3d46bbfc2eb76573981b8d698f22e0483f8afb04287c5d445b0d45cf65854fd7

Resubmissions

29/04/2026, 04:31

260429-e5rv2agt2x8

29/04/2026, 04:27

260429-e3fpzscs9q4

Analysis

user interaction
yes
max time kernel
1800s
max time network
1803s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qbittorrent.exe
Size 40.2MB
Sample260429-e5rv2agt2x
SHA256 3d46bbfc2eb76573981b8d698f22e0483f8afb04287c5d445b0d45cf65854fd7
MD5 65f2aa34eb5787edf870c76385c873a8
SHA1 363e415984432de099955c86b0bc15c36914761e
SHA512 692b3cb08c825722385123e1456b18294c1790f4fe517f7f20e2563f9eed4726cc21b59bca7b5f8c6ed089b2dcbda5b117c0a610139e41e0179b9c5372ce7b7b
SSDEEP 393216:1JpDhekqU3FqDakseRGVNh3tdbn8B3BdBvaFx8tSbrN/l5BW4T5MQcJikZA+OuKZ:1swEXcdb8BL1UatSbrN/jrQJtZA+OQI
TLSH
T12D97AD56A3F80195E1FBC2788AA78103E7B1B846137497EF01A495B91F73AF09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (529) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3584	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219107967522567"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{3B5AB936-E7A7-4D0A-9E3E-F75BB44F3C18}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Bullet Ballet (1998) [1080p] [BluRay] [YTS.BZ].torrent:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Bullet Ballet (1998) [720p] [BluRay] [YTS.BZ].torrent:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1108	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
5912	chrome.exe
5912	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1108	qbittorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe
Token: SeShutdownPrivilege	4908	chrome.exe
Token: SeCreatePagefilePrivilege	4908	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
4908	chrome.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe
1108	qbittorrent.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5416	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 5152	4908	chrome.exe	80
PID 4908 wrote to memory of 6084	4908	chrome.exe	81
PID 4908 wrote to memory of 6084	4908	chrome.exe	81
PID 4908 wrote to memory of 3584	4908	chrome.exe	82
PID 4908 wrote to memory of 4112	4908	chrome.exe	83
PID 4908 wrote to memory of 4112	4908	chrome.exe	83
PID 4908 wrote to memory of 4488	4908	chrome.exe	84
PID 4908 wrote to memory of 4488	4908	chrome.exe	84
PID 4908 wrote to memory of 4332	4908	chrome.exe	85
PID 4908 wrote to memory of 4332	4908	chrome.exe	85
PID 4908 wrote to memory of 5604	4908	chrome.exe	86
PID 4908 wrote to memory of 5604	4908	chrome.exe	86
PID 4908 wrote to memory of 2128	4908	chrome.exe	89
PID 4908 wrote to memory of 2128	4908	chrome.exe	89
PID 4908 wrote to memory of 3988	4908	chrome.exe	90
PID 4908 wrote to memory of 1464	4908	chrome.exe	92
PID 4908 wrote to memory of 1464	4908	chrome.exe	92
PID 4908 wrote to memory of 5516	4908	chrome.exe	93
PID 4908 wrote to memory of 5516	4908	chrome.exe	93
PID 4908 wrote to memory of 2684	4908	chrome.exe	94
PID 4908 wrote to memory of 2684	4908	chrome.exe	94
PID 4908 wrote to memory of 2984	4908	chrome.exe	95
PID 4908 wrote to memory of 2984	4908	chrome.exe	95
PID 4908 wrote to memory of 2904	4908	chrome.exe	96
PID 4908 wrote to memory of 2904	4908	chrome.exe	96
PID 4908 wrote to memory of 708	4908	chrome.exe	97
PID 4908 wrote to memory of 708	4908	chrome.exe	97
PID 4908 wrote to memory of 468	4908	chrome.exe	98
PID 4908 wrote to memory of 468	4908	chrome.exe	98
PID 4908 wrote to memory of 3124	4908	chrome.exe	99
PID 4908 wrote to memory of 3124	4908	chrome.exe	99
PID 4908 wrote to memory of 5824	4908	chrome.exe	100
PID 4908 wrote to memory of 5824	4908	chrome.exe	100
PID 4908 wrote to memory of 1676	4908	chrome.exe	101
PID 4908 wrote to memory of 1676	4908	chrome.exe	101
PID 4908 wrote to memory of 3120	4908	chrome.exe	102
PID 4908 wrote to memory of 3120	4908	chrome.exe	102
PID 4908 wrote to memory of 792	4908	chrome.exe	103
PID 4908 wrote to memory of 1820	4908	chrome.exe	104
PID 4908 wrote to memory of 1820	4908	chrome.exe	104
PID 4908 wrote to memory of 5024	4908	chrome.exe	105
PID 4908 wrote to memory of 5024	4908	chrome.exe	105
PID 4908 wrote to memory of 2116	4908	chrome.exe	106
PID 4908 wrote to memory of 2116	4908	chrome.exe	106
PID 4908 wrote to memory of 5540	4908	chrome.exe	107
PID 4908 wrote to memory of 5540	4908	chrome.exe	107
PID 4908 wrote to memory of 2656	4908	chrome.exe	108
PID 4908 wrote to memory of 1744	4908	chrome.exe	109
PID 4908 wrote to memory of 5960	4908	chrome.exe	110
PID 4908 wrote to memory of 1176	4908	chrome.exe	111
PID 4908 wrote to memory of 5912	4908	chrome.exe	116
PID 4908 wrote to memory of 1820	4908	chrome.exe	117
PID 4908 wrote to memory of 1820	4908	chrome.exe	117
