hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
900s
max time network
900s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260714-vyvaksct21

Score

8^/10

discovery persistence pyinstaller ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
276	4120	chrome.exe

Executes dropped EXE 8 IoCs

pid	Process
1136	RansomWare.exe
2808	RansomWare.exe
1140	RansomWare.exe
4452	RansomWare.exe
6988	RansomWare.exe
7128	RansomWare.exe
3112	RansomWare.exe
7064	RansomWare.exe

Loads dropped DLL 52 IoCs

pid	Process
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
2808	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
4452	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7128	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe
7064	RansomWare.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	camo.githubusercontent.com
28	raw.githubusercontent.com
131	raw.githubusercontent.com
148	raw.githubusercontent.com
179	raw.githubusercontent.com

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	214	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a1b23e98be136054	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000d00000001c813-2678.dat	pyinstaller

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4120	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Checks processor information in registry 2 TTPs 49 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285234793423433"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{A6619032-B1F5-4867-AFCB-4D27102578DD}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ꈐ󥸀耀\ = "DS_Store_auto_file"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.DS_Store	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\DS_Store_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\DS_Store_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
1216	NOTEPAD.EXE
6620	NOTEPAD.EXE
5516	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2192	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
3720	chrome.exe
3720	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4748	firefox.exe
4748	firefox.exe
4748	firefox.exe
4748	firefox.exe
4748	firefox.exe
4748	firefox.exe
4748	firefox.exe
4748	firefox.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4744	OpenWith.exe
5064	OpenWith.exe
1404	OpenWith.exe
4748	firefox.exe
4748	firefox.exe
4748	firefox.exe
4748	firefox.exe
1300	OpenWith.exe
2192	EXCEL.EXE
2192	EXCEL.EXE
2192	EXCEL.EXE
2192	EXCEL.EXE
2192	EXCEL.EXE
2192	EXCEL.EXE
2192	EXCEL.EXE
2192	EXCEL.EXE
2192	EXCEL.EXE
2512	OpenWith.exe
5020	firefox.exe
8016	chrome.exe
2156	chrome.exe
7928	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3312	4892	chrome.exe	88
PID 4892 wrote to memory of 5656	4892	chrome.exe	89
PID 4892 wrote to memory of 4120	4892	chrome.exe	90
PID 4892 wrote to memory of 5656	4892	chrome.exe	89
PID 4892 wrote to memory of 3208	4892	chrome.exe	91
PID 4892 wrote to memory of 3208	4892	chrome.exe	91
PID 4892 wrote to memory of 2668	4892	chrome.exe	93
PID 4892 wrote to memory of 5780	4892	chrome.exe	94
PID 4892 wrote to memory of 2668	4892	chrome.exe	93
PID 4892 wrote to memory of 5780	4892	chrome.exe	94
PID 4892 wrote to memory of 2312	4892	chrome.exe	95
PID 4892 wrote to memory of 2312	4892	chrome.exe	95
PID 4892 wrote to memory of 4984	4892	chrome.exe	96
PID 4892 wrote to memory of 3744	4892	chrome.exe	97
PID 4892 wrote to memory of 3744	4892	chrome.exe	97
PID 4892 wrote to memory of 5972	4892	chrome.exe	98
PID 4892 wrote to memory of 5972	4892	chrome.exe	98
PID 4892 wrote to memory of 5448	4892	chrome.exe	100
PID 4892 wrote to memory of 5448	4892	chrome.exe	100
PID 4892 wrote to memory of 2160	4892	chrome.exe	102
PID 4892 wrote to memory of 2160	4892	chrome.exe	102
PID 4892 wrote to memory of 4544	4892	chrome.exe	103
PID 4892 wrote to memory of 4544	4892	chrome.exe	103
PID 4892 wrote to memory of 2444	4892	chrome.exe	104
PID 4892 wrote to memory of 2444	4892	chrome.exe	104
PID 4892 wrote to memory of 1300	4892	chrome.exe	105
PID 4892 wrote to memory of 1300	4892	chrome.exe	105
PID 4892 wrote to memory of 5124	4892	chrome.exe	106
PID 4892 wrote to memory of 5124	4892	chrome.exe	106
PID 4892 wrote to memory of 6008	4892	chrome.exe	107
PID 4892 wrote to memory of 6008	4892	chrome.exe	107
PID 4892 wrote to memory of 5940	4892	chrome.exe	108
PID 4892 wrote to memory of 5940	4892	chrome.exe	108
PID 4892 wrote to memory of 3944	4892	chrome.exe	109
PID 4892 wrote to memory of 3944	4892	chrome.exe	109
PID 4892 wrote to memory of 4176	4892	chrome.exe	110
PID 4892 wrote to memory of 4176	4892	chrome.exe	110
PID 4892 wrote to memory of 4552	4892	chrome.exe	111
PID 4892 wrote to memory of 4552	4892	chrome.exe	111
PID 4892 wrote to memory of 4488	4892	chrome.exe	112
PID 4892 wrote to memory of 4488	4892	chrome.exe	112
PID 4892 wrote to memory of 584	4892	chrome.exe	113
PID 4892 wrote to memory of 584	4892	chrome.exe	113
PID 4892 wrote to memory of 3060	4892	chrome.exe	114
PID 4892 wrote to memory of 3060	4892	chrome.exe	114
PID 4892 wrote to memory of 1692	4892	chrome.exe	115
PID 4892 wrote to memory of 1692	4892	chrome.exe	115
PID 4892 wrote to memory of 4156	4892	chrome.exe	116
PID 4892 wrote to memory of 4156	4892	chrome.exe	116
PID 4892 wrote to memory of 4552	4892	chrome.exe	117
PID 4892 wrote to memory of 4552	4892	chrome.exe	117
PID 4892 wrote to memory of 2084	4892	chrome.exe	118
PID 4892 wrote to memory of 2084	4892	chrome.exe	118
PID 4892 wrote to memory of 5108	4892	chrome.exe	119
PID 4892 wrote to memory of 5108	4892	chrome.exe	119
PID 4892 wrote to memory of 820	4892	chrome.exe	120
PID 4892 wrote to memory of 820	4892	chrome.exe	120
PID 4892 wrote to memory of 4836	4892	chrome.exe	121
PID 4892 wrote to memory of 4836	4892	chrome.exe	121
PID 4892 wrote to memory of 5060	4892	chrome.exe	123
PID 4892 wrote to memory of 4804	4892	chrome.exe	124
PID 4892 wrote to memory of 4800	4892	chrome.exe	125
PID 4892 wrote to memory of 2644	4892	chrome.exe	126
PID 4892 wrote to memory of 5940	4892	chrome.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff83193c728,0x7ff83193c734,0x7ff83193c740
