matanbuchus | 92a2e2a124a106af33993828fb0d4cdffd9dac8790169774d672c30747769455

Resubmissions

13/11/2025, 12:09

251113-pbg4vaspex6

09/10/2025, 20:15

251009-y1lyrsyzcx10

Analysis

max time kernel
660s
max time network
660s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2025, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
upgrade.msi
Size 5.7MB
Sample251009-y1lyrsyzcx
SHA256 92a2e2a124a106af33993828fb0d4cdffd9dac8790169774d672c30747769455
MD5 a8ecce20e1279a8c4168cf94fa9a8529
SHA1 4b2327151fab85900f53dda504002d5e6c6019e4
SHA512 43699ed273edf0ba8021bb4532dfb5b63fc99ea851fbd7bef244f903f7806011548eb8902ce451a5121365a086cc0a139edf6bceca1f76bf8ef514b11aa0a966
SSDEEP 98304:jjV2IMWIqr8kfma9fQ5S26Zb9urOO/oePq2vZGIabVNGDD+K8kTMOqg1I/OmeZ98:fV2cqkfb945S/bSO8oePFvZGIaDGDaF1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

google discovery matanbuchus loader persistence phishing privilege_escalation ransomware

Malware Config

Signatures

Matanbuchus
Matanbuchus is a loader sold as MaaS first seen in February 2021.
loader matanbuchus
Matanbuchus family
matanbuchus

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
240	2748	firefox.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIA26B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57a086.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA637.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8069CE93-80D1-4269-8758-2DE391A5ABD4}	msiexec.exe
File created	C:\Windows\Installer\e57a086.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0D4.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
4744	HRUpdate.exe

Loads dropped DLL 16 IoCs

pid	Process
3744	MsiExec.exe
3744	MsiExec.exe
3744	MsiExec.exe
3744	MsiExec.exe
3744	MsiExec.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe
4744	HRUpdate.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5588	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HRUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000024258b225650624b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000024258b220000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090024258b22000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d24258b22000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000024258b2200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134045147459492410"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5024	msiexec.exe
5024	msiexec.exe
4260	chrome.exe
4260	chrome.exe
4716	chrome.exe
4716	chrome.exe
4260	chrome.exe
4260	chrome.exe
4744	HRUpdate.exe
4744	HRUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5588	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5588	msiexec.exe
Token: SeSecurityPrivilege	5024	msiexec.exe
Token: SeCreateTokenPrivilege	5588	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5588	msiexec.exe
Token: SeLockMemoryPrivilege	5588	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5588	msiexec.exe
Token: SeMachineAccountPrivilege	5588	msiexec.exe
Token: SeTcbPrivilege	5588	msiexec.exe
Token: SeSecurityPrivilege	5588	msiexec.exe
Token: SeTakeOwnershipPrivilege	5588	msiexec.exe
Token: SeLoadDriverPrivilege	5588	msiexec.exe
Token: SeSystemProfilePrivilege	5588	msiexec.exe
Token: SeSystemtimePrivilege	5588	msiexec.exe
Token: SeProfSingleProcessPrivilege	5588	msiexec.exe
Token: SeIncBasePriorityPrivilege	5588	msiexec.exe
Token: SeCreatePagefilePrivilege	5588	msiexec.exe
Token: SeCreatePermanentPrivilege	5588	msiexec.exe
Token: SeBackupPrivilege	5588	msiexec.exe
Token: SeRestorePrivilege	5588	msiexec.exe
Token: SeShutdownPrivilege	5588	msiexec.exe
Token: SeDebugPrivilege	5588	msiexec.exe
Token: SeAuditPrivilege	5588	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5588	msiexec.exe
Token: SeChangeNotifyPrivilege	5588	msiexec.exe
Token: SeRemoteShutdownPrivilege	5588	msiexec.exe
Token: SeUndockPrivilege	5588	msiexec.exe
Token: SeSyncAgentPrivilege	5588	msiexec.exe
Token: SeEnableDelegationPrivilege	5588	msiexec.exe
Token: SeManageVolumePrivilege	5588	msiexec.exe
Token: SeImpersonatePrivilege	5588	msiexec.exe
Token: SeCreateGlobalPrivilege	5588	msiexec.exe
Token: SeBackupPrivilege	5280	vssvc.exe
Token: SeRestorePrivilege	5280	vssvc.exe
Token: SeAuditPrivilege	5280	vssvc.exe
Token: SeBackupPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe
Token: SeCreatePagefilePrivilege	4260	chrome.exe
Token: SeShutdownPrivilege	4260	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5588	msiexec.exe
5588	msiexec.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
4260	chrome.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe
2748	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2748	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4760	5024	msiexec.exe	90
PID 5024 wrote to memory of 4760	5024	msiexec.exe	90
PID 5024 wrote to memory of 3744	5024	msiexec.exe	92
PID 5024 wrote to memory of 3744	5024	msiexec.exe	92
PID 5024 wrote to memory of 3744	5024	msiexec.exe	92
PID 5024 wrote to memory of 4744	5024	msiexec.exe	93
PID 5024 wrote to memory of 4744	5024	msiexec.exe	93
PID 5024 wrote to memory of 4744	5024	msiexec.exe	93
PID 4260 wrote to memory of 5184	4260	chrome.exe	100
PID 4260 wrote to memory of 5184	4260	chrome.exe	100
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 1620	4260	chrome.exe	101
PID 4260 wrote to memory of 3652	4260	chrome.exe	102
PID 4260 wrote to memory of 3652	4260	chrome.exe	102
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103
PID 4260 wrote to memory of 4420	4260	chrome.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\upgrade.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5588

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F58EFEA2C68FA3464BAD18B8E201A8DA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3744
- C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\HRUpdate.exe
  "C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\HRUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8af54dcf8,0x7ff8af54dd04,0x7ff8af54dd10
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1980,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2276,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2412,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3212,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3248,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4320,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4704,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5360,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=252,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5456,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5380,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5488,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6072,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6120,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6116,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5296,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5044,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5104,i,13940511642951048250,9411357617336090602,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:2992