PID 4908 wrote to memory of 2544	4908	chrome.exe	118
PID 4908 wrote to memory of 2544	4908	chrome.exe	118
PID 4908 wrote to memory of 3604	4908	chrome.exe	119
PID 3872 wrote to memory of 5416	3872	firefox.exe	121
PID 3872 wrote to memory of 5416	3872	firefox.exe	121
PID 5416 wrote to memory of 6036	5416	firefox.exe	122
PID 5416 wrote to memory of 6036	5416	firefox.exe	122
PID 5416 wrote to memory of 6036	5416	firefox.exe	122
PID 5416 wrote to memory of 3220	5416	firefox.exe	123
PID 5416 wrote to memory of 3220	5416	firefox.exe	123
PID 5416 wrote to memory of 3220	5416	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\qbittorrent.exe
"C:\Users\Admin\AppData\Local\Temp\qbittorrent.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffaea27c728,0x7ffaea27c734,0x7ffaea27c740
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,10941846059800448245,13407670722921562245,262144 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,14849331014952997332,8103759014683086944,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,15417029095659517150,10948888722524753324,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11902927911151132563,12815011380578438547,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,4714441241610888119,5322663045264938637,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,1167557922242220520,1010938322276576107,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4228 /prefetch:9
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,995095761246856761,2192265844051627981,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,5204761079281185914,2693225393660928625,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5688,i,15023935951620376654,12246137292928173524,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4532,i,10545506603992980195,11264877014887028628,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3484,i,833730245063633024,15618285145106846626,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4552,i,12848449481315783220,10447143325029262012,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3508 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6068,i,4757884272239412286,8546804171579267577,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5780,i,12288285744528164376,18016668348515038378,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6136,i,11582008068678990739,1395253707727475230,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6048,i,9545413878948895305,14452805570074783372,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3544,i,11060089249781204227,11279762448844980723,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6172,i,16297939300941738959,14991442727230188932,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,9852545307698046467,15365518845383987090,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6200 /prefetch:12
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,3195174717323597385,11654071662911906035,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  - Modifies registry class
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6476,i,3451813796853136670,17419226099120777574,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3308,i,16401006884847834230,484264963549639074,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6744,i,14438690268934390465,65905181065892654,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5896,i,6081321574605925988,3413867679307811292,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6796,i,14697685664725838873,9719587830947963982,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6772 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7140,i,2347150243363156680,15891358229893811409,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7132 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7088,i,9384195754014995041,13057855783070910687,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=220 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7084,i,17672414881078194434,9930417439306753319,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5596,i,11152028195467685322,2643947712931625515,262144 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3116,i,11933826631649577552,12338298094174141163,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3120 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7164,i,16610399684925527458,6477219193063822257,2097152 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7040,i,1062329035919205483,3682187990010961724,524288 --field-trial-handle=1840,i,8196702874967187208,12431063384741145101,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6916 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1272

