lumma | d56e5881ddfb6adf33a9554fece06ff43aae92ee269019a1d8dac7ed764d97d7

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bsg.exe
Size 1.6MB
Sample260710-m65saaas7m
SHA256 d56e5881ddfb6adf33a9554fece06ff43aae92ee269019a1d8dac7ed764d97d7
MD5 1c89d3e44ac8291fcde8d45c1d1ad361
SHA1 689ff2d179d43aed16d08bb2f8f19a7416ed498b
SHA512 dd06f9d94cb0eaf942f3d0792ebcff071c11cfffbdf576869c77686e02f2fa19104ef248de85db53f88a3f6c84a0ac8c795433ba5b8658a19bedc1d1020d272c
SSDEEP 24576:sj/HX3/ocUIGFCMZCavhSebMQGOoaaa88Edn6wxWWaAvCYM86m62qApqhDXmpW:Ofgc0FCCCUh8QEaaRNVWWtv3M8ymE
TLSH
T1EB75E042F9830053FBE304706B3DC9A4C8299AA3BB285CDB91588594C5F9EDFD67352B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma persistence stealer

Malware Config

Extracted

Family

lumma

https://houshan.shop
https://yunded.com/uwuz
https://sirhirssg.su/xzde
https://prebwle.su/xazd
https://rhussois.su/tatr
https://todoexy.su/xqts
https://acrislegt.su/tazd
https://averiryvx.su/zadr
https://cerasatvf.su/qtpd