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:6080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27099 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {5417275a-308c-4e82-845f-3933cb794a02} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27135 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {2e927a7d-67a8-45f4-bd47-2ecaba886f86} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27276 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {7f5d4fd4-d0b3-4a34-940d-28839b6bd2df} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27276 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 3792 -initialChannelId {4521fbce-27b0-4f99-b7a6-60e7a89b7de2} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2584 -prefsLen 34775 -prefMapHandle 2588 -prefMapSize 270279 -jsInitHandle 3392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1300 -initialChannelId {a7e54c91-8947-4b26-9e08-c9e14f082422} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4852 -prefsLen 34959 -prefMapHandle 4856 -prefMapSize 270279 -ipcHandle 4828 -initialChannelId {99dfb481-5d95-4ff3-95c3-e80ea26b64a1} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4960 -prefsLen 32847 -prefMapHandle 4964 -prefMapSize 270279 -jsInitHandle 4968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4800 -initialChannelId {52af7b57-6524-4f16-9ec2-2624f1dbbcc1} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32847 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4936 -initialChannelId {218dd037-cf0e-4324-9d08-058b2986526d} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32900 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {dc86848d-8170-4a00-93b4-b8e873fe57fd} -parentPid 2748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1328

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\SysWOW64\msiexec.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57a089.rbs

Path C:\Config.Msi\e57a089.rbs
Size 3KB
SHA256 985879122b8db7fe1bb912c9ddd016952955f912573573792a61065782990079
MD5 f320ab7366e9708e2dc0b443422afea4
SHA1 ddcd3bfb4d33fdab7b638937834b038ee3d92e38
SHA512 5b4a89d141d41187f4db6bbec9b76a0de2a1ad4916b1cb6e01056ba49283f964e8c1887ec8515951b3c55ac8f9e4600d8be9053c24d3d945fb05e5ba53d930d8
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1468b15f67a8c119f87c71d5f40297735954a4c39209a3384991897fde911096
MD5 1b4a1cedbc5f1fe68c3639350f9c02ac
SHA1 bb6a842aca4342e76dc4d09fcaf14a73a2bdb179
SHA512 150f38f925ab8f9b1d5d8e6597ae0d9a08466c20ecb65197b4534a38518aeb894f6175292cc1a0b2171cf92bc9a6ed34616bedc16a16085e14eff38582ffb36d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 84199bd3e1d1d9a7c2c69af201ca4694dad769fde9f11a4200479eae8efe41dd
MD5 92a0532825c984f8976f770623e7b430
SHA1 28223694042a9ad6c0650ff507e1a383dfaa6000
SHA512 1a49f1ee000cb1e6ec00bf273e8797af52f0d92887ea86ebd62df8b8f88405c9f3799affba5575f223887eb547825105870dd8de761bfbb0daed820d5f8266ff
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 549991cd7ce12007f58dc5116768ead8c084a2059333fc4f5f9689ced6b600ab
MD5 343f97ad3aa58beec0488fedbf1979f1
SHA1 b5b85a02d18a2a7155f6b7985cb5738340daf21d
SHA512 b40b58cfd2ccb2fef94dcc591e3e1003d842171e7607c30016aebef7b31eba9343b26c1daf3c18ee582872137d6a0c4c01ec26cd5e48bb1a1941933aac6521d2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1583ea62b838b3c152ce6f32d1a7e6bf0783f6eb2919bf5c757a96fc6e28d2f6
MD5 b68ff12bf8c0c3ac1b7d067907f959e6
SHA1 1b87b49e5060149de0df82f64781033aeaf6d38d
SHA512 9d32d4b43685a6a4b5961b59f415b7033640a684a0924db2b0c0375768e0386a6cce617ce883723d5e0df41f362678cd5ba55e540c7dc8fdde4b6e59141fbc04
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 519B
SHA256 082705204996b44fde3f2bd07d31ecc35868f186fd89ebca81ffce051f3401b8
MD5 c61b16ed5df9f893d5dc75d5e3855c53
SHA1 0f61a18615aed6b95da09286c6199dce5f9b9e5a
SHA512 672f837824d3b5aebee22112b97fba105ae3c700c0384ca9cf4176a0f487a82021d3361cf357a948c58f6f7075efb7641b86b5ecd7e863d11a5864110f2e6413
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 aef805a34e70b0a7a87f9597994eebd43c80dff67516fe9e5287d23b92663eea
MD5 bebc9fc815d4f3a3be44657bf1f09415
SHA1 cf4185b375c82c901f59371ed50c03b5883ac8f5
SHA512 daad3fe66ea9241efe98c5ade9ce4b1286b48d315695b0aa478e9e1cd74855f96e4474fc0d8a06530100dbfebad72fe7e3c827a1723d055ec2edc1362bd5da2b
SSDEEP 192:f7YN8SzQxb/uG3L7QSNtzsOZ8PRpAYHS+WN4N6WozNRIQkwYXpQyIsnA/g4:f7YN8Sz6bB7jtz2XAMciXozNT45Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 ccecceab6c5987506ea4d658c18308df12380fad9e81e2605bf5827be3640721
MD5 7cecc91a91563205f717ef0819e5e2ea
SHA1 591b086664511e5422c6b63b893c41843506cd6a
SHA512 3939e24205e7f078e2a66567b67489eb8676f30c8fac5500ed76efc21a62b67f3113bac97f49777a62b3ef964680ce1a1811b88d1574484000102ac895964ba6
SSDEEP 384:uiDF7pLuLceiWjXw9PkXqKf/pUZNCgVLH2Hf1yDrU19HGS3eQeREhw:u8F7pLuL7Prw9PkXqKf/pUZNCgVLH2H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 6f81badd9f815f9c147503496d462ba47c77317ab1a191c92e29f1ade31a6612
MD5 c85177786fce66dd2efd0e0d3e9ceb02
SHA1 48b61c6533070f1c43b5ad7f1d33b1c91e786ed0
SHA512 057e2427c4dc919e35d0fe1547f8027f26b6d48e2ed660f88d8662bcc3b3f8816c9f038df6763df5a7621272f8cf97bc625300859b5225aad3d0a30fdd038951
SSDEEP 384:uilTSK7pLuLcBj7pLuLceiWjXw9PkXqKf/pUZNCgVLH2Hf1yDrU1vHGS+SzQeREU:uCz7pLuLuj7pLuL7Prw9PkXqKf/pUZNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 81802e8adc3df70e1a79dde612bb25f95e3b1b7ef678e01e6a5e8fd179418ee1
MD5 778e3fa81c74c6b53dd4e6b9a7f1e2e4
SHA1 ac471507eedefa2f97c2b593ab10b66ebaa0067f
SHA512 da46df2427271e2cebfebe1d0210c55e5cf4a348a130a6f9db4dba58e8cf172f818a41ffc3851928b1b5dca1dde4061f2a40a60a7c05adf30643aa809c4b545f
SSDEEP 384:uiDj7pLuLceiWjXw9PkXqKf/pUZNCgVLH2Hf1yDrU1vHGSVzQeREhk:u8j7pLuL7Prw9PkXqKf/pUZNCgVLH2HL
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7c5f5a360fe074a0cdb4fcc7279a9e1acef185c66f1ab6d095b93b3e44a009ae
MD5 8f128cf40a4ffa60b616caa978c00924
SHA1 00a182fba00e368b66d0b6ef8a8d27d272c1a1a3
SHA512 23a3f2dde80322cd1feefc110a9cc69e177541278bb332060254cdd27b268bd293090f509cae7d4b09cb28919d9c842a2c9dad82689b3e3670f9f6b7daa8a569
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe582362.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582362.TMP
Size 72B
SHA256 b66021b985ae624961ea9e5f1e0500c6c4cda30f9a2b57f6296aa86051efdd8c
MD5 0d8af65e232531c74b6eead93011f808
SHA1 f13ec6d3e7bd41343b8cd4530fbbea7a93602f49
SHA512 584cc18b9db6157658cd14188d22a8a1993ee3b57414de4d1ec61da0981b390c59ddf7da091418c406c0ab1c8c455f521b0cf2c6180a316b4c873580de1e0b63
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 ed073f290ba9cf0a870824de9b75f78377579bf702c9afe95539cc4406bbbf09
MD5 2f8afc14456c0929186f07bd1c64e6da
SHA1 c70cae75704dbf77f90ac87b5c3c1e48e20a4511
SHA512 5e6e3500e02e36550ec0558da05c74dbed9c15981440a67d6fda7d8f22fc1fa842bbd2f6e9b06ea4dc68da1b8026b39da9f56adaf978e5dbe9d8e2f9232e6cc7
SSDEEP 6144:2Gdp+etaHJn33M5cEPbBQoRTt8JrTnGfzF+TwMo:dptiFHM5cEPtQo9tWHncFSwMo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 7a533235f5842e03bfea9d120526024dbb2b81150b7ce69e88309c5a962a7bf1
MD5 2d9132df1dce87ecdd934c85c764e3fb
SHA1 f2952cc98fab786d1748a50eee4eac0081cb92e3
SHA512 7ae7bfd0ba91e7bd13cdb82c4bef69d865a7c5ed56686c889788b0a3b8f5b5578b857f148ef5cfae9a47fdf6cc757e74a2500cdba52fd62f184c50c5210b8dd6
SSDEEP 1536:byXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM+:uXjM4rTmN5eWvStRNoV8cWK7XF+TwM+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 84KB
SHA256 5ca2dc13fb22e14774e15906aa71cb4e6a6003f8a914e63993a3dc96397cfdc8
MD5 4d63ea9f37b5642439ee5702cade0bf8
SHA1 3e100d5918f7abc0eff22412d1a0beb48b47d1b6
SHA512 83c63e0ac26141dfafa38c45ec73d964dfc078181a18e999f630ed7e18811041fe6ff9e9cc86fec9cd2f9781a987923425419ac946f4e65394ec22c6268888cd
SSDEEP 1536:YyXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwM+:XXjM4rTmN5eWvStRNoV8cWK7XF+TwM+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 f47a6ac9ad1dcdfc0a255d55a9bd432b49909d919a715f48127b81bc09c1f316
MD5 b2b2a71baefb5480a6fdc905bc09fdb9
SHA1 328f0ff341f8ea6e47c0c56d813c36a7328d4308
SHA512 44566a99a934a7cd4a9e06abd7f9623878478755ba385eef30c245b9f8b989096fc80ab91d318b4276a3025943c4c80a57ac516ed96f7ff7b4af80954ca2314a
SSDEEP 1536:NYXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMT:+XjM4rTmN5eWvStRNoV8cWK7XF+TwMT
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yvr20lbo.default-release\activity-stream.contile.json
Size 4KB
SHA256 79da2a9610eb8c9c59fb2db99fed06120c00d1173c1bdd4783db449427733524
MD5 259d4d2ca9bafa76b6c990ebe7a989e3
SHA1 4f33e3f66273b880b4a773da87328e345d5e4010
SHA512 1bc96d7d7a2bf2644553988841f29f1170c4546055a6bb8807f59120b0b2efacfea43c94d0c754028b9c9ca1a5f6f2bd27bc46c0966cd782a6677636fe9612b7
SSDEEP 96:BL/PtQslJtxxmbPMM8PCmohqVQ2BS2lgprQIChqCzlfsxkl:BL/PtQslJtbmbzUCmoMQh2lgprvChquT
MD5 SHA1 SHA512 SSDEEP