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:6044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1824 -initialChannelId {f01e61d3-0d1d-41a5-a2fc-c0827ed80fda} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {531c612f-a8d3-4e8f-a659-dc58aaaca933} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 27323 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {e13d1cf7-0a15-4ae3-9249-70af2dd98b98} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27323 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 3760 -initialChannelId {6f7b664e-dbe4-49a6-9a9a-5b0755ab04e9} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3092 -prefsLen 34822 -prefMapHandle 1576 -prefMapSize 270279 -jsInitHandle 1644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2984 -initialChannelId {0a5c1fc7-5bda-440c-8a3a-8233d6546999} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4948 -prefsLen 35010 -prefMapHandle 4952 -prefMapSize 270279 -ipcHandle 4960 -initialChannelId {8c4f06dd-e933-4201-8d0a-030d546d1e09} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {39f017d3-5fa6-4a3f-8ede-5ba0ac589e8e} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5604 -prefsLen 32952 -prefMapHandle 5608 -prefMapSize 270279 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {c3a1ac84-9e2f-43b9-8d1b-cb15ad2462e8} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 32952 -prefMapHandle 5796 -prefMapSize 270279 -jsInitHandle 5800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5808 -initialChannelId {afac00a5-3988-4e3f-8953-e69391891452} -parentPid 5416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 17330dbc94acf5d58b2f525153d1818d5fb388d22b5cd923c6de8d46fe88b712
MD5 7487c76b61cfb5d026b623715f5d5abd
SHA1 832ab62b211bd4c964583711e2f604a229460230
SHA512 f5c0162d99f98034f494cf0003dbbd1e1063197d418c4c8ef18832852c252141fb4bbd29b6472a7b414a1e9e307287e1dfa05111e0acd4054a6ed3e3f587fe2c
TLSH
T160E02BAAC825DC374DFE071855905742E64413A72B40992F7A3D930C8F7067E468AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 b93d02a6dfe8e6eb52c21bb8a76fd943e5e81abce1c2325f29eae498f68497ba
MD5 323de593e8026d257a078b191b9701ec
SHA1 404697690b981e2aa26a9c1d5bb379434e28fa6b
SHA512 d89321ef7cff1c3ef747ba70d7df5b0f9f128ebd68c703cf03142a48a5dfd45763eeed2c375e64f8c0d9d9644f2881f568a86059e2e4a795b7f38ce24df80a55
TLSH
T166012D92E0E7420BCF745D3029DD2C1CB5FAC96447B76F0B664F1E74AA1B7918327940
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 8a6bd2dd19d90f4ab83afd8be7b0c884e62eeb1cb0ea737c85858f65ae19de56
MD5 57bb8cc03301243f0f296c778c954ac1
SHA1 b814f0149117d88ef8923f73176df5b5f16c12c0
SHA512 4089da0d7a140ee72226e5894e1028ca0c0e6ca3284a46c9ec442ab8c6369ff360a94e6a9f5d205d06dbbf7cbe4589ebb57cc0989696ff927b8a1a3f5cb7a520
SSDEEP 192:DIuZWXNscLtLCtHdwu7/daIayYXld7G6EAB18i0Xv3zPiCLbOuQCgppFRbtOSRMn:DIuZWdscLtLCtHdwu7/daIayYXld7G6+
TLSH
T1DE42EEF7C3E5C62ED91155F0EA146E17CE680A15432C3D5689D8BF0BA3E25B2D290B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 4b208ad41eeb62b70df3e83660aaf797a6e3b6872c81ba734add4a974b8bd510
MD5 59406c718da0e21a3a09c97dcc3ae33b
SHA1 cda854719fbc486d5652a6bc1f5b8ab5341a4248
SHA512 41df4802926e332ca291f8efe1300a7bf792c81dbe261b9ff12c1223e7f025538413529a4c2e0f92ef68a4b306f11a7b6e32a643dc2fec601a050105875890c9
SSDEEP 192:DhuZWscLtLCtHduSNFENcaIayYXEd7G6EAB18i0Xv3zPiCLbOuQCgppFRbtOSRMN:DhuZWscLtLCtHduSNF0caIayYXEd7G6g
TLSH
T19C32DEF7C3E5C62ED91195F0EA18AE17CE680615432C3D5689D4BF0BA3E35B2D290B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 80a905245416d450bdc450f3d2b6c463655a8981a9bf713bdaff15ed153dda58
MD5 cfb23fe836b634c83393dd8671f24aca
SHA1 2334ef2785c788d1065aff53a13a3e13cc227ddd
SHA512 07d8a9f92187cf99ed2abcfec736ae606c7bb9a95701f9f72eb4ea9be56943b2ae5edbb7617df27d2044859713a21b44becdd05e989721ea60840a13dbe096aa
SSDEEP 384:DIxSFPI0GXDLB1zRemfaIayYXl717G6EAg1J4PzSgwLbOuNCgppFfbtjSRM9iJHy:wUc8Ed
TLSH
T17152CEF7C3E5C62EC81255F4EA186E17CE590A15432C3D16C9E8BF4FA3E64B2D250A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 9d207a6be40479ab9ad93e03e07f725ad26286f25fb48e6413512bb88ba2eb82