Attributes

build_id
58482ce51891922bf0aef7e896596263ce2c09f9fec92dbc85

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1768	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	taskmgr.exe
Token: SeSystemProfilePrivilege	2404	taskmgr.exe
Token: SeCreateGlobalPrivilege	2404	taskmgr.exe
Token: 33	2404	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2404	taskmgr.exe
Token: SeDebugPrivilege	2232	firefox.exe
Token: SeDebugPrivilege	2232	firefox.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe
Token: SeCreatePagefilePrivilege	7052	chrome.exe
Token: SeShutdownPrivilege	7052	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2232	firefox.exe
2232	firefox.exe
2232	firefox.exe
2232	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
2404	taskmgr.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe
7052	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2404	taskmgr.exe
2232	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2232	4780	firefox.exe	94
PID 4780 wrote to memory of 2232	4780	firefox.exe	94
PID 2232 wrote to memory of 3716	2232	firefox.exe	95
PID 2232 wrote to memory of 3716	2232	firefox.exe	95
PID 2232 wrote to memory of 3716	2232	firefox.exe	95
PID 2232 wrote to memory of 2436	2232	firefox.exe	96
PID 2232 wrote to memory of 2436	2232	firefox.exe	96
PID 2232 wrote to memory of 2436	2232	firefox.exe	96
PID 2232 wrote to memory of 2436	2232	firefox.exe	96
PID 2232 wrote to memory of 5172	2232	firefox.exe	97
PID 2232 wrote to memory of 5172	2232	firefox.exe	97
PID 2232 wrote to memory of 5172	2232	firefox.exe	97
PID 2232 wrote to memory of 5172	2232	firefox.exe	97
PID 2232 wrote to memory of 2908	2232	firefox.exe	98
PID 2232 wrote to memory of 2908	2232	firefox.exe	98
PID 2232 wrote to memory of 2908	2232	firefox.exe	98
PID 2232 wrote to memory of 484	2232	firefox.exe	99
PID 2232 wrote to memory of 484	2232	firefox.exe	99
PID 2232 wrote to memory of 484	2232	firefox.exe	99
PID 2232 wrote to memory of 484	2232	firefox.exe	99
PID 2232 wrote to memory of 4800	2232	firefox.exe	100
PID 2232 wrote to memory of 4800	2232	firefox.exe	100
PID 2232 wrote to memory of 4800	2232	firefox.exe	100
PID 2232 wrote to memory of 4800	2232	firefox.exe	100
PID 2232 wrote to memory of 6356	2232	firefox.exe	101
PID 2232 wrote to memory of 6356	2232	firefox.exe	101
PID 2232 wrote to memory of 6356	2232	firefox.exe	101
PID 2232 wrote to memory of 6356	2232	firefox.exe	101
PID 2232 wrote to memory of 6364	2232	firefox.exe	102
PID 2232 wrote to memory of 6364	2232	firefox.exe	102
PID 2232 wrote to memory of 6364	2232	firefox.exe	102
PID 2232 wrote to memory of 6364	2232	firefox.exe	102
PID 2232 wrote to memory of 6484	2232	firefox.exe	103
PID 2232 wrote to memory of 6484	2232	firefox.exe	103
PID 2232 wrote to memory of 6484	2232	firefox.exe	103
PID 2232 wrote to memory of 6484	2232	firefox.exe	103
PID 7052 wrote to memory of 7068	7052	chrome.exe	105
PID 7052 wrote to memory of 1768	7052	chrome.exe	106
PID 7052 wrote to memory of 3004	7052	chrome.exe	107
PID 7052 wrote to memory of 3004	7052	chrome.exe	107
PID 7052 wrote to memory of 3416	7052	chrome.exe	109
PID 7052 wrote to memory of 3416	7052	chrome.exe	109
PID 7052 wrote to memory of 2844	7052	chrome.exe	110
PID 7052 wrote to memory of 2344	7052	chrome.exe	111
PID 7052 wrote to memory of 2844	7052	chrome.exe	110
PID 7052 wrote to memory of 2344	7052	chrome.exe	111
PID 7052 wrote to memory of 1340	7052	chrome.exe	112
PID 7052 wrote to memory of 1340	7052	chrome.exe	112
PID 7052 wrote to memory of 3192	7052	chrome.exe	113
PID 7052 wrote to memory of 3192	7052	chrome.exe	113
PID 7052 wrote to memory of 5540	7052	chrome.exe	114
PID 7052 wrote to memory of 5540	7052	chrome.exe	114
PID 7052 wrote to memory of 5512	7052	chrome.exe	115
PID 7052 wrote to memory of 5512	7052	chrome.exe	115
PID 7052 wrote to memory of 4856	7052	chrome.exe	116
PID 7052 wrote to memory of 4296	7052	chrome.exe	117
PID 7052 wrote to memory of 4296	7052	chrome.exe	117
PID 7052 wrote to memory of 6020	7052	chrome.exe	118
PID 7052 wrote to memory of 6020	7052	chrome.exe	118
PID 7052 wrote to memory of 6464	7052	chrome.exe	122
PID 7052 wrote to memory of 6476	7052	chrome.exe	123
PID 7052 wrote to memory of 6476	7052	chrome.exe	123
PID 7052 wrote to memory of 6576	7052	chrome.exe	124
PID 7052 wrote to memory of 6464	7052	chrome.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bsg.exe
"C:\Users\Admin\AppData\Local\Temp\bsg.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4144