Submit Download

C2717B99982B5EE4C407BE5FD5A3BE0F00D7649C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yvr20lbo.default-release\cache2\entries\C2717B99982B5EE4C407BE5FD5A3BE0F00D7649C
Size 14KB
SHA256 ebdac05c10305be8cbb18c9b1f7c5d9d744848b15a31978516c5d0f87c861c01
MD5 3964b0957a5c0290fb326e59f9a5c73e
SHA1 c8637b963f7f08965b737db25dc03f8ca8a66b7a
SHA512 0d1346fe06e8e36a8d8e249e2ccee03ae430a2c4d5d7b18619b02fa7d88373b2d1d2f3624e6e028abe7b449279ebefb267f6385738bfa866da93887d09c8f962
SSDEEP 384:HsLEiO024Yc7hSznZOML+CbcxDEclrIVy8eOuI:MhZYc7hSz8MLPbcxDEcVIVy8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yvr20lbo.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 b6124200a1821a7f9ce5ba29e0c9b728edf4640c1b9ea6d25cf465f6eafd2bb9
MD5 3bc573aba390531e28fba4ac870ef67a
SHA1 dfaafa8cfc748945f3bc82476fbefc51c1533358
SHA512 517c86bca0af64fe164f4852a209311b86bb205f3d188b0f3f04f3f8fff4043c65a552f17efa3eaa6cf4ad004d25e9fa2cab9155176c2e13bdfe39e7b2a6c778
SSDEEP 3072:j3l2mo9fDY7x7VpbrYhM3oQG0tu7z7Jn5EEh:p2VDYXpbrcM3bxudv
MD5 SHA1 SHA512 SSDEEP