MD5 01de1c191ea2849a84f5fc790dce9a06
SHA1 d54fe351ca9e11995fdf12252d40a6240002c7f2
SHA512 852305bbecf0a56978e651b7141894cab966fe68d76f3c94236ee9ac1f6d33d4b5ead403fed1621c9dd854ba72b31b503dd9ee1d5ddb850e5f1bffede57036cf
SSDEEP 384:DIxSFPI0GXDLB1zReuaIayYXl717G6EAg1J4PzSgwLbOuNCgppFfbtjSRM9iJHHS:wIc8g
TLSH
T17642DDF7C3E5C62EC81255F4EA146E17CE590A15832C3D16C9E8BF4FA3E68B1D250A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 334d4816a959a775dc4dcf0f7d154f8250c265c3a842bfc0c7c311798d56c6ac
MD5 66557c8cdd6bcb7c976898e6f3cfbb3c
SHA1 d9c70eeeaf6d75a57e6984c28fb15b7d87fcd42c
SHA512 6981612927a326debb85159f3d9b1edf0436cf73b62b70dbf742afebc622474802b97e9422854536a2ca55a026c9151bbc8f939f518f73d9589332a9744834ae
SSDEEP 192:DIuZWXNscLtLCtHdwm7/1aIayYXld7G6EAB18i0Xv3zPiCLbOuQCgppFRbtOSRMf:DIuZWdscLtLCtHdwm7/1aIayYXld7G6C
TLSH
T1E042FEF7C3E5C62EC90155F0EA186E17CE680A15432C3D56C9D8BF0BA3E25B2D290B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 65118ef31bdb94660dbd68383a8659e3b6d1f8bd798508c9b78d0ee6a29408f0
MD5 19421dc6bf3db73528fed0fb82389355
SHA1 4698e15faa31681667097328ea735beb96e33f37
SHA512 9673f1778ea359164e2ac0a7d8991cd7edf00f846ea194fc10f4cdd50df7b00e6a2eff2a51b9c9e21cb55a949625e37b7c48dc5722ee64dde58581f5a9e4a64f
SSDEEP 384:DIxSFPI0GXDLB1zRem7jaIayYXl717G6EAg1J4PzSgwLbOuNCgppFfbtjSRM9iJU:wgc8e
TLSH
T13652DFF7C3E5C62EC81255F4EA186E17CE590A15432C3D16C9E8BF4FA3E64B2D250A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 89db4dd62ce48d62b9ae6a501fa6d98f41d11466816a5aec674ba0fc17b45082
MD5 16b42cf0e2db95b69676030d8a16ad93
SHA1 e5297c60ca56573e25a77cb1e734d0e50c7631a5
SHA512 04b7f5b44e5cf02e52cacebe2286a6dbec2e078a064a24490d2b6566362afa4f8f8133b83538d93b36edef607f9667731b09c7cdd7aaab87ccd6391be888cb48
SSDEEP 192:DhuZWscLtLCtHdwuSNFEVaIayYXEd7G6EAB18i0Xv3zPiCLbOuQCgppFRbtOSRMv:DhuZWscLtLCtHdwuSNFgaIayYXEd7G6G
TLSH
T10F32CEF7C3E5C62ED91195F0EA18AE17CE680615432C3D5689D4BF0BA3E35B2D290B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 8e36a4b2713ae0a033a02083002df503303c6a67c7048826720e113f3581242f
MD5 8d93f35a44eb86df3924d3e1b702a41f
SHA1 bc1485620b18eb99bb9997cca490af55764767cd
SHA512 297562ae5d85fc4cd51e30430c4ac4dfc84a62752ee549e09a49ce040738df46bd32511623fd292ee954493b1036eab8fb0c6e1ee0468f198d445ec352e296dd
SSDEEP 192:DIxSFPAN0GXDLV/1zR2aIayYXl717G6l3AMf18i0Xv3zP6gwLbOuNCgppFfbtjSq:DIxSFPI0GXDLB1zR2aIayYXl717G6l3v
TLSH
T13942DFF7C3E5C62EC91255F4EA146E17CE590A15832C3D16C9E8BF4FA3E64B1D250A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 f2f0bf906e2ad90087ebcc1285de8735bf995fc5866f6746e9405b11eb34e5b9
MD5 c92bb88677a70b81ed8c9f930e8c4046
SHA1 1d5815468dd367df4df227276648abd29af4f6ba
SHA512 7b04d8f4c06d0c029875d4ab1b562c1b17830c4345f5724304f580ccbe436e54085c78e4a74b2944343427d2c67c06f6eb9d7b10f80fae8f1c8645c92e4b9e26
TLSH
T159413CA3D27FF827907D49772E48B809187BA43181D264F4DEAAC27E70C54F31A27466
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bc9449ba8bcdd96a618cc5e0aad071e0bcdd3c4b78965428f24c12c6aa853c8c
MD5 d2dd11cc7d464dee9145c63346dc3bea
SHA1 d275bc38d05af4f493ebd4e362c25c0017b8bc51
SHA512 c82dc416a943018130a12e03ee66aa410b68f348dda65b392400f711f100c381f4f1e0b548d3643336babe1e6b47ec755a0fd9a6cd0689e4f6b8924e2ec85484
SSDEEP 192:zRdcGz9PPHv7zFwAPRp2dvlwudXFU9hHsb+WNFqvNk4eX0mD2VwOex2aP+8yIsnB:zRdcmPnFBXxbwXF2S2aP5e
TLSH
T1D662C76FE62019775CEAC22AFA11B71AE3F5102165D05D88EAFCCF2C15DB6DD211740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 5c82ae6e7b8be1ae6ad1ed16549a34200d9acc79c7541d17254e8d87cec3bfe8
MD5 e5755bb6bd79b22420951f04882da10f
SHA1 a0205c2936abf43b1f587f5f2e921328892dd237
SHA512 c9514c648a2bb8f36f7c5bb6f1b12cab24969a4f9b21abde69350202b462c45a77c76da8dd22b69098c6cba6c89c611b947249eaf71a378453c66a916d6f366e
SSDEEP 192:zRdB8z9PrHv7zFwtPRpZdvlwQcdXFU9hHsb+WNnXvqvNk4eX2wefOex2ar+8yIsB:zRdBAPnF+XRbwXZfe92ar5e
TLSH
T1C762C7AFE520197B4CE6C22AF911B71AE3F5202165D05D88EAFCCF2C15EB6DD211781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c50bef14aa6d14acff94b1ef09ddc78470d65e1b4dbd6eed7d31537eee83089a
MD5 d607317c1d80dfb2bf1fdd7be7899c96