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27098 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {10afa2b9-7957-4d09-9977-9618ac483c9b} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27134 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {e0b9ce2c-9b40-447c-9b1f-3a3845ae6c01} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27274 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {066657b7-654e-4fd1-9e92-1cc9b1370662} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27274 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4012 -initialChannelId {0105b7b7-2140-412d-920a-7ee1c68b6ef1} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1376 -prefsLen 34773 -prefMapHandle 1380 -prefMapSize 270279 -jsInitHandle 2704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3176 -initialChannelId {74c77de7-f695-402a-95f7-55ccd0f2c22e} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3240 -prefsLen 35010 -prefMapHandle 3016 -prefMapSize 270279 -ipcHandle 3116 -initialChannelId {7a2c1c7e-c76a-47aa-bd4f-19d0cde8b2d9} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1628 -prefsLen 32952 -prefMapHandle 3248 -prefMapSize 270279 -jsInitHandle 3264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4628 -initialChannelId {738db3ae-297e-494d-9382-06dfee8c829a} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3048 -prefsLen 32952 -prefMapHandle 3192 -prefMapSize 270279 -jsInitHandle 3408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5560 -initialChannelId {2f20ac7d-308b-4da3-9387-cf451651ab99} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32952 -prefMapHandle 5728 -prefMapSize 270279 -jsInitHandle 5732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5740 -initialChannelId {dde5e056-e21d-483e-bfaf-32656a795ab4} -parentPid 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:7052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe8d86c728,0x7ffe8d86c734,0x7ffe8d86c740
  2⤵
  PID:7068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,461829173509515105,10205656970459341096,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,5123759489162623167,1674042392542028362,262144 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,8906736996867655641,14474996744633016982,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:13
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,16123551223978599485,9363222805969378461,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,870503636760765994,18015272922707270144,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,13979466867767121358,8373516201834228639,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,1330391793620046567,12669587927478337220,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,11261478853282754151,7893941146815653540,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,10100988554128618562,16193403620935944309,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,2680436635043894237,11942944081938851637,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5096,i,5454471049213566073,8418800119504963826,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5100,i,9695084058485069499,10090116215455257542,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5108,i,16295677131765888789,17430227815429095075,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:6464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,1647788816535551653,13776121853366471319,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:6476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5776,i,16498475923262304755,12002642097831004848,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:6576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6252,i,8752965964244187997,14466353937562492335,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5112,i,9621776843865988241,4230195061859745428,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6248,i,13078792081055520108,8909383730597533625,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