Submit Download

4883f6c1-a46b-4c7f-b14e-92e392a0016d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4260_1830431722\4883f6c1-a46b-4c7f-b14e-92e392a0016d.tmp
Size 161KB
SHA256 23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
MD5 d6a332ceaa785f20d7cf0ef7b9fc4790
SHA1 65f275d0b2d7b017fc8727298498dd43833d0940
SHA512 d79eba8bc96fe187f1284e7c3adf9323bd0525f73daba3e6f97013297588119256aa1af82ddccbdff5483b466f22b1846ee2f44afeb84fecd7f2c6951b7aa659
SSDEEP 3072:D0siC87t5FyUgTnPw2Aee5WZ/2gtjccLyD1FLrhHopoqxPVv+J09vXOj:3MTyJrP7xe8/RyDf/mpoGX9vXOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

DuiLib.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\DuiLib.dll
Size 1.4MB
SHA256 1a03fd6fe8afd6d4f855a327f13e56059c52dea6f4e5ccd326ecdfd6fa1c93a3
MD5 c6bc89937af33fa577c1cbbf85ca7526
SHA1 7ae41e5fc130948c17065e4a6a0784ff6343d50e
SHA512 7b0b89e028d3d18489a6e6e156c9f1adfc1408782c357d261af0e5c0e2b4c32bc2e33bbc6f7d73633b017cbfa9ab74692583f573c355316f6bba5aafa6e542dd
SSDEEP 24576:Ou2ldkWs2X6iRRjMkFITLCyrfJHfSpxpp8FzIVjnD60xf3BKjsbC:OykinCyrf2mOD13BEsu
MD5 SHA1 SHA512 SSDEEP

Submit Download

HRUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\HRUpdate.exe
Size 625KB
SHA256 6246801035e053df2053b2dc28f4e76e3595fb62fdd02b5a50d9a2ed3796b153
MD5 2461908fa177643eabef737ce8a73b52
SHA1 11f7e2224d3a8fa8f67d300daed8e7d1c2f1a4e5
SHA512 e021ff35bda0b852a20668120a6a8807eaf4f8ace2f275bf4b51f031d70e3e313bf80586f4f6acb177c09dda9742000e2d8d2d70e54af4322deaca721272f71a
SSDEEP 12288:RUGjx9cIisPNAk1hdph04Ji8L5+WmWHA0ZyBsZBjWaDGap:RIIisPbW4Ji8gWmWHA00mZdOap
MD5 SHA1 SHA512 SSDEEP

Submit Download

HipsDB.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\HipsDB.dll
Size 357KB
SHA256 e6502b910f42a7942bf90062b8d3db511d921c6ee656b9cb41a48f070bf7f54d
MD5 981f6b90a4aacfe739d9ef758141c76f
SHA1 186d95ed1b175434cf7e4571b0575b569cbf483e
SHA512 17117a62b08844780e14cce6b54a62964ea62b39f70d33cbf24c1aeed33eeca7c22da6f758b70ee980c1abf1f61b0de827ff4d6118565ece2f2f2f3525511533
SSDEEP 6144:ZQq8vXhlKfqvkhUIQfT8hZuREsDRDL5zX50bjJ:ZQqeR2q8uIQfwhcesDRDL5zJgjJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hrcomm.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\hrcomm.dll
Size 140KB
SHA256 ab8fb729c5ec826b261c177918f034712fd5e934f0c8eea7eaa0e8b9f8fb121c
MD5 4d43fab2076afb75aa58bb4477ae2ded
SHA1 31a7e6417b33013ccc9d93862d65c6c0b10fd153
SHA512 d62fdd22af810680696548ec9aa8e11799822cff14dbfecb5241b3fb7a99ca7be5b212812f2771a86f3de5afc0dc020fc78e42e5bbc6a3a140f19263c596da04
SSDEEP 3072:HmNvpFLB+Oy2lsxLo+dQv7IbMTwaipUJ3NYfNAN:HmNvpH+ONWo+dQmpaeAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jansson.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\jansson.dll
Size 156KB
SHA256 f3ed0e3e54e8559bc05c8b17fa3edf0be5a62acbfd09195c35cbd7bbfded70a4
MD5 c23567c629888b0898311b6b5e1527e0
SHA1 5a20885878e439bb194e404ce734362e8380a630
SHA512 df48a405de3d255c840ab85d87a590c122f75ef0a270376a8da5e26d02d693577c6ca570a7b3f756c6ed7f736f7ba6ed274a71b2e980189dc04d09208eb0e8b7
SSDEEP 3072:Y7bg1ffgZi++Fx+dimXGI/LuUJ9becc71cxXsgkbgNXu:Yfg1ggLIxGky6LFslaXu
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\libcurl.dll
Size 2.1MB
SHA256 b1c446f737044a8c82dad6456603acd285f68693e6b92e73d6ce3f65ca9fefe6
MD5 7a56fb38a4b5ca3c7d3c6584a4461c02
SHA1 69919bcfa22c618010a35b5a63e7b512d75696bd
SHA512 9192bf8b507b38fa1b7486e9ee17c35fa0064afaeef4fa76bd74d116be08de9c35d4de4e795c31ec5f5f0fc3f7e4cfecdfea079efd9e2467b48e9ffbb0976770
SSDEEP 49152:lkq+KOy/M0m/BAaZz4C8JA8YotPUxutwnN1YHNsLvK:lkq+i/aBAEf8JMoyxutl
MD5 SHA1 SHA512 SSDEEP

Submit Download

libxsse.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\libxsse.dll
Size 1.1MB
SHA256 e30e12e80b17821b519e5ea6d60684e1c1775838ba673e1b18eadb892752ef46
MD5 995eae069381b6f1aad68235afaa5589
SHA1 afc5968806cc88e43b4482e6051fec9390d7e9be
SHA512 5f29ccd6b776b8c0b79bfebdd9e7c74804b109940b23959120b79b7c82c836266fd3ab878e6bd68c3a7e707bb35b091d18b0cf848529d687597a3b41d6a7d3cd
SSDEEP 24576:WqlzgzQL/huJPGyTA+vM6UDjUaKwqAvOquOfKNi:Wz2LKwNfuOfci
MD5 SHA1 SHA512 SSDEEP