SHA1 660731aa31d00aa3fd9a821633cbeb70de4fdc18
SHA512 250b79b21be81ae10cf305e7a57e58143f5b3e9411c4cb7147cb0ccac8fdd1ec35869d4e201a01d3b250c419d1674cd1fa0593032354a34075250cfe3c584e31
SSDEEP 192:zRdQGz9PPHv7+FpAPRp2Z049hHsb+WNn4eX0mD2V/Oex2a1+VyIsnAUgtaJ:zRdQmP6FUXCbw9F2T2a128
TLSH
T1CD42D66EFA1069375CDBD21AFE61BB57E3F6102161901D88EAFC8B2C14EB5CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 14f63f9ab21d1dba036a1a89789c7b1a65cf45909083981908b5e98cc470d9f4
MD5 de6dec1341f1c4b5488be27ca90344a4
SHA1 397d4d3bea70098a2f2bd175fb55755d1540949c
SHA512 db589c94e314ed21d7531e66706a0dcde429226458b5493c70abf7cb23e5f44a1ea4f3d64a74816af93883f9342389b24a9826da256403f2ac2ba1aa134f616a
SSDEEP 192:zRdc8z9PPHv7zFwtPRpZdvlwudXFU9hHsb+WNFqvNk4eX0mD2V+Oex2ar+8yIsnB:zRdcIPnF+XObwXF202ar5e
TLSH
T19162D6AFEA2019774CEAC22AF911B71AE3F5102165D05D88EAFCCF2C15EB6DD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f45254567d3f32aab6dda3e6c030784c5687219175ec39304c8e650ae0603225
MD5 44274841ad098a700d1630faaf4cb588
SHA1 81c7729810706ffbc75970d386207e3b998d518f
SHA512 bbeebc959b2b7e111f5ac0e3b323f39fe5af6a77cc5c2d349b251849955fd3226fe0173b0ab9805f7566894baa91b420f1bdb9046fe0fd20b868e07eb93d2558
SSDEEP 192:zRdQGz9PPHv7zFpAPRp2drwuRo9hHsb+WNF2U4eX0mD2V/Oex2a1+8yIsnAUgtaJ:zRdQmPnFUXfbwHF2T2a158
TLSH
T15A52D76EEA1029775CEAC22AFE11B75BE3F5102165901D88EAFCCF2C14EB5DD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 68a2dc5740e0312840314efeca6acdffc918a3e7a86c9fa87c2ce011c226ed7b
MD5 ed6e38d62311203bedca9782c9b97b6f
SHA1 40f5f01ddbce394f116760834d5b848805ba95c7
SHA512 79409897cc013ff47652009eb407fc0b385dd208699ca689b0614b6a778a4488f8b363f82ebe8414fe42ea03e76bdf4d75b4a8b210656346516af2dbb75298d9
TLSH
T139B01250C0C29A21C01303F5228215883118DF108B051301D3F4AD71982A1904014191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cc63.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cc63.TMP
Size 96B
SHA256 035d69da180511484b829b91a42b7c6fe89483c2d2e419f7c19dda962d408698
MD5 ef18bc3dbf4d908cbf44de6fe049fd20
SHA1 077e7c9400f3d264600fbd13496fa2e964d4c668
SHA512 a5b4bf743162df78a544885921f6445b686854291432bd3a4db7e41210b5c5917bdaf17308536d201f53c7e148a253886cac2a70fc359bd94b185e840a958a9b
TLSH
T1EDB02200C0023202C08223B0288A82FC3030CF20C203232E82F00E33CC38220C020820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 e03e4098815d3169e2875703487cc5143b6eaf25d9833f7702e7c6ba4c2b8633
MD5 8b3d44f85118c2ef503cd98c57e2d46e
SHA1 cbe6dd400b076601a7591415d166dd825214d4a3
SHA512 91d411cf53928939b1b00eb3bb55db7823528339ce6174ebeee46387c35cd213223c5514843ebaad3aa42aa5b2355c0b84c7ccf559ef949252a3f6c320a1434d
SSDEEP 6144:5bNDqV0MqEAH4Ws32F+gg++JjcMW2VcVLK:5xDYLYFiOMWU
TLSH
T1E61422F56E2E39F8527A86B151174C5D4CE39C8FA60A342CE2E39F0F116E7839752CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 d8003bba1e210337cceeb1873e8e2581799b2a796f7b0cd057d5a8ee596cadf1
MD5 e5c88d934f2a6c86d114557b0e790813
SHA1 7e7cd96e1a37f3888a27d9432f82d05ceaa2675b
SHA512 f75826138b6a705a4823e0ff745e53183ff9aec8d28fce0bed18aaa9ea731221afe0359365b24772a7d92342c530c653de2284d2c2a4e7178fd0f2a5b14d6c00
SSDEEP 6144:fbNDqV0MqEAH4Ws32F+gg++JjcMW2VcVLK:fxDYLYFiOMWU
TLSH
T16D1422F56E2E38F8527A86A151174C5D4CE39C8FA60A342CF2E39F0F116E7839752CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 87cedff96a2955f6bc87fd9f6e5d484edf184a964c837ea20ca7eb3130f51ffc
MD5 4e2fd9992ed1170f1a22d4f36736cb4b
SHA1 25cb35f5054defce14c55c755e34b05731ac15ce
SHA512 099d6ff692e1e157d37b9559691cd67142b52d878b57ce81063acdcb62f489e4b3254931194d7af6babde274c9d13026cffaed3f1a4a38984ca818c4a25472df
SSDEEP 6144:jbNDqV0MqEAH4Ws32F+gg++JjcMW2VcVLK:jxDYLYFiOMWU
TLSH
T1C81422F56E2E39F8527A86B151174C5D4CE39C8FA60A342CE2E39F0F116E7839752CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 43e5d47704ca22aa48025d91ebc0cd7eee742d28788f712d7a42e645f7f2a5be
MD5 4043f78c64fbbadfe794e20d74bdd5e3
SHA1 2c568e54d92e12ef6187e126d9efb84c1e2c448f
SHA512 57fd79ccf9a7279b4667ea79242d12f236c8a01618a35832cb49eeb7bcd594acad8dce74afe3d38400634555e5817e4d1aa1140673e0da51580cc336c9dfe560