:6636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,15896292963083039078,17153185561267796887,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5552,i,8659916676559054442,7920314812760895655,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:6940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,6241692387356135996,17642012064409627872,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6472,i,7449293739163627238,6205324172908309414,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4724,i,3566911622831920982,252775304082921778,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6180,i,14539647056479566465,7418777274806812182,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3932,i,4257746554887273372,3794739731508592449,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:6684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6188,i,14201582510933914830,5022400859863983006,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5096,i,14296944884423762978,11523711010319775541,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6052,i,3044161887555354130,15809271887018516444,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6792,i,2435763789545470098,4494034391862948968,2097152 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6508,i,9937005791430357894,13543233842087989670,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6572,i,10137673695014637789,9288411774527600358,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,10467588783253975328,17257306252016151796,524288 --field-trial-handle=2004,i,12518700555307877312,6176948691934233260,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:3492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 680a40c39b44c8b92374efbec4f678b67560bf1da7a7c98c0d7dc82a2f2bf855
MD5 0cffb7eee6c6f82037d98b185eea5ef8
SHA1 d5e60767178b8ed63347c5dbb6cf5ac1ce7ce81a
SHA512 8aa88fdf822cac601f7e2fa4f1c1b162b395c27df4601d52ba9c11cf927a94730c3ff697af65d5756faaef112c2090d2890bc417839841d59720cb9eb4b8203e
SSDEEP 96:Gb/+YBqmiBO0ShE/5RqjML1scglYoAxJt64QgyMVxiFiXkxxoZBaM:Gr+YBqmiBdShETqjMScgmoAxJt6jgyc9
TLSH
T19C81DD46578886D2CB5234F110F49DDFB6B20C730CA3BE4BC0D5A279A5473EC8224BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 55d9bb40af9052ab2cbfbf163a37a10cfd009c85094b40544f0a0a985d173ebe
MD5 35a77d72010db00e8daeae3e26d665ca
SHA1 3ffd92294f732e512c0c66ad663443d7856528d2
SHA512 bbef19fbf36d0c9de535202c040245e3e14b29317520a42954f2e5f430b25c6b18c9b2eb9437bee6811a03c0212552e5d0579f1bf7710650f46632936daa7b35
SSDEEP 384:DPHWvLSX8vJ8vYvG6vnXvSNb7o7RPM9LqliGPR8Ekz5aNCf7S2Iuo1MA/bAeeSMG:YaAV/x8gSIl25ZotEHEL
TLSH
T140925DF786E4992EC91152F5E7183E2FCE2A0918922C3C1FCDD5AF8B93E2471E10194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 508ebfd553a6a474cbf1ca84783757ea293137f54834e48be20657aa43c880d1
MD5 80cdd63ad5a3a72cab31357a869d18a9
SHA1 d1c8abc567316d2a48a99c757e2422fcd2ef18b1
SHA512 d414dd5e8d8cbfd56c7f6230d3316605ef3f091b104da08166e2cd412c22bb4e58020373b615e3e4059f6dd0e5a96d7e746bfb39b62b886e99fe918da2a75cd3
SSDEEP 96:8EUGrifU7n2qUGaWU7WDUGnUGf/UGkHTUGpQUG5UGmAiU7JUGnbUGYAU76UGVUG7:8EUmsUyqUgUSDUAUUUnUaQU2UHbUdUQp
TLSH
T1C2A17B57B7BEF8BB10680D6F1D887C052DB9B83A4681A4F4DB6AD26CE0814F75B07453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c9266f2136b5fd150af813379509fad5e123172d25b0a068ab3680848f93ffd6
MD5 c0c17fc29bb1dfb0591d5eeb35c5b605
SHA1 e1f27c26a76e59fb09b5c457048fed6d00989a9a
SHA512 c0fac45e6304450fe28bb85c3f331cc065518981e22e76cc96c23b0e3b20dae3bc47add1fce150f52bc198553d207b2af299ac84fb398dc4a2061b118a43debd
SSDEEP 192:jRocBzAChyv7hAPRp2G5h98Hsb+WNnvk4742hn7VyIsnAUge:jRomzAKeAXHuwcr219e
TLSH
T14F32A56FB914A9BB6DCBD219F9217793E3F1102165E42E84EBFC8A2C11E79CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 95b9e7fdde21d3fcfa2b7176e1efe3678a97a8c772ccf089fbe09699b8855a4a
MD5 f952dadbc32777fd9db94afbb3818a4f
SHA1 2be047e53c4e02e6de26ef8ad217d61e42f41a4f
SHA512 076c905b28719f77d9f34e6ed53be1871961508739d0088db4c94035147701e811646d3a1ad21ade6117831c3cb9e9dae8bd53231f76c29a3eb08bd20798b2f7
