hxxps://fuckingfast[.]co/y62inwiswl6e#Forza[.]Horizon[.]6[.]Update[.]v364[.]933-RUNE[.]rar | Triage™

Resubmissions

27/06/2026, 12:07

260627-paembsa19m7

27/06/2026, 12:04

260627-n8xp5aas811

27/06/2026, 12:00

260627-n6gacsa16q3

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fuckingfast.co/y62inwiswl6e#Forza.Horizon.6.Update.v364.933-RUNE.rar
Sample260627-paembsa19m

Score

7^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

pid	Process
2092	forfiles.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4676	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

PowerShell

pid	Process
6544	powershell.exe
5620	powershell.exe
2592	powershell.exe
6296	powershell.exe
6268	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

NTFS ADS 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Archive_win64_8436.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\LofPtETo9.zo:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\TravelBookingPortal.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\Internal.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\TravelBookingPortal.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\TravelBookingPortal.Build.props:Zone.Identifier	Setup.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
5400	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
6544	powershell.exe
6544	powershell.exe
6544	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
2592	powershell.exe
2592	powershell.exe
2592	powershell.exe
6296	powershell.exe
6296	powershell.exe
6296	powershell.exe
6268	powershell.exe
6268	powershell.exe
6268	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	firefox.exe
Token: SeDebugPrivilege	4936	firefox.exe
Token: SeDebugPrivilege	4936	firefox.exe
Token: SeDebugPrivilege	6544	powershell.exe
Token: SeIncreaseQuotaPrivilege	6544	powershell.exe
Token: SeSecurityPrivilege	6544	powershell.exe
Token: SeTakeOwnershipPrivilege	6544	powershell.exe
Token: SeLoadDriverPrivilege	6544	powershell.exe
Token: SeSystemProfilePrivilege	6544	powershell.exe
Token: SeSystemtimePrivilege	6544	powershell.exe
Token: SeProfSingleProcessPrivilege	6544	powershell.exe
Token: SeIncBasePriorityPrivilege	6544	powershell.exe
Token: SeCreatePagefilePrivilege	6544	powershell.exe
Token: SeBackupPrivilege	6544	powershell.exe
Token: SeRestorePrivilege	6544	powershell.exe
Token: SeShutdownPrivilege	6544	powershell.exe
Token: SeDebugPrivilege	6544	powershell.exe
Token: SeSystemEnvironmentPrivilege	6544	powershell.exe
Token: SeRemoteShutdownPrivilege	6544	powershell.exe
Token: SeUndockPrivilege	6544	powershell.exe
Token: SeManageVolumePrivilege	6544	powershell.exe
Token: 33	6544	powershell.exe
Token: 34	6544	powershell.exe
Token: 35	6544	powershell.exe
Token: 36	6544	powershell.exe
Token: SeIncreaseQuotaPrivilege	6544	powershell.exe
Token: SeSecurityPrivilege	6544	powershell.exe
Token: SeTakeOwnershipPrivilege	6544	powershell.exe
Token: SeLoadDriverPrivilege	6544	powershell.exe
Token: SeSystemProfilePrivilege	6544	powershell.exe
Token: SeSystemtimePrivilege	6544	powershell.exe
Token: SeProfSingleProcessPrivilege	6544	powershell.exe
Token: SeIncBasePriorityPrivilege	6544	powershell.exe
Token: SeCreatePagefilePrivilege	6544	powershell.exe
Token: SeBackupPrivilege	6544	powershell.exe
Token: SeRestorePrivilege	6544	powershell.exe
Token: SeShutdownPrivilege	6544	powershell.exe
Token: SeDebugPrivilege	6544	powershell.exe
Token: SeSystemEnvironmentPrivilege	6544	powershell.exe
Token: SeRemoteShutdownPrivilege	6544	powershell.exe
Token: SeUndockPrivilege	6544	powershell.exe
Token: SeManageVolumePrivilege	6544	powershell.exe
Token: 33	6544	powershell.exe
Token: 34	6544	powershell.exe
Token: 35	6544	powershell.exe
Token: 36	6544	powershell.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeIncreaseQuotaPrivilege	5620	powershell.exe
Token: SeSecurityPrivilege	5620	powershell.exe
Token: SeTakeOwnershipPrivilege	5620	powershell.exe
Token: SeLoadDriverPrivilege	5620	powershell.exe
Token: SeSystemProfilePrivilege	5620	powershell.exe
Token: SeSystemtimePrivilege	5620	powershell.exe
Token: SeProfSingleProcessPrivilege	5620	powershell.exe
Token: SeIncBasePriorityPrivilege	5620	powershell.exe
Token: SeCreatePagefilePrivilege	5620	powershell.exe
Token: SeBackupPrivilege	5620	powershell.exe
Token: SeRestorePrivilege	5620	powershell.exe
Token: SeShutdownPrivilege	5620	powershell.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeSystemEnvironmentPrivilege	5620	powershell.exe
Token: SeRemoteShutdownPrivilege	5620	powershell.exe
Token: SeUndockPrivilege	5620	powershell.exe
Token: SeManageVolumePrivilege	5620	powershell.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
3008	Setup.exe
3008	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 4936	6008	firefox.exe	90
PID 6008 wrote to memory of 4936	6008	firefox.exe	90
PID 4936 wrote to memory of 6676	4936	firefox.exe	91
PID 4936 wrote to memory of 6676	4936	firefox.exe	91
PID 4936 wrote to memory of 6676	4936	firefox.exe	91
PID 4936 wrote to memory of 5892	4936	firefox.exe	92
PID 4936 wrote to memory of 5892	4936	firefox.exe	92
PID 4936 wrote to memory of 5892	4936	firefox.exe	92
PID 4936 wrote to memory of 5892	4936	firefox.exe	92
PID 4936 wrote to memory of 1804	4936	firefox.exe	93
PID 4936 wrote to memory of 1804	4936	firefox.exe	93