SSDEEP 1536:eGe68P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:Dy++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T13F9302B9991E7D75636AC6D6A0079CAC88E3DCCE1514117C30C7AB1E24BE393A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 843570cfe08624bc362bf5cf9949e38c17a5f0f525a4d077dfe65c0d59a6f6dc
MD5 0ac9aaea644b182e323ce0ab89427c75
SHA1 d23e6077dc1a96751f1aefdf2e2b9415f622ec11
SHA512 d7652c2e466fde9ef3bbe8d150cdc1544d07d4d4fe03b8e3bc9579661601a7fcf425a628b88fcf3680fca4358150b5a3fbd15ef859200384960e6bf68ac533e4
SSDEEP 6144:P0DqV0MqEAH4Ws32F+gg++JjcMW2VcVLK:P0DYLYFiOMWU
TLSH
T14F1423F4AE2F79F85279837251274C6D4DF39C8EA2063468E2D38F1F11AE7825356CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 c641d2530e84ebe9ade16ec3c8615162942eb1bd0fe59ac9a2058cbbdc3218dc
MD5 4ad05e194d9282e6f957dd2786d8b365
SHA1 b32cbe5e9aee9c860f7d9c62d80a689ca7e281da
SHA512 12aed7016231df32225dc00bf6f5465dc208a6b432c01416652fdee2574ac8894e5f819228341aa8280d83b7166e305de872a8dfb4c36cb2def6a9cb1fe13e25
SSDEEP 6144:q0DqV0MqEAH4Ws32F+gg++JjcMW2VcVLK:q0DYLYFiOMWU
TLSH
T14C1423F4AE2F79F85279837251274C6D4DF39C8EA2063468E2D38F1F11AE7825356CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 11KB
SHA256 7d821cd3d4c4417bc1018fd023f4b11dcd16c42a7a0e1ee47f559aa60e741591
MD5 103ee5f7170b8d85c5b8ca493341788c
SHA1 2f2dbc705c52c4ae5aeb209024dc6b8f9facf54a
SHA512 9f0c86a37660505892bea0f914ee905a05a2f1fe12758a61f0c36aebd074d1a93611b6096ba57fd7d58d9ebb41916e60dcdb5cab59087fa46b3b8af69099c04b
SSDEEP 96:96FbH5/50ArIPg5/5ZXN3BF8Pta5/5yT45VhID5/5OJ5/5cGC5/5pZgG5/5fh:9AtqnPgtDNRF8wt7rIDt4JtLCtVZtn
TLSH
T11042DA19A7F92626F3F3EA32A9F673118F3EF8435B19994D519043884871A0069FCB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 99c9d6541dd440e960e19ad258af672da1edd904615f4a3e9613bddcd95306cc
MD5 0e72f82611fac6cf938c61fea5a07db0
SHA1 45c3517cad30d5eee03f5d452edb6d92f2545853
SHA512 e4da02592ea44fa7a54706ee57e16b73fbf2b841259c59430e51d9d487965f10f670b2652d0f1e50bd9ea31e9e015fd1dbeacb92da0244a8f3ad9787505821a2
SSDEEP 96:46FbH5/50ArGPg5/5ZzJ5/5cgC5/5p3gG5/5fh:4AtqdPgtHJt5CtrZtn
TLSH
T1AF02DC49A7FA2A55F3F3EA3269B673114F7EF803571999595290438C4871A0069FCF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 f7f0c2b851a2bdcf5a4cbb483a839ebe5ab40b5d25387dc79d8123dd8d86dcb6
MD5 79369c9d7eb1897948367903d35e3184
SHA1 44f5328d35800946741a17ea2419eb3a2f926c17
SHA512 5fef894bc16f6bf9637c5cad772a58728197d86f9421ffcb57081102b0a237b3eed646d8ba42e93d409286d54206e5f177407062ad6b0cca00ddc5b6cff162a6
SSDEEP 96:26FbH5/50ArnPg5/5ZNVhID5/5RJ5/5cJC5/5pGgG5/5fh:2AtqkPgtprIDtXJt4CtSZtn
TLSH
T12E22DB49A7F92665F3F3EA32AAB673118F7EFC03571999595190438C4861A0069FCB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e70a4716ca38c5efe63f9b1c2f6bfc6db708fe1cc0940edd4a067d8f84e7431c
MD5 340c35da065714496f931225732c4354
SHA1 738bc430b9437712aa83ef0fa2c29296e8b2578f
SHA512 735a0205e02b88d5ead668453e18b4bfeca6e32ed58fbb130335b874d1f94b4e704bd82d277899b2deb83e2657d8ed499bc87231d84bb41ead96de61dd255b12
SSDEEP 192:ns1/66Joz0dzgCl6mc0de7Ov5zboHAU3hyjHS:W/66JozQzgC1jBboj3hyj
TLSH
T19AE120A4F629463BD405127BCCA61F410F39388A988E3F1936DC644D2D472ED7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 251f77db3fe360ac17b39db15d3f174d970f8b178bb3eb50104624a0be7ca715
MD5 3ad033e87441e9d1fde80015f58575e4
SHA1 ee7a8bdacfcbf4b9d9253d19084a4bfa597017ff
SHA512 94f2aa3f47db42ba30873b4e019b3f0a655bd85d63a54fca9553908b8f50d062fe16a4363b3a31ca1261ea0ea5e08f1f6e9b120ce10ce428105d79b4771730f0
SSDEEP 192:n7Ov5zbooZ3hyjHyhs1d66Joz0dzgCl6mc0d:kbooZ3hyjhd66JozQzgC1j
TLSH
T194E11EA4FA29463FD405127BCCA61F400F39398A984E3F1936DD644C2D572EE3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f91207239e667b1aa1b378670f4c913c371a1576cae516df808b43c5b3d13386
MD5 2049e8d99c5dcf575e7d7ade0e91664c
SHA1 28364d10e14a4c3201abd6dec66480cf883059c4
SHA512 542be173a11ecf8a21cded8d93de303785a65d22a7c74fcdfb68a292b25722ecada236b9740faa78927a92b421e64dceeade25368e84e50f0f6a6489cd28b7fb
TLSH
T16821794D39B84D2AACDBE29C74D4018E631A4A1389C72D431D03DF8DCDC6AD9326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