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3aEHG8t2rlg9:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqK
TLSH
T16552E867684D9A7B0FC8C98CDC176F8BACB60157A2784D2456FB5D0803A5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7f24943c11f977f1bfff7d96f2416c555268fa41970fbec99ea1254d4c4b13b7
MD5 782e9d4e6a31ece0f8915e4d83cb2647
SHA1 a3eb82f3898e5bfd39c42b30e5e119e3c3d933c8
SHA512 f4a62845670e7d66b723fa0506a75f620ee228ada636586fdfcb885ef80c55a36a554046cf70f4f892ade49b004fdcc23479fc4320895d00a5e919f2cc039839
TLSH
T18AB01201804A6511CC4051F01B04509D31426E718200361296D096D5DC870E01124141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d71d898ca125575ec1c3a0f620d3dfac565ef02a0f3d66477c322913266054f9
MD5 afd31df9f33488136cd407f79b2a4bb1
SHA1 86985cc0eff6740b3bcbfff4081d56a3fc87ddb8
SHA512 f5cbb2e7901c9d938b3a8210ae22f6decaf321bc75a0de660f7483b29163fa6cd58f18cb57a9488c7f204375c25eea61910c50e4ce74d3fddbfbc8ac566e3e38
TLSH
T10AA0021462C04921CE0973F466A1056B625B4C75595A4BCBA4A1568C899B1C29112110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b1559.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b1559.TMP
Size 48B
SHA256 291a728ba5ca337f6835a6e79f7638daaaa6e0d4080dc08d146f1c2a07b93fc3
MD5 f0d8f7b020422b76effc314bc79eca10
SHA1 8d7c019cb984ad277b39bcbe390bfa3da29a2d81
SHA512 046a544d66c0e4e3be96e345e805426729bca1837dd582ed3fbf981401ea73faf08b17731c44b760a6c6abd5526c045c8ef13ef2942fc8c5fa6374ab7c4aa05c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 8812ad30854851b5e76b2a3e92f0b2a042bcd191fcf0eb61ce829241ae7b1fb7
MD5 39bbfb42b5150ec83c38905c7b80e021
SHA1 15614f01e4f875bcea328b20cb0111d1d2f6c90f
SHA512 5328dd2e04d3fdf60b0bab799b4a70be74caf469e661591e715172f7ee2344c8ac19708789c6aa942e9e69ce243dff9d2ab20f5f3d7d818f13c026ec9104f67b
SSDEEP 3072:tfvqH8C5Q2lDxzGvLkVdD+w97FUMz1joq1gpDB4sCc:hDCdtz6YVFJR+MpjL1gBB5
TLSH
T166C3129BF9880E4B6BB9E25472373D6AED2215F3C583EBB2D6F2950701B7845C322845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 83e6d4aadee7bafc573bab1088ba2b18eb713d59ef49244765c2a7d5af8212f3
MD5 493e486ed872d5252b4002d04d546f17
SHA1 9eef654afc77551b6f044d8d29a6791b4a75fa84
SHA512 5eb4c0de8823e7fbb36c1cd607e736c74ff0ea47ea31e38a117f624b5dec0017e598c4e9277a9dd304afd94a640b3cbf4432d6951c8782e9a022b08cd8ea752e
SSDEEP 96:5KC6jd+oJm4V0FH+pqf+HBKyoytsRDotok53HDjB6eGyvkonHob1v4a:MCIHJm5FHuPgXDUDz9W8nHobZ
TLSH
T1AAA13AB178B94CB719B7C248F9923E83DEA4A22765A0EF84DADD1F0C11F30D81302627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 c282b3dc7b4a77be039df0fc57ac242aa7a562ae11aff4612a2a9462a3b629a1
MD5 991f13ee908b3c0cb698b864163ec31f
SHA1 d701cdeb1d3cf551e7ee13248f47f95a19612386
SHA512 1b871ba6a7771a7958372bcc082289dc7eced4962fc25bd0a921aff5dc1aff23a69ac5733ed5e8b96239442a012cc5d4cd570bb2822870e4a982a1de5ff62b1a
SSDEEP 3072:TfvqH8C5Q2lDxzGvLkVdD+w97FUMz1joq1gpDB4sCc:zDCdtz6YVFJR+MpjL1gBB5
TLSH
T1CAC3129BF9880E4B6FB9E25472373D66ED2215F3C583EBB2D6F2950701B7845C322845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7052_661805439\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 246fd5c3ac8cc8c2703b5548d59594925c97e4bf6efc13e5599304d3db0853e6
MD5 88c923334deea9bcb966fd8fd675ed43
SHA1 3efd17fb80499bf563979fcb987bc5a39a3d3061
SHA512 5443cf8f5c21ad96e7babf9f20df1e3134bcece635b8eb8ca996ea5c5ad71abe44e866062f85f2712f101be2d52417c7f467bbc03e4e80621bedbfc402a7ab02
SSDEEP 192:+u1d66JoztdzgCl6mc0djOv5zbo2Z4hyjyMN:Hd66Joz/zgC1j2bo2Z4hyjF
TLSH
T15AE11EA8FA29867FC408027BCDA11B410F75385ADC4E3F19719D25082D5B2DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 09c70094148a56dfa59adb4a8e3193ac18eedebae02de6e84ee8aecd3326d78e
MD5 71040cf29f58348542a1801733af1a09
SHA1 a548f2631ec98751bad6691345d8a3954ef0bb7a
SHA512 e38ef1e37dc24843e9c54ce3e0f3b19462e2f31e0a72fb7f59208b6c8143313424ca3accc152ce5c769448f240b457b7d6caeedb32f094f08b104169c8dc7577
TLSH
T156219E5C7AF84D6AD887EB5C7440068E93548EC708871C834D46EE8DCE91ADD336E43C
MD5 SHA1 SHA512 TLSH