Submit Download

selfprot.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\selfprot.dll
Size 144KB
SHA256 3ac90c071d143c3240974618d395fa3c5228904c8bf0a89a49f8c01cd7777421
MD5 5ba4153a662315289bb6ed526e34e921
SHA1 d39d5e1f6e1621659cc65f65d317d5dcad356869
SHA512 818c3a3fed000d652b2fab87542612c114b88082e62ef009aaf4311ea3bb17f51e6f6fde8185e4ef730d13e4b888167fb58c1ac597aeca3142db1824c16d18ab
SSDEEP 3072:lkAWsVsT0sR220pCzJAUQE5p4JDkQoLy2TKCwwKa/tpuOxVhN:lzWsVW8pCzj5p4Rjwq+KyNrhN
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\sqlite.dll
Size 1.2MB
SHA256 ac2237c3fd7f12919278e33de880487d3f78a717e120e3f8dd3d3f2b689de519
MD5 e1c44774ee731e7a5282f06e3fba05cd
SHA1 0125f3b6ae007ae96fb3add51f1adeeb6ba22abb
SHA512 b3a7c4066a9d293376d878c1ff79095cf49c32f8e36c5bb030a9c9cc4b93186b0bffa8c5b65de88b33f2e90625240b46ea9e5c40947d85ed9071addf3d1305a3
SSDEEP 24576:olE0Jg62u97X3AmHZtLpuygJevGRFgU95Uh9Mxx66iwIHQFVGBw5x:oG6F9z3D98nEKpAwFVGG
MD5 SHA1 SHA512 SSDEEP

Submit Download

uactmon.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\uactmon.dll
Size 394KB
SHA256 c8fd0d0074f09ca4c14a65ff2b96ada9e3e8c615aa52a361541a79ca371cfb1b
MD5 09b72a405f59cfdc72e0acc0a3c6c1e4
SHA1 0316ee3d25b8cf07d29970da1250266b673a54a2
SHA512 b7d0dbff9cd2a93defc97f4167aa151ffbe3a5e028040e8bbea246b6544ebb6ef01447aa1c7be75e339d657d7d37d4f81b333702a32db0996e96b37d2f555544
SSDEEP 6144:capEHHXoDMqk6V47Dtr+r+WLJdLnOyAuZKhcsFABk00r:JiHHSk6V4nte+WLb7OAZKZFik00r
MD5 SHA1 SHA512 SSDEEP

Submit Download

upgrade.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\upgrade.dll
Size 447KB
SHA256 0cd168f26b016d20a1d5256fe5e603e63ac709db4cfee74999b9408940d8676a
MD5 e13b16d6f76016a1004f00c86edb982e
SHA1 f8bcc8b5ecb17141c51cf54ffae6bb91c2fddb0f
SHA512 aa100a1c0f5661fe467ed94acfa362b98436c5efcad35eb58457aabc07fbc5e1f7a2568a1f1ee393933e7baedaefda65341c16cd3c86b50dc4084b878c969b38
SSDEEP 12288:y6AwgyYgxNpAMODOUQFMZV0+2elg6ouvvAdTTzduqZpxzFRqW:KkNpAMOQr6ouvvazduQxzFRqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