PID 4936 wrote to memory of 1804	4936	firefox.exe	93
PID 4936 wrote to memory of 1804	4936	firefox.exe	93
PID 4936 wrote to memory of 1264	4936	firefox.exe	94
PID 4936 wrote to memory of 1264	4936	firefox.exe	94
PID 4936 wrote to memory of 1264	4936	firefox.exe	94
PID 4936 wrote to memory of 1240	4936	firefox.exe	95
PID 4936 wrote to memory of 1240	4936	firefox.exe	95
PID 4936 wrote to memory of 1240	4936	firefox.exe	95
PID 4936 wrote to memory of 1240	4936	firefox.exe	95
PID 4936 wrote to memory of 3920	4936	firefox.exe	96
PID 4936 wrote to memory of 3920	4936	firefox.exe	96
PID 4936 wrote to memory of 3920	4936	firefox.exe	96
PID 4936 wrote to memory of 3920	4936	firefox.exe	96
PID 4936 wrote to memory of 2592	4936	firefox.exe	97
PID 4936 wrote to memory of 2592	4936	firefox.exe	97
PID 4936 wrote to memory of 2592	4936	firefox.exe	97
PID 4936 wrote to memory of 2592	4936	firefox.exe	97
PID 4936 wrote to memory of 2448	4936	firefox.exe	98
PID 4936 wrote to memory of 2448	4936	firefox.exe	98
PID 4936 wrote to memory of 2448	4936	firefox.exe	98
PID 4936 wrote to memory of 2448	4936	firefox.exe	98
PID 4936 wrote to memory of 6848	4936	firefox.exe	99
PID 4936 wrote to memory of 6848	4936	firefox.exe	99
PID 4936 wrote to memory of 6848	4936	firefox.exe	99
PID 4936 wrote to memory of 6848	4936	firefox.exe	99
PID 4936 wrote to memory of 5020	4936	firefox.exe	100
PID 4936 wrote to memory of 5020	4936	firefox.exe	100
PID 4936 wrote to memory of 5020	4936	firefox.exe	100
PID 4936 wrote to memory of 5020	4936	firefox.exe	100
PID 4936 wrote to memory of 6780	4936	firefox.exe	101
PID 4936 wrote to memory of 6780	4936	firefox.exe	101
PID 4936 wrote to memory of 6780	4936	firefox.exe	101
PID 4936 wrote to memory of 6780	4936	firefox.exe	101
PID 4936 wrote to memory of 6028	4936	firefox.exe	102
PID 4936 wrote to memory of 6028	4936	firefox.exe	102
PID 4936 wrote to memory of 6028	4936	firefox.exe	102
PID 4936 wrote to memory of 6028	4936	firefox.exe	102
PID 3008 wrote to memory of 1656	3008	Setup.exe	109
PID 3008 wrote to memory of 6080	3008	Setup.exe	111
PID 3008 wrote to memory of 6792	3008	Setup.exe	113
PID 3008 wrote to memory of 2312	3008	Setup.exe	115
PID 2312 wrote to memory of 6544	2312	cmd.exe	117
PID 3008 wrote to memory of 5996	3008	Setup.exe	119
PID 5996 wrote to memory of 5620	5996	cmd.exe	121
PID 3008 wrote to memory of 6776	3008	Setup.exe	122
PID 6776 wrote to memory of 2592	6776	cmd.exe	124
PID 3008 wrote to memory of 2428	3008	Setup.exe	127
PID 2428 wrote to memory of 6296	2428	cmd.exe	129
PID 3008 wrote to memory of 1392	3008	Setup.exe	130
PID 1392 wrote to memory of 6268	1392	cmd.exe	132
PID 3008 wrote to memory of 2092	3008	Setup.exe	133
PID 2092 wrote to memory of 5144	2092	forfiles.exe	134
PID 5144 wrote to memory of 5564	5144	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://fuckingfast.co/y62inwiswl6e#Forza.Horizon.6.Update.v364.933-RUNE.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://fuckingfast.co/y62inwiswl6e#Forza.Horizon.6.Update.v364.933-RUNE.rar
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {ed6a8078-3f7a-43ac-8398-adcf7b0ab439} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {1093cf56-79a9-4a4d-891f-6ed50116b295} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3932 -prefsLen 25164 -prefMapHandle 3936 -prefMapSize 270279 -jsInitHandle 3940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {6fa41ee4-2c0b-42bd-ac49-5a2e21c89eb7} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27274 -prefMapHandle 4088 -prefMapSize 270279 -ipcHandle 4176 -initialChannelId {66d04d8e-7b4f-4b4a-82b7-bf14c5fa9f18} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1644 -prefsLen 34773 -prefMapHandle 3244 -prefMapSize 270279 -jsInitHandle 3248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2928 -initialChannelId {7e22e7e6-57ca-4e93-8977-7bfef73a8ed6} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5136 -prefsLen 35010 -prefMapHandle 5140 -prefMapSize 270279 -ipcHandle 5152 -initialChannelId {ff3a2f62-c59a-4ab3-a5b1-84ff95224279} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3248 -initialChannelId {088d6e4d-8331-43b0-80aa-4bf8da54d6a5} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5816 -prefsLen 32952 -prefMapHandle 5820 -prefMapSize 270279 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {1ae57e1e-65fd-4415-8d99-146f38f4474a} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5984 -prefsLen 32952 -prefMapHandle 5988 -prefMapSize 270279 -jsInitHandle 5992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6000 -initialChannelId {6f4b0c5e-b701-499b-a01c-93732ec1f811} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6184 -prefsLen 32952 -prefMapHandle 3248 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {80f39ffa-9229-453f-974e-97adda027bf8} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6308 -prefsLen 32952 -prefMapHandle 6312 -prefMapSize 270279 -jsInitHandle 6316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6324 -initialChannelId {e34bfd9e-9b5d-42fb-af66-c060521d648e} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1616 -initialChannelId {71465062-0068-4f25-b983-9e08b68d2ec3} -parentPid 4936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:6028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3440