Submit Download

174547ec-3238-4cc6-94fc-751092df74b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\174547ec-3238-4cc6-94fc-751092df74b0
Size 883B
SHA256 b4ac244089d6026a541d4f197075dd5ebe65e0af55c5398d5aacb849a15153f0
MD5 7196ec9e64f212fc4370554822442ccd
SHA1 2166ee0d13e4bea896bfef8e4976f3af40277299
SHA512 e7915ba4f76268de790a99c76fb5f60858be86db19eb134d9ba617cc8e41b957f0200fe6bbd079a4224c98972c65288f2c853771501c6bb92693240362e92b91
TLSH
T100110090E531B6B3CC78924BC5A1370297E4B433C0C645143D945E140EAE51BABAA24B
MD5 SHA1 SHA512 TLSH

Submit Download

349630ed-d772-40ef-b50e-fc0357d1bae9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\349630ed-d772-40ef-b50e-fc0357d1bae9
Size 15KB
SHA256 33d9baa1a1300078ef8b24542c82767e2cd4c4e18949b7f98a1aa47b6e6cd526
MD5 465a6fd1bb88de7dd0ec02649a73660d
SHA1 437332798541607f350405be2f5ac5305fb539e6
SHA512 d2b58ac2128af18b55a245e1d5852cae361b37f63335fd37c27d496fe14a1271d34d12340da0f0dd01caa321d27383be463afe79eea74130a97e4a22e88cf249
SSDEEP 192:Awa1CRGoBXFmZqL4Qo+skmm+GruuQpGiMDdXxQZybY3SszxKkWR73PJER1JmhW3s:So31AYdSyRslKkWR73P00tzV
TLSH
T17F62E9556430497E8691E368D8E87FC3E2F518CF8C019FC99BE47E0869EE0AE5127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72bdecf3-fa34-467a-9e90-8a8a8862fa29

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\72bdecf3-fa34-467a-9e90-8a8a8862fa29
Size 235B
SHA256 92e6d0b5134ee52c7bce2dfc13e064047a79f1cd025c44476f105435f86147cf
MD5 f326cdcb1ee1f52f66d0720e9b0241e7
SHA1 f110a642df4120535ac78c60a223533fff01fa4f
SHA512 d10335d4eab17cb8eeb4271f0b6b1df96be4ba50cf18c48d2f414fcf3d86f5e7008fe00ea6b23115691a7801f223136e0c4e84f8074ba8a302dc5d1798c44f28
TLSH
T136D097C45888B79D0C040F02B0A03EC230484C3364A8A81499D106BC9DFAEC89262917
MD5 SHA1 SHA512 TLSH

Submit Download

78c7195f-c686-45d8-a384-4fc5a55fce98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\78c7195f-c686-45d8-a384-4fc5a55fce98
Size 886B
SHA256 bbc7da44e6217cad4f2b496bf97492319a8a07bc81903d66e12d7082be533441
MD5 ce1c8c398261568a85ee30b8d3db0950
SHA1 1b0f331b848085ea46efebceca4b859078489265
SHA512 2364d040fa4da1d653ad43c579b58bc62379a3cd24eb22909b5f49ecc106a970ca32fbbf443c5a54d6ee6125b230c1aae801483169efc5c507c998a77723b126
TLSH
T1411100A0CA35B6F3CC7C9257D5E0774286E0B423C0C64A183D945F180EBA51BA77B60B
MD5 SHA1 SHA512 TLSH

Submit Download

f8015501-c500-4a02-8325-e36c4a0810f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\f8015501-c500-4a02-8325-e36c4a0810f7
Size 235B
SHA256 69f6682076c32b303c29b3dedf3bb4c5ee222bb157e8d421df64e68ddca1cbf1
MD5 37bd9ce748323bea7c548ffda31cc8c2
SHA1 0dc89b5861db37a58476d7c55a9ccfb22724f516
SHA512 0ba7c71c4eed0edfdda5c8b098ee4ab23ed2e9c5c80c6694024e3c27d7e224cac8180e26fb616181ebec2d90c992d5d3e28a16fbad8c56f94b1c5394ebaf8d2e
TLSH
T1E1D097C0188CA72C4C000F0BB5A0A9DB31888C372578982096A04574AAF8EC64253807
MD5 SHA1 SHA512 TLSH