usysdiag.dll

Path C:\Users\Admin\AppData\Roaming\Cerevia Systems\NeuroLattice\UpgradeSysLib\usysdiag.dll
Size 524KB
SHA256 07e7432e0eec0b8646b9f3f4ca1cf03f9ab9a8ffd8de5c6765ad7aa4dcf786a4
MD5 b8dce4ac19c298436ac6f6f72afaf6f8
SHA1 8bf7c8cd1a5a5300a7856c927a72c349415afed4
SHA512 1d5ee6382c6cf14decb5e66b5ef5c06fcd4428311e21564170cf343173fa1c0195359be382758e344e64b3d27e573e204f3d3ad4f4f3fe1cc1460407fb198d4f
SSDEEP 12288:sK3TYp9nydWFxqy4S5NLsWpkk5U9ST3HlJ4EAg7/fFLjVtH:sK3TZdEZ46T3HlJ4EAEFHPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 5KB
SHA256 d60463041a85dc9846246fcd2a957bcd8ecdb22b100a634fa4700ab5a1feae3c
MD5 523e51069925c195a37cac4e86d24b95
SHA1 77405b332cdbd70e2fd8deaa77abc881cd591300
SHA512 ff76105be17a7ed6a5107219eaf1ff9b10088dfc99597e766017b5ced6447e8f35dd72de35fbaab396d304feae8a224d5b714c52fec2678941bfe692295faa79
SSDEEP 48:9LzUd5J5UgdwrVzKLQUd5J/6BdwrTKLqUd5J/adwrhv:RIEI/7I/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 33922c1caa812030f2d329eff5bce6bfd751858e8900a9b648a340c1ac1f7dfa
MD5 b2816dfdff377ee5a6fe52cea6ec07ed
SHA1 be3ad30adc68a1f165e761781c401a6780b8d6bc
SHA512 4b90aecc11233cb797c8c83ba4b5dce100645d02f7eff56e0b4385ca03cc9cb9e3b8873c7f32e653939841bb1ec1ee72ab62d692db50e2a371672b5b6d018280
SSDEEP 96:1kY2qyqqqaqZ/dFl66JozGzgClKtmSSd/URUFQxtSdF95/7bkW60rcEwzEJyUR6A:151/66JozGzgCl6mSSdRi3Ov5zbowbws
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 37KB
SHA256 16d769b65991f735789014cc4b271960db2a3284e3fc086e7c59fe9850aff59b
MD5 1540ddd82d367051ba64aebc71c3ed75
SHA1 ccd442ae99f1d7ce25de972d6876a5fcfc958107
SHA512 75eadd6531d4a517cae122a52c3ebc894f409ce218eddaf11dd6084c37aeef1f1292616edfef853edd0dd3b393bed277d2826ec405e7edb32b97e588accc9c10
SSDEEP 768:1lEgfCbjF2DXAGcmhuUKPYEFCjYJniT0bvbBDbibobdbXbYbubsCmRo6t:cbjF2DFokCmRo6t
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 235c29e0c6172759540b9f2900fe8f931685aed8a09aed9891631366e6ea751c
MD5 eb72c2013c279780f99abe7ad9179d94
SHA1 1eeef53a9e62edc8d2b97f67822628c63e12cac9
SHA512 f3c649648ff130b4cd78ac812b5736e2caaae474b02ec121505c719479fc854e988e5bef3d622a6a6d75a3640e1275740c3f15c9316c96a1eddc0bb52c3bc0db
SSDEEP 768:ClXYDZLtc6GcmhuwKPYEFijYJniAgbvbBDbibWbdbXbYbubDFmRo6Gf5lEv:ClXYDZZIDlFmRo6X
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 37KB
SHA256 f4813b9b9de54335244eca390f14238afd09addc4a3dfcf4c947c5c64b255496
MD5 366cc2b3db10781a1dc8403268753138
SHA1 76659058c6cf44ec20a7c98e2646f47743ce5045
SHA512 f0966a03b994ba5344dd58cd44b12a920781b5a30b2eddccfaecee6e8af0e420de98230406c02f2194da2ec140741d282c5d97d7255016d546582491bb563ada
SSDEEP 768:hf5lE9bjFcDXAGcmhuUKPYEFVjYJniM7bvbBDbib9bdbXbYbubsCmRo6t:0bjFcDFXnCmRo6t
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 37KB
SHA256 f1a1ee4e84eef020fc4b35318b7548d82f06f63f3712fc7cb48c6ed36c840799
MD5 0266c862ccaae023c7322c0b4bf95b8e
SHA1 13dee8bdbec49dc20f66726858c5286795683f14
SHA512 6a46a042651de751e280a44fd55c4cbb5f2359ae79c69de0faec9efec65326a7cb782bf3a23fdbaf5dd876205eaa0e038121c20c406e1794098b82bc866a66c4
SSDEEP 768:GbjFcDXAGcmhuUKPYEFVjYJniM7bvbBDbib9bdbXbYbubsCmRo6ulEgfW:GbjFcDFXnCmRo6H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 37KB
SHA256 c4fee499e3d6cb49cbb6b81423d68f6e2bbc301337ebfb2fc96669555e256daa
MD5 b0b8a6c954549f4902b5b922564a66db
SHA1 83f2117309e5957d0a36f6ff2805849e1d1e2b38
SHA512 fba24b5a7e8e69992eab9edd47fc9a15404811655d5f4d9bb59ecd4d1f74cbdff2de1568201706b6325fe0c97c5c07f899503fcb1fade11b325faaeaefed38fb
SSDEEP 768:1lE9bjFcDXAGcmhuUKPYEFVjYJniM7bvbBDbib9bdbXbYbubsCmRo6GfW:WbjFcDFXnCmRo6D
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 fd2d9ee9176451735d155669ca0fdcea2ba7edbec501dcd7b7c2f39324180986
MD5 331af23bde2d8582dcfb7d511df107e8
SHA1 9359b1f0db3255c7d69f62547ffe47223ba0c22c
SHA512 d75969e6fe92c474d412d1cf4af950913e2969387e903c0caaf49fde0d2b9c98260c14312d11cf7c62665597992becc05f9b1d737717de11c0eea26ee981d4ea
SSDEEP 96:1kPQqmyqqqaqZ/dFl66JozGzgClKtmSSd/UGSdF95/7bkW60rcPyUR6rWZ:1Tr1/66JozGzgCl6mSSdzOv5zbowCyjC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 40KB
SHA256 f19056b20e4c0243c34c5c6983e44fd8470b2d6542327fbb06bf8e9e7125e096
MD5 f201d6a7c7eea11fedc73d815d3570b2
SHA1 4b58f49f1624128f4e2fa9aa9533596f00cbe30d
SHA512 d8ab9f90f75521644eddd3f551cce03a0987ebf1f8e6aedde2e1583a6c9210437290416b72296c5d2925bb5beed2b2213b03b904649be431f94b310ec744ae3a
SSDEEP 768:1lE+lXDmUNX6GcmhuNKPYEFWEYJnFVNbvbBDbibYbjbXbYbubaFmRo6GfW:JlXDmUgvMFmRo6D
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 51f53b8535ca2550efd54535ef0565c9bd4b12877ca8f49a8e661ba366eedf62
MD5 1ebfda95d004d30323b7bb5ded31face
SHA1 f10564878bf01f4987ff2b8fa022212492707f7f
SHA512 67f41b9441ae8650b3318081b9c314d5b583fc3c9fbbdebd7f737454b56f98c87379c65cb5eb896fedce7c759a0d19ffb824c0840d93459556a9fd008b8e3522
SSDEEP 192:+i3Ov5zbo9ZwzQyjnZaAa+1/66JozGzgCl6mSSdz:+iIbo9ZwzQyjn+Y/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 8b30520b32c3c0fec2d6054c84f38852f5ed3c5f40c87167d8f9ebfd2301b095
MD5 c940a23460c2211b4765ac40e3253fc1
SHA1 8a98aac48d6acecadafa7bd0d16a248191c39917
SHA512 36c90f41f15d3e11af794917818cddb39bc6ff86049bc767456248d03217b2cdeb1de3f4c232fe08710404f85e5c60259719ae6c962f936ed3367e3549a41f3f
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ea8ea9630be3182b95c70978e0e6fbe26e6168bca0860b9cb85a902cb1f1bd89
MD5 abc1da9251c1f7c256cc234540f4bc3b
SHA1 1de49a49a6e1fb2b46e6cd55b73c85deaebf9ca5
SHA512 e990830fab28b50085bd3c310f77b54e0fcb96a2ee5704964aaf7c2e2d3bae0c5270160ed657951e08ab332a6a034ac296563518887add1f5204736adcdb2274
MD5 SHA1 SHA512