C:\Users\Admin\Downloads\Archive_win64_8436\Setup.exe
"C:\Users\Admin\Downloads\Archive_win64_8436\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:6080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:6792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6268
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo /m LofPtETo9.zo /c "cmd /c ren @file LofPtETo9.bat && call LofPtETo9.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "LofPtETo9.zo" LofPtETo9.bat && call LofPtETo9.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:5564
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\LofPtETo9.bat" /launched
      4⤵
      PID:6904
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\LofPtETo9.bat /launched
        5⤵
        
        PID:792
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\TravelBookingPortal.csproj" /nologo /v:q
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4676

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Archive_win64_8436\log.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9cff49efc112d2c96a8fcd9c766227b4ed7e0cb09999397170b5b0fbc929ddc9
MD5 f82ea1885b0857b39af445f2dfaa7220
SHA1 44e7e7f2bfa0034f135ecd7a9bb9b0726272d98c
SHA512 e0725674335d935cda6b2db26a8844a099656589c6c11bb4b4e403372dec7356d3e9195f2d6be42ab55357fc978de467784ff228f50d8fc05b8c652397190792
TLSH
T118318637F3DC8611CC9A003A10DDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7bc4d1c1c5fd4296a889f290ed4c80b702a3d1480857d7dbcbb4875044917468
MD5 b70ce503db8b6273a4a3f43cd13b9728
SHA1 83877ee2f409dcfe77b5fc1d27eaaa22d971294a
SHA512 5f175cf1e13e646e0c0f4d25b0207e890ee89c7383c9913df496b03550d11773842196f0c26c4e97a3116c19bc74e9623c833972a6f611d0491b931c0b0af06a
TLSH
T1C7219833F3DC8614CC99003A10DDAC1036B6C7CB40DECF9B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 af7dbeff30c4fae6694a563ffa4d08ba511dd92b848dfacbd925554ac030be92
MD5 5fc0655760908e00773027a95f00decb
SHA1 4497367ff36afb502809a85ce438469afa51602a
SHA512 2ee4d12a599df6af10c706bdaa6bffea4ddfa619f0cc727d82af5391ada1c768158252203c38248a06c73643c5abde04b1e6c8fdd54724a68a4f0f73ec17014f
TLSH
T167219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a3b73f3da5f909e5d1d257c99560b04f2202dcead30224cf3e9f51eeb3b5b2fa
MD5 a79cbec7f8ddec36aec9767b30d8e8fb
SHA1 94d0b955901bcd888ef717b6ec2a5fad28f313a0
SHA512 75d0b7f03d421db05df18e5ece8b90eebb3e977651ae2b66c94b397fd322a3d582490fb114fe104de189ce1a561cc0c1db978cf6256ab2df8f7e7ef5fe42f804
TLSH
T1E9219833F3DC8624CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 7242d373e2ff0a640624c87c8a8c2939b38378a24875a04e028bd1fbae2096ad
MD5 88b78ca0689100501e2f1e33321a54a5
SHA1 0da44281ad58fe59601f11b52b9798cea9b942e2
SHA512 00957f128877664a7b19be0ad69715bf2deafa6115bf649572d32e39550d6a47bd35fc0a8a397024830971b19d715fabbf7a4f921711ab44773f6c1613c6ed35
SSDEEP 384:HPC9iO024YJo6J+Sl1xDnZBPsac4j0lpDII+a/yvY/yvQJ:v9ZYJo0+Sl7zZlsac4ID8LoyCyk
TLSH
T1AD529EBE9F0238AE1927D1A5D5FE9244CD08E6BFDEE2905615143C04CA447B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_acpvihyc.ric.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_acpvihyc.ric.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Internal.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\Internal.targets
Size 1.2MB
SHA256 dd3bcbdd519bd207b6ffbe095f6cfafd6da5521d7244a63a33d1849ee41ad245
MD5 48bc58fcc4b9961814479369482813bc
SHA1 ff36e7c5ccd7e3ee8ed89a140ae822d4daf101bf
SHA512 4f1f3cfa012375cf84ac7f7f816333f0d0a162fd90496f4fef794c90f5715592e35355022dffa8df5c240b417e337eaa4894960a64704d863ed48b36444d4ce0
SSDEEP 12288:QqZP/1llDZXCKGDvudTgfRO4aSdqhfxi/O54m8LMtNB8yanEz24V9Gn:QqZP/1llDZXieEfRO4eh/4FS8yaEz2vn
TLSH
T1D445C6B32649FDAAB7B31E8485401301AC943B4B5A38C17CBD1B91562AD7284DCEDFF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LofPtETo9.zo