Submit Download

f8bd4a38-ff1c-4acd-9b11-d084086c2294

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\f8bd4a38-ff1c-4acd-9b11-d084086c2294
Size 2KB
SHA256 3326d7f6c68a3e78ceb3ba2b7c870d1647c108643be1bd3085a3476d194ef127
MD5 35f73bfba9527b454af037df1e966d4e
SHA1 ecba4d117a7cf32cd7c5f652ac52c92ec8068dd6
SHA512 a4c1d3dfef9cd72f9a727aa8884551b4486c06aba685674c77c0c8b21df216083991ce146ce97a9a04d811cb07b5c0ac5f7a68d3d1e0dc5f4a6f5dc6e9762055
TLSH
T1A841636C74384E77DCDAE25D9182338E93B09A0340C21C532D46EF0C8E9269E73BB41B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 8aee19fd77604531484f85d8e69668e2b4b4a164b4b5aa99a26c9739a141cefa
MD5 c3b77a3d123e80636f8b5c34e7a6cdad
SHA1 eb982ecf97af085228e0cbaa1f6774016af7391d
SHA512 957a98df1b0a63822db2d3d997a46c41467283c379647d1e23dbe4bf79d68bf2466bc06991a79f4f95972f5893a0eb505d921e75e469e1c2003951a9f56633d8
SSDEEP 96:xH+UTUQqGqsfiV1fObzSMSSSlvdv9jcnAHdA0ScSqBw8Ou8L4cnEVjR:ArRsfiV1fOSSSTdA0ScDBw8Oe7
TLSH
T1B2E11F789508CB7F64B6777CAC6888716AB2413BBBBF68C650A554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 3f27e7e81202a3a8c12d0abbf35ccdd69dd45d7edd20756a24d657a372e44d95
MD5 78fb23cc1624b3de714f2c82d17a222d
SHA1 538151e14e12ac32bdb58023c32e514ab0c05db0
SHA512 9db6fe8a12e81948d2ea9b92f03a602c855764260b49c044900666fdf54287b1a9f5e62155a3a68693b573ac5e55a54ecd27406330dcb2a061857de44f717aa2
SSDEEP 96:xH+UTUQqGqsfiV/z1zS9wKSSlvdv9jUmnAHdA0ScSqBw8828L4cnEVgR:ArRsfiV/zcwKSSqjdA0ScDBw88W+
TLSH
T16DE13F789008CB7FB4B677ACAC6888716AB2413B7BBF68D650B554C4015CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 a12bd7e0b3e7e0381dff87dbb6ec67b5cf461d8fb6336767e85e41b7f56f0212
MD5 a70c8a1545659fdc5f57dcc6ccc8cc88
SHA1 b421e83ca914637517637c273b818bc026d7b056
SHA512 12a6a7ba1f4c872e011c9aa308376b2ce764a3ef5a40d498cfd875961b3d914dd9748a8c585bd88e45e8ab6562213e8a6dc8e3757fc86f9aab70f158e57214fe
SSDEEP 96:xH+UTUQqGqsfiV1f1zSMSSSlvdv9jcnAHdA0ScSqBw88u8L4cnEVgR:ArRsfiV1fBSSSTdA0ScDBw88e+
TLSH
T1C1E120789508CB7F64B6777CAC6888716AB2413BBBBF68C650B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2404-32-0x0000013921FD0000-0x000001392219A000-memory.dmp

Download

memory/2404-16-0x000001391F950000-0x000001391F951000-memory.dmp

Download

memory/2404-35-0x0000013921FD0000-0x000001392219A000-memory.dmp

Download

memory/2404-33-0x0000013921FD0000-0x000001392219A000-memory.dmp

Download

memory/2404-6-0x000001391F950000-0x000001391F951000-memory.dmp

Download

memory/2404-31-0x0000013921FD0000-0x000001392219A000-memory.dmp

Download

memory/2404-12-0x000001391F950000-0x000001391F951000-memory.dmp

Download

memory/2404-13-0x000001391F950000-0x000001391F951000-memory.dmp

Download

memory/2404-14-0x000001391F950000-0x000001391F951000-memory.dmp

Download

memory/2404-15-0x000001391F950000-0x000001391F951000-memory.dmp

Download

memory/2404-8-0x000001391F950000-0x000001391F951000-memory.dmp

Download

memory/2404-17-0x000001391F950000-0x000001391F951000-memory.dmp

Download

memory/4144-0-0x0000000002970000-0x00000000029D4000-memory.dmp

Download

memory/4144-1342-0x0000000002970000-0x00000000029D4000-memory.dmp

Download

memory/5384-928-0x000001EA5F010000-0x000001EA5F135000-memory.dmp

Download