Submit Download

05a61987-8ad6-43ca-94b5-983dfa703cf7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\pending_pings\05a61987-8ad6-43ca-94b5-983dfa703cf7
Size 16KB
SHA256 e3522ede3207d41161f8df6887a123828cd25510224d90148ea035e15ec6c102
MD5 a70155eba92d3e24aa8f4ad00d2116cc
SHA1 ed8667901e69ff216430c57a1d85a57340b3289c
SHA512 83468df6c9b87e39512b551ab15d56d271506137b227dae4d89d7dc36a52d892e54791d5da026bafa4b580065334627656a0c27c101dea7b554907b7ac2a2c7e
SSDEEP 192:77nagt+JLco2f5w9tZYcKobcKxz5EukL/yD4IaA05g/dI7CP35gY1FQt8Ijq4fvw:7WQfy9tZYcKobTxtEuvbyj8Ie6kXv3R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

3a4f651f-e1a6-4336-a4fd-84300c862742

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\pending_pings\3a4f651f-e1a6-4336-a4fd-84300c862742
Size 883B
SHA256 9e5628e2f5768cd75c05d44fef9cf9cb610002615e49402a4f4844b173aaecbe
MD5 5ccad84bcbf00e06c11b9f7e35ed5737
SHA1 fe7bbce0a9d096e4e61242c889afc62f444cb7d7
SHA512 3a0431cad928dbc1afa29e0f13bbb6098eb8e42ef6bb7828217361a6cbf1fb2f943b5b16eccef40fa51ae83979e582a81ccabc3f78d4c4ae2b291b11a6960c47
MD5 SHA1 SHA512

Submit Download

48113068-71bc-41ea-82dc-d15de652954d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\pending_pings\48113068-71bc-41ea-82dc-d15de652954d
Size 235B
SHA256 4029114e66ffbd858b6acaabfec33ac1af268f862ca76a124d40607b4f4bc87b
MD5 a7e30c9c69aa3c1f6e042fdd76abf763
SHA1 ab683d5994278250029489b7fa83eef96fa19cb1
SHA512 a352acb3007a58dc837226f9b4249b49454e7ca75fa824f8e71a14ecb0e33a197fa8c2cf7ad170157fc96fb028cd9e4773bfde873ec613d1155fc5cbacf3810c
MD5 SHA1 SHA512

Submit Download

512ed9d8-0b47-4683-b23f-352aaeae4704

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\pending_pings\512ed9d8-0b47-4683-b23f-352aaeae4704
Size 235B
SHA256 b4c1ac3dacbe1866efe0ffcdebc1ab47c8e73a622e9de7d124ef4b8056275bec
MD5 afe08f0ead55d9a6ed8b9df4f676aca5
SHA1 a61c6902c960915a57cf95ef3536c1f946889a96
SHA512 629287011460777563384601fd6f85baecea86a6c3a389f8a806c715cce740ebfdb89785c2bda4cbd2fe855255d493ed686e47d7ff2b513b9d5258384beb96bc
MD5 SHA1 SHA512

Submit Download

91cba69c-4e68-4563-a6e8-e4be184e761a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\pending_pings\91cba69c-4e68-4563-a6e8-e4be184e761a
Size 2KB
SHA256 e04405fac08de5f134c43e16290a17161307de3f57a018431d79026901acf1b2
MD5 fedba23689cbfc179670508baa8f15c9
SHA1 005e6cc9bf8909bcf3b8fe06e4db1ba5fe4b6bf5
SHA512 12ed3c509759d218fe367679bc433a296569b7727df6410b501f4bc00924831ca85573da3c120a271d2e9bdcfba8473be66b5a7205a499e41832b0aa4f7812c4
MD5 SHA1 SHA512

Submit Download

f638ddb2-37b0-4379-9356-bd944f1336a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\datareporting\glean\pending_pings\f638ddb2-37b0-4379-9356-bd944f1336a7
Size 886B
SHA256 0d297e60418d6c91ec88126fbe876ed14fc5df9199ad420962e85d53cfb47094
MD5 f3d774ad145ee3067ade89b4416eaac2
SHA1 cc0304be8dd23181035749d6de88250868f4b627
SHA512 a2cb49e6bcd02617a66a8ebfb414fd9624100a6f4772f1fd6c71d35a0fdbd1227a020721a6fe1f487af15f0a73bfd1bf4c74cd027c3042ecf6565a803269b702
MD5 SHA1 SHA512