0ad1986e-01e5-4842-b382-6d3f3fd60efc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\0ad1986e-01e5-4842-b382-6d3f3fd60efc
Size 235B
SHA256 e022b25966ec1aea1a7afeeedd02da514cf4ef8f73314e2a6137a7cac872b47d
MD5 305000c93f87fb434654a0947abd66bf
SHA1 33d69fa7e41dd4bfeee4904e474a63521c97b669
SHA512 60d500eec421bdc0038cbceda1eafd6f84eb3ff72c070d7f0648985148defecf512e6d8057a25c536c6746ebdf91857060be568d9851b9234601047b7da80814
TLSH
T1C5D097812488675C0C000F06F0B0E9C631858C3314E1E820E96509B58AFDDC4827380B
MD5 SHA1 SHA512 TLSH

Submit Download

13623667-86ae-4361-a69d-7cd80be87152

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\13623667-86ae-4361-a69d-7cd80be87152
Size 16KB
SHA256 02108000cf337aeb353c91b87abf85dc574c81f9ee5f1b4a0e831ef29faa4fc0
MD5 bb34ff4b90f8344d0ed5a06aad9fc408
SHA1 a352fb111f86deada853264be1253e69fdb44ede
SHA512 c8e0ca8929f3e02067a920e35b9b261011443f6e4db47311a58925d8f4401e3bf4994c229379f7321c198c1536b9c46dee3d7486a494a221caf768043ed1d82f
SSDEEP 192:tMkhg+eEBq1MCeDvULjdG/dgb3MspYt094Alngw7xhJuaRUvafvEIWjYEY6SgiVf:KD+eErvUYkHmaRUCf8IWs36SgiVbl5
TLSH
T19472C816286049BA8251E36894FCBFC3E6F528CF4C418FCA9BE4BD486DDE06D512784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b97fd72-583f-44c8-a820-bc8cd1be64a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\4b97fd72-583f-44c8-a820-bc8cd1be64a2
Size 886B
SHA256 48dcd77f938cea23794d6f219db709dcac3819a23a101e4dd4116121db714d6e
MD5 c931ee94b8502e0e4ef2062998bc9449
SHA1 7ff8d3f04e4746b4a59bad41cb80ac4e4ac4beee
SHA512 64ad56652d64e8074e32aecfa79001ab4605939bc34a6eef8d9c32a79d9eb47546d56d6997ac2ea768ef28945e036d9ff3a647099c9ab5267415eb93d18667fc
TLSH
T16F11448086347CF29C68D2CB85A07B4257A87513C0C648043F946E0C0EAA12EA757307
MD5 SHA1 SHA512 TLSH

Submit Download

62da2b77-b121-4c71-93b2-d18ea9267b73

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\62da2b77-b121-4c71-93b2-d18ea9267b73
Size 235B
SHA256 10276f2f37544e56bca3b80c33e1f06ddb1afb8aeed3dfb27188f6de683a24ca
MD5 12664775c4ff520353d1ef8cbf98e679
SHA1 86481d30536a0e588471a5ee8d268f6e40d5b514
SHA512 2dd20ebb9bd6b8a7495f6f02e8419b3d3c22653985afcf77f38e8b6707ae1d56d5bed8382cbab28076953958d3eaadadddeeb05b1dda23351e1cd12bfe6b1fc1
TLSH
T1C1D097C43888EBAC08048F12F0E03ACB30CA8C372460A810DA5105789AF8EC44161C27
MD5 SHA1 SHA512 TLSH

Submit Download

c45d63ed-aa97-4806-90b4-a2849316ef0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\c45d63ed-aa97-4806-90b4-a2849316ef0a
Size 883B
SHA256 61a4ab6c106741673f9a0d6068bccdbdc7c4dd62dce69cccd3858e6831d78280
MD5 bcb57d1fa5e27e26a31cedf441a3154f
SHA1 3bb430771f74dda62fc4dbe2de7c8c759b89f40a
SHA512 317661ff8b64825174be45c5978dc75b44efaab3ef7bf96ee608c7e137698fef48369844d1366c7bf4494d987a555ffbdf8f4632c164bdd66cc307b792a96e52
TLSH
T1B9110090D63179F2CD7C938B89657B029BE47913C0C658183FA55E180E7D12ED36B70B
MD5 SHA1 SHA512 TLSH

Submit Download

d24132fa-ed0e-4d5e-9b8c-9aa4a6b9ddc2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\d24132fa-ed0e-4d5e-9b8c-9aa4a6b9ddc2
Size 2KB
SHA256 8c17895e78084f853a2f36679f3519c3fdcbf38fd15ae2001702b23d25f2b66c
MD5 819500674d42837c7c2ff1f295da8cea
SHA1 ebe251483e5e0f8ac06186714a7e72223d0d970e
SHA512 77ba1502629ef53fe679ac9c4647f3313ca84044631066a94c286c67a3a4113ccc231648d3cd2c62011bc1b48000223c01b67d4021c088597392a842c8eebd3b
TLSH
T19741411C35785C7E9CCAF55E8492338E53A49A0340C61D432E91DF0C8D976E9736A53B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 b6eb97c8ebee62d71d3d50d7ea13e61ecee93b96731257fbcfeecfb71d693684
MD5 8f49b09d3d5ae5df858ddd81f933a32c
SHA1 6478d646627161632a142f6fa67e649c8bea73a2
SHA512 c95ffa81a663d636c08036328a1fdd4f061d9785cad41a1687e9bace831f0c17566c4d4ecdd47313daf1f6c792a67a18c27b0cc937bbfb876faac7e57e8d1b44
SSDEEP 96:xHiUTUAPqGqcUfCAf1zSMSSlrdv9jdnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCAfRSSLCaYzMgBw88qL
TLSH
T126E11F7894088B7F74B6776C6C6888316AB2413BB7BF28D710B954C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 4da1f792dacde61b00d9e5bb5c5f3bab52448d9e1900c02cab216b30a7fc8fd3
MD5 fdde983c9b93fc17e797e607c35df6e3
SHA1 3fc395225e583bbfb3b4f1b07ab0757a116b52d7
SHA512 ceff4532f3e3ceae79ec863c31dfe99000638e1167335dd8ed5f3bed5bac56387f097e2dd72b538de0a3c68ee932455b8adb36e325e5e6ec78c1935c6ddd123b
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zS/GSSlrdv9jGnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNgvSSACaYzMgBw88qL
TLSH
T152E11E7894088F7F74B6776CAC6888316AB2413BB7BF68D710B95484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionCheckpoints.json
Size 212B
SHA256 1bfee61e2f346959c53aa41add4b02d2b05c86c9f19ffefe1018f4a964bf4693
MD5 29ce37dc02c78bbe2e5284d350fae004
SHA1 bab97d5908ea6592aef6b46cee1ded6f34693fa2
SHA512 53a9eb746e193c088210d8eaa6218d988f3a67ee4cb21844d682ff0178db040932404f5ce2f3cf8b4576313ba0ec33c04ca288c3412bfa5df7dd8230cc2068bb
TLSH
T127D0A987C00910BADE832E4873D4BB819D3F00F772600102B6AC588C283B023858B803
MD5 SHA1 SHA512 TLSH