Path C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\LofPtETo9.zo
Size 1KB
SHA256 cd5c167a60807d1a833295b55aa6c7f26eaee1d022b9446546c5c5227f23acf8
MD5 6db941a50ce645b2838b7c85c4fb6de2
SHA1 25eefb2fb7b39b35d2564628b208af6b661b169b
SHA512 187fdbd07db83ad2423ac52cb3d6fa2b5eda114ab8a64ae7def4e51efaf36d9cd0f57b4325e47c66268a1f489a0fafb81831cbcc3dc5961595865bd8fd3ec984
TLSH
T159217696B522155DC8A4727B27B58333120D72833884F5BDB0C4DDAD749F43FEAA12E8
MD5 SHA1 SHA512 TLSH

Submit Download

TravelBookingPortal.Build.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\TravelBookingPortal.Build.props
Size 516KB
SHA256 3b8aa49d4601655d80558ff91a72f23c9a950b4508d1ab5074d89b0596841202
MD5 971223a4c7cdaf4d27eb67b99f4c0c68
SHA1 b07dc2a93313300deac90c6e4bfbacbb9aff7480
SHA512 f360d6436935c41af4e17fa9b32cee5203ba132f2b55940d8f6eb0862b54909c6ccec4a56f956a86b03347b66fa7c2ee77c59dec15f7dfa27531b631160070d3
SSDEEP 6144:MOIxPWzahRbZa9MEYFpQij7mHS4Dv9ciKYNcmjq+PDxe+tv+PCdxBduxqqR2Q0jb:nIxPwEZa9MEqj7GKi3Xj2Bsp3IY
TLSH
T1FCB40C73541BFCCE6B370ED5405066400D6D5E6FA618C878FB480399A2EAE5EFEA8C71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TravelBookingPortal.Build.props:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\TravelBookingPortal.Build.props:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