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\extensions.json
Size 16KB
SHA256 7aebd36b9c7083571f191c508d1f1e06adb74f353d278eadf7d0443fdc763328
MD5 42da6273a5809096ca29ba712693e6d3
SHA1 03eba48573d123ef7ef527f40d5820bff4c45a43
SHA512 8da4d7dfadedf42fc909ef6598631f6eaf725e30a9856211f0cc045db2f7b98c9341b29e0e2e38e7dba4f15808b4bb353ab62f7d8ad91ea26f738b0e96f98c27
SSDEEP 384:BkI4v9Umldvv8dhWv94zj96oCL4HPL4PiL4HnL4HcL4HxC4hh:yI4FRfsXm4d6X4z444r4W4I4f
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
Size 1001B
SHA256 4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce
MD5 32aeacedce82bafbcba8d1ade9e88d5a
SHA1 a9b4858d2ae0b6595705634fd024f7e076426a24
SHA512 67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
Size 18.5MB
SHA256 3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648
MD5 1b32d1ec35a7ead1671efc0782b7edf0
SHA1 8e3274b9f2938ff2252ed74779dd6322c601a0c8
SHA512 ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499
SSDEEP 393216:sDgMCmTAzkHn48M/i5hE//jTnb80OjjF0OUSFypUor7dmzHfC5t:nqAzkH4Z/S2//jTnwyiIUoIHfi
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\prefs-1.js
Size 7KB
SHA256 57adedc95d9c4a5e89d07bfdca0fe7b143c9365e6b49f816dd74acaacfee3750
MD5 839653c3c3b0002b39003fec592049dd
SHA1 0d1cb1a307658153caae26a6927c422a0f6abcce
SHA512 57092cce6d1b84d7ea49020c697c07c5123b408fbaf3d780e6837cbf312c2e8da7736eca55661665b2035ce45fecffc4bb06677ac7af03c82e8760a17642fd15
SSDEEP 96:xHzFTU+BqGqufCwlF0KPnXObzSTBSSlKdv9j2nOYRH7RH7Bw88rQF8L4cnyVjfVq:RMRufXlS4X1BSSEY9NBw88MplY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\prefs-1.js
Size 6KB
SHA256 455db658f93f428f228d56061d1d498b28b6e3324ec27db0fa236f7dba09e669
MD5 f5bfcd33a62c202f6d2287428714d376
SHA1 778dee831e22dbb26d73d1d576265bd8fd207bc2
SHA512 6c722312e4ce61a1e99a8066a444b2241f133c66e1169bb13de002b8590ec23431233670760b906ad6dcab85f91cf2331c93ee3b572dccc0bd2a35190ee14049
SSDEEP 96:xHzUTU+BqGqufAKPnX1zSTBSSlKdv9j2nOYRH7YBw88n8L4cnyV0fVq:RRRufA4XQBSSEY9sBw88TqY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\prefs.js
Size 6KB
SHA256 54306bce35ef1f2cafc62d6c88907dd04cb6f3a294adb65b809d9bd983f37bce
MD5 45bcf2081d2186824351343cea8fcbec
SHA1 84807a32447bd0c71e8140cab159bc5ef88daaad
SHA512 91fc8fb1b087da653fee5cb07ede4d927b1c2ea4674d775c7d50195d9158076a4e48d12f91d740c6f2b751ea8cdb490180a19f8de3300a4b05258a3098b95b7d
SSDEEP 96:xHzUTU+BqGqufAuWt1zS8nSSlKdv9jhnOYRH7YBw88n8L4cnyV0fVq:RRRufAukNnSS9Y9sBw88TqY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\prefs.js
Size 6KB
SHA256 1444b8fa1f467b3351aa8977ca1a7695899ab6a82878b9b7ed2e8e93413142e5
MD5 d1e154ad04c88168041d7ece0d7486ec
SHA1 57f8eb5bfab5eeba5b8426b262e9a152c1f811a5
SHA512 14d69ff03b03c98acdd064b51f5886f36bde75bb6f541b681039d3524dcac5e08d237392886a4421a80f7cdb61c83ce8cf88ec66565b4fae213dd1b08e1f2290
SSDEEP 96:xHzUTU+BqGqufAKPnXObzSTBSSlKdv9j2nOYRH7YBw88n8L4cnyV0fVq:RRRufA4X1BSSEY9sBw88TqY
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 60a9fad4fe24c0762950ad3623f432319a5d599619a48c4e5b476651fb083184
MD5 ec1ce393d4f8d4dea260c30495e3e2dc
SHA1 23b94710a1330a85a0596a491895ddc9322f9a41
SHA512 619ddedfb04ec77f8c2479b6231797b7609866ec214d830a4924d9ce19670d4459f162c6ddb8e7f9f1679e1c73a5b6c417c200fd03e4fa46803863432fdbac08
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yvr20lbo.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8e389781e44cf266704a2d21d3058d8e5bf5faf9dcfb56326e3fe9558960bb71
MD5 345c14be265d193424dad395f7701343
SHA1 5c1f6e8fb2d2ac1d0dfb04bd5742a52cb70350ee
SHA512 de4730b5156e2aede8a45bf2781fc589e6d030ea2083af4a38bbad2df784ef58ab1b07bb6e6a8ac1890f05aa1712d77b56202d3bffd85d2eba5c3ce9560bb495
MD5 SHA1 SHA512

Submit Download

MSIA0D4.tmp

Path C:\Windows\Installer\MSIA0D4.tmp
Size 1.1MB
SHA256 049651b61130ae99aa1874c1ba0640c4b820ed4cc612e3f7aad3a74d907ecfb1
MD5 9920fa5f326724a654901359701687e4
SHA1 af4ab638838c463d14a24bf5f50f092182afdb56
SHA512 1d5b167f8fde5317c135bbd39dffd01896196744e797889232e66cc62925de0d14d57a5962ff1f18d8c2c69364589a900ac60626c9da6d0064c23724010af1c2
SSDEEP 24576:EXzVIxnIPOZSjSqQroeqrkgEHAIlh0lhSMXluTaSwDRLEyj:EjVIxIP0WIqrkgEHx8WaSwDRLEyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 1da8bef3997fa244811791bf7666978ccd7f7ee3239561028df79ef9ac0ab02f
MD5 afe360e52dc3a54226c51a3817b8a552
SHA1 ce7c87ff7c8e258f948c24799953f8635e908b92
SHA512 fdcdffd772fa9b9fba9855764129f58074118323bd878fd75dd882aef35cc4e52634c964633bf9a2b73e1539e0c1a9bc0d6a4b3adf3edde8a863a79580f80edf
SSDEEP 24576:FZxm+1LbdoO/vvTLbW+ebGK6PXYaGlOyC4GdsRP1G06POJ3JYvFN2D1hb:P
MD5 SHA1 SHA512 SSDEEP

Submit Download

{8f2877a0-893a-48ef-a170-7acc604e2ca6}_OnDiskSnapshotProp

Path \??\Volume{228b2524-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8f2877a0-893a-48ef-a170-7acc604e2ca6}_OnDiskSnapshotProp
Size 6KB
SHA256 68088d00d9b65e13e228be0462f90881d3ef4d63faf21621c0a525515f13093f
MD5 3ccf15743ee1514d340f88e4026ff8f0
SHA1 1764d4b3362282c6fb9be7e790ff2bbe04926a25
SHA512 0133f161eb8e634de81ad625353c2676d2a91689988d1b8b3f6958b7eb6bd745b1fda389e2886533361ae9001ff8409b67bb14fba11186d93d9ced514ab24247
SSDEEP 96:FOPwwMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Yo1b++ZVmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4744-1221-0x0000000004C40000-0x000000000871A000-memory.dmp

Download

memory/4744-1226-0x00000000041D0000-0x00000000041D2000-memory.dmp

Download

memory/4744-1224-0x0000000004C40000-0x000000000871A000-memory.dmp

Download

memory/4744-1222-0x0000000004C40000-0x000000000871A000-memory.dmp

Download

memory/4744-1223-0x0000000004C40000-0x000000000871A000-memory.dmp

Download

memory/4744-1220-0x0000000004C40000-0x000000000871A000-memory.dmp

Download

memory/4744-1214-0x0000000004C40000-0x000000000871A000-memory.dmp

Download

memory/4744-1204-0x0000000000F80000-0x0000000000F83000-memory.dmp

Download