Submit Download

qBittorrent-data.ini.lock

Path C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent-data.ini.lock
Size 64B
SHA256 313a301c2b5b84f96e54bc018fcce0854515587ca1e0865597d48ba0f89175f7
MD5 9e407a1dc05ac3c95402087fddbf1de1
SHA1 d0c20e0e98cd5cdca61d523bef4af2930bdff430
SHA512 19a16d8f0837b738efdc1cfa68398daf38fbf208cc3917a840e25fa5ba01850a11fe0cf3c25c7e8c643efd0d5e5907e628159f8e062c166d75a7f0cbc517d51b
TLSH
T127A022CBAF3A8000820020080A0082300B23800CE0002AF0FA0E2080C0030888BF000C
MD5 SHA1 SHA512 TLSH

Submit Download

Bullet Ballet (1998) [1080p] [BluRay] [YTS.BZ].torrent

Path C:\Users\Admin\Downloads\Bullet Ballet (1998) [1080p] [BluRay] [YTS.BZ].torrent
Size 20KB
SHA256 6f1482d18da9ca28dd4e453e764ab45f66a6e499be31e8b795cdc0ed60585955
MD5 e515a5b77b7d977096ed41217e60b919
SHA1 98cdafb81a045694f43fc827d26e622b1b32e733
SHA512 36a62778ed29ebfba24e7af556e313f45022ac07962dfc276d1a5e4537f9a098f7be1ec32beae5ae164a9fd281472dcbaf341ed6099fa5244b545eac9c7c7c25
SSDEEP 384:tsGtsdaixKmGysu6pMqjKxvbtsnx+rfvYotqV/FC9CA1a+Th9SUfRbmephkqYVCU:2d6+qSbtsnx+jft8JuDSubmShdYJwFRa
TLSH
T108A2D1891B522010043640BDB6D9D47B070B286196BA7D63DBE1E7792AA9F13E3DFA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bullet Ballet (1998) [1080p] [BluRay] [YTS.BZ].torrent:Zone.Identifier

Path C:\Users\Admin\Downloads\Bullet Ballet (1998) [1080p] [BluRay] [YTS.BZ].torrent:Zone.Identifier
Size 162B
SHA256 9d3adc5dc283fa05f6f45789b0de9901e5542baab9fe8e15eccce8868ae2effa
MD5 62929904e6c24b13b21e42516989eac4
SHA1 175050618182a987b71c02ebfe1d60054f8207a9
SHA512 5159d5a7a831f7aeb4d6833eea49e1e5c69869bcd3c6c51bf1b994d40de375e25df2adcd60c4e555bc0acd4754b741a1414165b80b687991a207e297c40e0307
TLSH
T180C08CEFD20A924B099427D84CAAAAE9E04F258019854498C4E4888ADCC149585D064B
MD5 SHA1 SHA512 TLSH

Submit Download

Bullet Ballet (1998) [720p] [BluRay] [YTS.BZ].torrent

Path C:\Users\Admin\Downloads\Bullet Ballet (1998) [720p] [BluRay] [YTS.BZ].torrent
Size 20KB
SHA256 4080a14caf5811880603dc04c776c85b7b33927cbb3ebc240dd375d755c8ea0d
MD5 7c3b690e20fa4caddd826785f97d26c3
SHA1 743b250800effbc0ad8d164981fb5473b1d73175
SHA512 35796ba5bc07783980ed815a298cbe11eb84341ab3ed3b7df4966cf2a2a5f29396499a021b2b5c728feb44622102fdcae6c8710410143f740fca96cd04abe820
SSDEEP 384:tsGtsdaixKmGysip9HOqCaA0s5tS9lo8tc9oBDInX8p+1Cm4FOzrAVcfjC8j4BS:2/p9HOzf2c9oBDInsw1x4FQrAs0BS
TLSH
T1C0A2CFEB892B5152E17F3230493B90880916F1D63EE9CC55D3EB2F90A02A68F7299DD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bullet Ballet (1998) [720p] [BluRay] [YTS.BZ].torrent:Zone.Identifier

Path C:\Users\Admin\Downloads\Bullet Ballet (1998) [720p] [BluRay] [YTS.BZ].torrent:Zone.Identifier
Size 80B
SHA256 a649c4ff1479fe75c3843d9f4605d613b5b3eb1a92f201c55a248e2a2e12f213
MD5 1cbaa6da1b65b4254c4d8d6445291507
SHA1 a3a45023efd4ddaeb1b3674cde6e9b2c331b89d9
SHA512 08dd6c4980a129f86444ac6e42892c48d3ea9c7e94b626cc359b1554c735cd73386cb884a91cbe8975f1e4f2fcc524cdfc68d744d5811b038c7fa27aab158ead
TLSH
T13DA0129F8611558D00102398146989A9900B14000E550040D4008087948001881E0505
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1108-10-0x000001736D1F0000-0x000001736D200000-memory.dmp

Download

memory/1108-0-0x000001736D1F0000-0x000001736D200000-memory.dmp

Download