TravelBookingPortal.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\TravelBookingPortal.csproj
Size 8.8MB
SHA256 28f6b2969edc4fda988ce26dbc8635c86f1a4a7bc1dd495d0d716d3a97b95e24
MD5 a823eef66ccc042c659a810d43479c4c
SHA1 9e9c92a4dc14e7e919d1f00a90f49a34f9be4ec6
SHA512 1794c14fb8896639ff26171f5ba1d90aede9e9a4c3f03e7ca9e5812052db2ff35d03f7fc932e3f8dfea80a2b6f51f64c3e0ffd621eba80f410310e75e50c4d17
SSDEEP 1536:+ETcVLMdINaKabqmTpMHpf0JB+0laCiItqYkLxE//Jwl7R/1TFlIeAavthqHJR/r:Z
TLSH
T12196DE7B078047BBF3D407C4446F342E26F4E126B925219AAB7369EFBC1AA97407C653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TravelBookingPortal.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-21884-ag8vS108CrHo\TravelBookingPortal.csproj.user
Size 801KB
SHA256 08afffab51bbd552901a183f9edf4c8c96c2c58696b2c9bacd6032c93cf60669
MD5 a9c560d6f014070af0bedb296e83354a
SHA1 0ca5c5e8dfc0acf6b693138dcc1c0e5476421a85
SHA512 5c6b4f6295996ef0a72e3701ea1d162d0f482039a616c51004aab6e4599690c98dae76b997ae70856d2f98dab584f8409fec2da1e33318b059b28954d7eec4f3
SSDEEP 6144:zSYiHEoAmKnWdgTYiXQs1aSoHQcVWZ+FGi0FWIkGVlF4sHkkoyVCXdvY4FMNbGmp:UHkmxaGmSlMY6JXnxoJYjTTlggHb7
TLSH
T1DC059675110BFD9A0C3BCA5BF84A94425C813173F50AA85AF5C84D2F92F74AB5EB8CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\AlternateServices.bin
Size 3KB
SHA256 00d02b4f591436a939c05afa27b9d47727cd9a910913053e5efe62658a2c84ab
MD5 fe8aecf80a25fbaa4357797c667e6fea
SHA1 288a5cb91c6b1c72a6de8cd5415ecf88801784cf
SHA512 a903ffdbb7ab67ac70a7b4a6b24c4045c89d972c5948e630673c90540736ce05016bebddfe4c86e09f4b59d1b4c04677f9b9ffab78d2527d46d8b42eb382dc39
TLSH
T10D81F4E346738631E0104FB19058B2A99CB3520B16BD184B5F18F0D76883FB9D07EB6C
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\AlternateServices.bin
Size 7KB
SHA256 a77183cc963328e99397bc2a411abcd47f44e66a5b960e45da1f50dff678c6df
MD5 d8292ed5e77946c86e30f30c637cd2ff
SHA1 280c4df755a1861fef202a24e790c2a99cbd9406
SHA512 d4cbb5bc93aed72b8f6957fe244d7e78932a4b40cd4edf4362763a6c6ee679d46fbd735f31b86077e0a7fbefc2f0d1992359c3d6d3d6cf470564a5cfd8d63e58
SSDEEP 48:8tvo/U8iXDu/UjUWiUsUNY/UB7h/B7h/:syU8iXAUIWtX0UZ1Z1
TLSH
T173F126E189738632E0208F70109CB1ADDC73150AA799495AAF08F0D35457FBAE5BEB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1f4f64b38933f6ec8db1c6d60d37b27319380af8cb68011ea103466f20e2f55c
MD5 7782b74c462dfb1559d7c574ec36c91a
SHA1 14c1607cdcb2e0b75a6ba70a651611e8e9bb5194
SHA512 66095ccc9cb5817da0a35812d05159da19b21b9ab7bce7fdfc6a1fbd8a28cf4fee9eec598f3475d65571f2d5dc45a02c2a6c38e48fecf2312d090ef4cebaeb2f
SSDEEP 192:Pv1d66JoztdzgCl6mc0dMOv5zbo7fZcWyjby:Fd66Joz/zgC1j9borZcWyj
TLSH
T1FEE10CA4EA38863FC409027BCCA21F810F39395A984E2F1935DC61182D572DE378E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 94b316b0f84ecfbe3ec80c44accdeeb83a3b51b4c162f36b0f681069e12f19fc
MD5 a0d6408af1896bbba9f0f6053ed96577
SHA1 5621ac663a4d10bafb1d413a832f1aa66435fdf2
SHA512 d412612fed8cbccf5818ebb33acbac30d27038e25f4965412493ff78f8b0f69be5f486deedd2fde847b5ae14246632aaeaeffaf0ed3f2c3a67e9090735e35e9b
SSDEEP 96:pYkSdF95/7bkW6ArcEPUWyUR6iUx2WZP/Fo2FgFzFNk/dd66JoztdzgClKtmc0dM:NOv5zbo8bcWyjLxVv1d66JoztdzgCl6o
TLSH
T187C1C868F6395A3FC409023BCCA20B800F36395A984E3F2A31DC64192D573DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8f03a08776489ad6fb1b1de85d19b7eb95179cd6f93e32f91934acbf5d865ce8
MD5 451055318e9a74354934542fd892b40a
SHA1 78a8ab371e4121815f93d1c4cf42d05e9f761000
SHA512 bf328799828c7f1c1d34be639653c9fa876b8517368e6638b7c5e83346373f6702fd8b6efe7f93242cae7e814fb4c0eced682791c29f99aa62d3192e1eaa9f71
TLSH
T1A7216A8C3DF84DAAA8C7E25CB841028F63658A4316871D475D42FF8CCE91AD9326E47D
MD5 SHA1 SHA512 TLSH

Submit Download

3a9ef762-15ce-41cd-9848-7a3e9d036036

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\pending_pings\3a9ef762-15ce-41cd-9848-7a3e9d036036
Size 2KB
SHA256 97d704e5a085783d8cb112f826164880614200013857d899afe5ab35eb4c9424
MD5 88211f892307dbee8a05fd16639fb22d
SHA1 00134a4153a2806605ae1482e603b03aac254dc9
SHA512 5734766f063fe19ed7733d6fb4659108c467ede9eeeafcf17fc01abd367899b198b9c91aaa9d1869763586b1f2d9cdcb9e80fc104771c890e538052abd5476f6
TLSH
T1CE41406C35B85C3B9C8AF25D9092278E53609A43008628476D51EF4D8DD27AE337A42F
MD5 SHA1 SHA512 TLSH

Submit Download

923cb264-3ad5-42eb-93ec-83f86a12cd27

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\pending_pings\923cb264-3ad5-42eb-93ec-83f86a12cd27
Size 235B
SHA256 dc765b2ff543ab4c0ec26cbef786b3129e70441e51c5f9da92f82c48eac1961d
MD5 6f0cc78af034b141acf9fa98f68e2a3f
SHA1 7fae0ea8c1e273ede5e04ada9fcc13ae5491a188
SHA512 b2d14352b00dc7cd06679ca61a328cbe7eee4307ee568cc6b7e93ef336e01aabf904dac063225cf9b5284acf213d109b3ba3c977bcf9546d3b3dada7feb91ca1
TLSH
T121D097C02888B76E08040F02F0A128D230898C3328F0A810C562407C8DF9EC80191916
MD5 SHA1 SHA512 TLSH

Submit Download

9688fd8e-7f17-440f-af74-0f1a9776afdd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\pending_pings\9688fd8e-7f17-440f-af74-0f1a9776afdd
Size 883B
SHA256 a618ee357469a5e84d46e92684b9a1b624673b06d6da6043e2d2748f25cf1ec5
MD5 83d877a2dc8a2f341826782d7a82cc47
SHA1 e1f24c2a1f35252f695db296519e03ad1da13df4
SHA512 c8606809c2511847adcce10e73760ece532c485cb0671c6e5a2ab7d57ca0664f9aaa6384be5efbd297b5c09d16ab1bef9a6e59dd795faa05bfac858d25dcbabb
TLSH
T1EE11E7809A347972CD6DD25BC8A53B9657E4781380CA45183DF15A180DBA61D977A30B
MD5 SHA1 SHA512 TLSH

Submit Download

9e8b45b6-638d-43f9-a2e3-a80bb4086200

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\pending_pings\9e8b45b6-638d-43f9-a2e3-a80bb4086200
Size 15KB
SHA256 88dcfbf490db63a6e87963a8d434b6f376e0ad4939617f769ff839bde7114ef9
MD5 41db6312161c3524eb8c54f47dc709b2
SHA1 2f28c3b3c024c4c1b86bfe17cafdda28b2f671d0
SHA512 3a566c76406868a7c021682226a74146a751b90534d732adab2f7400651815e6b993770139d5acf795695807d4539ec85bdc95aa17da756244ae180fb0e15f39
SSDEEP 192:P2wcqio5jRJHXNKzO39DMJ+uKjrnBBWDLM31XPDwEleplePrXewmQLJ4QgxfZ3:sqio5jRpXNKit/ugrnBQMvl4p
TLSH
T12962D9562830597E8551E3A8D8EC7FC7E2F618CF8C019FCE9BE4BD4869EA09D1127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1ac9e41-b472-4676-8284-e154ec53c04b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\pending_pings\a1ac9e41-b472-4676-8284-e154ec53c04b
Size 886B
SHA256 3ae921e138fbfde545dcbde000d53219516e4fb43581e3b9e977bff63aa3a3f6
MD5 38c5c7f6b0ed7dc705cc70717664cd6c
SHA1 60a1bfde117a13ff843ec03bcba891c8d0aef7e6
SHA512 b7ca200b2cc4a83d1cc77e366c5a409cfabd5941d0d4c74c577332512b9f194da23fbadd8d89d86c12e4f9404d231e96295797a0ab8611d27b94adc9da469487
TLSH
T1C51104C096747972CC3DD29B84E17B8387F4351380CA09187DA45B140DA76196365317
MD5 SHA1 SHA512 TLSH

Submit Download

c49888b1-8e3e-4b81-8eb2-c344fe78e2d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\datareporting\glean\pending_pings\c49888b1-8e3e-4b81-8eb2-c344fe78e2d7
Size 235B
SHA256 20f1968ab0f9d38424968984e94d8bedac258bce84d9b8852c102ab457f04f41
MD5 d46703901d4a648c21eb902e0594a813
SHA1 1c35db6ddd3427864b3cc919ec6186346b7caed9
SHA512 65d9ed5af3ee9bd03e1a4c4485fc9f00875333b3b88c0faefc3a991fd089b46f0f7aed7c1f9facc44457bb78c5b7dc66af82e67615f224a7502b77b559fb2622
TLSH
T1C9D0A784249867AD08255F07F0E0A9D671468C3358A56C20AAE1857C9AFDEC551A1927
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\extensions.json
Size 16KB
SHA256 db2bc08c44c7af634a555f6df77ce962d88f6b0fb86c03885d3ac1ced4b14704
MD5 ff4751818ebbb48e0057a5a1bfa8c26f
SHA1 c2ebe6cb0a2b887c3c16192354f7dfd06202c811
SHA512 ae8be750c743d3933245827c86c867bee2029f6cc0e14f403ccb93efc9bdc0f1c2d0155373b0d40a63b21a82925b174167409928eed67983bf92c105a21ca39a
SSDEEP 384:XkI4v+Umldvp8dhWY94zh96ouL4HeL4PGL4HdL4HoL4HSY4hP:0I42RfKX14b6z4E4U4d4K4z4N
TLSH
T1DF72421545148EB8298FA79BAA367E01C27D473B70845C78F4DD8FC802FB5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\prefs-1.js
Size 7KB
SHA256 fdd70c5d48ad514fe2952cb708a222c79db4b4c9c020749f03ee731a356274c0
MD5 9601fe317834fdad752b1b6b1a94ec61
SHA1 66e4514886f9889c6687fb41526f5e33b6fe9655
SHA512 9c1f5ea75dec348a90ce4100ee95c44f9f8d02315a4ae95b5893ca0b76cf5400d21bdb948deddb6545d9cc69e69dff51ec56d9c2b3ad269657484c45c2cb6f5e
SSDEEP 96:xH0FdTUSPqGqbfslBObzSCSSlAdv9jaYn8HWMQBw88Y/8L4cnNesDy:yFTCRbfslBUSSDQBw88by
TLSH
T1D9F1FC389444CB7F64B2766CAC644D716A72023B77BF68DA20B958850508F3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\prefs.js
Size 6KB
SHA256 fdf92ee64f9218820aa161a1e24204ab82ec7a9d498370857d9dd7795a5dc657
MD5 a3cfb414fa6d85ebdb83165556d878c4
SHA1 cb701ebfba96ce901d3098bad4135546e3ff5001
SHA512 32bd30b26fb9e9ecb67f396ddd155e4218e9978b719631b4619d0b60f35b441499ffd878faa26896c47493a545b5b72202051613fb02fb623336413e9abd05d2
SSDEEP 96:xH0FUTUfqGqbfIjA1zSxSSlAdv9jun8HYVBw88u8L4cnNHsDy:yFiRbfIjAESSmGBw88iy
TLSH
T149E12D7894088B7F64B677AC6C688C715AB2013B77BF28C710BA44C9054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\prefs.js
Size 6KB
SHA256 20298deb75f981d2199bef6a5dc4fb9910b10206cc46706d24bdcf0f1c4b11f0
MD5 89be8f0b9d28b6814b74cb10889d4671
SHA1 bb830426d60b5c94e3078a1c5a2d19bfaca5a19b
SHA512 d0a95e41ea02af4647fe42c9054bf514bea6640c2ab8038c77d6aeacd4cda6919ee9ccba39fa784893e00febb04f8d6ae5874a895bc75be4913e2af0012390b8
SSDEEP 96:xH0FUTUfqGqbfIlB1zSCSSlAdv9jaYn8HYVBw88u8L4cnNHsDy:yFiRbfIlBPSSDGBw88iy
TLSH
T10DE13E7894088B7F64B677AC6C688C715AB2013B7BBF28D710BA54C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\prefs.js
Size 6KB
SHA256 51856eb51a2412387aba4339516b63d22b02bb8c3c7ccb13f60761617eee1c82
MD5 0f32e543b959e6aea51b9f1e20330884
SHA1 f6853e8f178b698745ff5404a850199f32036cd2
SHA512 b0b775ee1f42cc2572dd416b017d522effd0a2db4261192bf438e36ee1df35dc20b31bcf8da7c4ee7197c6fffa08c3dc53be29cc1b671f7cef7c31573509db10
SSDEEP 96:xH0FUTUfqGqbfIlBObzSCSSlAdv9jaYn8HYVBw88u8L4cnNHsDy:yFiRbfIlBUSSDGBw88iy
TLSH
T123E13F7894088B7F64B677AC6C688C715AB2013B7BBF68D710B654C4055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\prefs.js
Size 6KB
SHA256 d8425cddd5e282e55c0ff0d57e68b366eb2e01723d1172757d5fc399c8a08fd3
MD5 f5c3abd7c42e9e52567ff8e7a51fed34
SHA1 9f7a97b66d4dfddb899b310e44c9ef2af2b3bb44
SHA512 c246f038cd2ed430a7a93aec758e0d9abe0a18250d5b8e0496dcfeed8bbd756af52e77e3745740d6b8427e4f69ee750dc6d72b0eae12364d11d263c386c44841
SSDEEP 96:xH0FUTUSPqGqbfIlBObzSCSSlAdv9jaYn8HYVBw88u8L4cnNHsDy:yFiCRbfIlBUSSDGBw88iy
TLSH
T12FE13E7894088B7F64B677AC6C688C715AB2013B7BBF68D750B654C4051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 9aa60e587f4a4b04011c1ff95a12880e1453cfe135ba4475b10c3f2ca5130fd6
MD5 8494694b1adfa5916db6cb5567d2e1fa
SHA1 02be51b2150c901e17673f8ae91d47319d17611e
SHA512 61e38c6aaee6de3f345dd426b102581d39895819fcfdc53fec23df42a6ddfb85e9712a9292fd0621496173eb3dc18f9f50a46b5b792c9b2531a551e9014b4f24
SSDEEP 192:3W9xl49tmAEDnTmTlEVSPqGbqlBdodsxfsZnbhoXEEZkTcF:3WnufL8ylElGbqlbtfsLqZt
TLSH
T11DD18E37A42D0E927A14BA1BEA0858FE865F70408D2730F4D33B5CEAAD48510D6C5137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 4a710da6d93595952f247a63a6d544bd6c63fde99de69f58c3e23f4f68c1dffe
MD5 62d1164b4253f48ef4431024996a52d8
SHA1 ce9e6d3922abe568ce602d313bf83783efc9a9db
SHA512 57a5c4fca774e9a5e5f9ce52a24f912da2647ccfeb7f63aee295386728f12c2b980e25961f3837cc019de4df3cb7f0a8f96b6731c0289c6f81b20bfd34262003
TLSH
T1BB41FAAA7C156DD2B534D267940046F6C3CB3095C9B300F4CB568D274C99A24E5E166A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 cb58dcfa34aa27fa973af3a8aae2720de61657f8ec057c59c9596a333fd22488
MD5 dba4bf57ad957bf26d4a9a361683d245
SHA1 c4f9242eda1e8c9c6cacba0ae4947ec9f9a4a8e8
SHA512 872c20fff21cd44a2ce566bd416496335ba931a8c2915b1cbfef167ac169a9394a7e4cef119520e3e02a5d43e7433feb2a4cf62d849da2e1cb3241f95e252177
SSDEEP 192:3W9xl49tmAEDnTmTlEVSPqGyqlBdodsxfsZnbhoXEEZkTcg:3WnufL8ylElGyqlbtfsLqZY
TLSH
T1E6D18E37A42D4F927A14BA1BEA0858FE965F70404D2730F4D3375DEAAD48510D6C5137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i0p3vc8v.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.1MB
SHA256 652f577e1406faf45e02b6bd7953d489f872d07f81eae4c24dba0aa25a60105c
MD5 4ddf07d186f9fe8f3f5f3bd34d582ff6
SHA1 ab95720534a49ea20579f7751c374b21f2f3e9ba
SHA512 b92316fe56dd1a1bd301ab3ae6a86ae115da9ca222912b44eccb07007acf0b1f6f05959d5d5625bb565b3a4e260adedd7302c158830af6c737100fc08ff09b76
SSDEEP 49152:LLqLyNaeUPBsJzqusC7efIKT8UL2WolAFOqiiYa/kKvWLQDYyipGGekKCfVXbgyu:Ps0QkKCfVXbgy8s
TLSH
T1DD765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

log.txt

Path C:\Users\Admin\Downloads\Archive_win64_8436\log.txt
Size 357B
SHA256 b7d92b3c905617ef0d882209ff98d0d1ed580f5cdac9052f30e345545d37ba56
MD5 f94b365b9c2ab2efe8f724a15e8d1706
SHA1 711d279b50e37169585dcadb9042a2143145b1f1
SHA512 29ca6d180b06c18d869739d128a7e6f04daf471d5c7166cee4cb500f8f878567545d9f2f1039237efc5ee72a5f26b72d4b0941de5330c3ed4afba6c7cbbaf28b
TLSH
T162E0DFC5EEA080B794608A0C0F822E7312446A8E0A9AF2C91E842A8016CE97AB72D135
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4676-1100-0x00000000059F0000-0x0000000005B4A000-memory.dmp

Download

memory/4676-1098-0x0000000000DA0000-0x0000000000DE0000-memory.dmp

Download

memory/4676-1099-0x0000000005810000-0x000000000582A000-memory.dmp

Download

memory/4676-1101-0x0000000005BE0000-0x0000000005C10000-memory.dmp

Download

memory/4676-1106-0x000000000BD40000-0x000000000BF1C000-memory.dmp

Download

memory/4676-1141-0x0000000006030000-0x000000000631E000-memory.dmp

Download

memory/5620-1032-0x0000015D7AB20000-0x0000015D7ABD2000-memory.dmp

Download

memory/6544-1000-0x0000023A4CC30000-0x0000023A4CC52000-memory.dmp

Download

memory/6544-1013-0x0000023A4CEA0000-0x0000023A4CEBE000-memory.dmp

Download

memory/6544-1014-0x0000023A4CEC0000-0x0000023A4CF72000-memory.dmp

Download

memory/6544-1015-0x0000023A4CF80000-0x0000023A4CF8A000-memory.dmp

Download

memory/6544-1016-0x0000023A4CFC0000-0x0000023A4CFEA000-memory.dmp

Download

memory/6544-1017-0x0000023A4CFC0000-0x0000023A4CFE4000-memory.dmp

Download