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,3878133618652998640,5610577497350475925,262144 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,16485919906115195355,8500178043103007640,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,16872695809355199904,4838360549535638305,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,16397421648691651861,10989094760917649739,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,3167136313227410728,7224628655815009781,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,18299211575565677163,5279134055860478997,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,7064535711437901054,4640337450605431171,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5344,i,3963205866865708412,15832949776104880667,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5384,i,6231729030492562379,8929589928244378970,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5928,i,11542006726514195831,6155874257008729161,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5628,i,9131077030857832941,271268722920549184,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5400,i,12795627043094724166,9658880473169423125,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6332,i,11966523550872168,6476214994723959905,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6088,i,15022639218378199127,1099854740763601201,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6616,i,1940685018211460714,5579849793366364134,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6588,i,4418226254766681488,11547673057644736129,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4704,i,4359128771961908248,14862466606383314811,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5284,i,2007756014831462628,7790544071322390949,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6984,i,15986568588341602828,6752999058468573445,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7124,i,1033573429962968307,12507997192109069189,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7296,i,13715044824728175204,638497796747931958,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6292,i,11125057877309455468,12660766978349587626,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6508,i,17316771139596826067,15200073904451698922,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6212,i,1615505895026090600,9755404782258889157,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6368,i,6976272220876979341,5680451849937454342,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6992,i,17089324395341569749,7361412846938776127,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,1903423430402680793,7824170494374106291,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:12
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5784,i,7041865942189855167,3383919803489481660,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7292,i,16828655649681012632,18041653127517684297,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5228,i,14634081734631618101,17894957150485800231,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7312,i,8900924370842926533,13929164654782329776,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6900,i,1499191035533848182,11304119182302392680,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6896,i,12640430678179567642,2501756825203377773,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,5890267371549847076,8038562881193041581,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5392,i,8979680712283529800,14201160079926322943,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7068,i,3661694635554698445,15142913812094827716,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,10487328638285273116,4454293316916747054,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7328,i,8919628597669192442,6041009826101192434,262144 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=1008 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,4823721378027717333,3296188382644274287,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7540,i,10509047173492041778,14886149905446845301,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:14
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=1008,i,9953041759343049245,10269503834880383750,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6684,i,10773026186925715855,6465846008205985456,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:6396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7776,i,10123305230635022256,1631839455759041190,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:6816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7612,i,14248844828587508668,11912985828372941859,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8076,i,259149517930298269,4708686607912766470,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7836,i,14441183649698010993,17392787735554441993,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7604,i,1043244178993397777,16805817159728917625,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:6208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8040,i,12665097931154198648,8250770869756727486,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8124,i,2560918828869818669,12410153459912213609,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=8604 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7628,i,4442568484582230070,7726886206371081536,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
  2⤵
  PID:6596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7492,i,14235749691766294774,9766294097580659747,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:14
  2⤵
  PID:5372
- C:\Users\Admin\Downloads\RansomWare.exe
  "C:\Users\Admin\Downloads\RansomWare.exe"
  2⤵
  - Executes dropped EXE
  PID:1136
- - C:\Users\Admin\Downloads\RansomWare.exe
    "C:\Users\Admin\Downloads\RansomWare.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=8648,i,11195225049595033072,12391975701343591264,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8072,i,5773915269974142038,6037650227158527335,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=8932,i,10296000233061874893,13450782189730730376,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7840,i,17222493466783984428,14011295658882100575,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:14
  2⤵
  PID:6796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=8960,i,614965221073050074,2943208150598504196,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
  2⤵
  PID:7760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7616,i,2520974748402447175,396838451439428800,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:14
  2⤵
  PID:7580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=9104,i,14160570307910671906,1351063182151447016,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=9248 /prefetch:1
  2⤵
  PID:7512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7636,i,17448998076284203231,3603365148943658152,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=9380 /prefetch:14
  2⤵
  PID:7620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=9412,i,1859198484177643719,11932535663822091997,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:1
  2⤵
  PID:8004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=9376,i,3904651856489547366,14068449095765193784,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8936,i,4309897457392931288,15276623923731109161,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
  2⤵
  PID:7360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8612,i,17399705611809195489,16278161026897092945,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=9440,i,13718338104983803324,16714138425856011735,2097152 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=9428 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=9108,i,948704774859457515,9014547031304149876,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:8016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=9564,i,6915976441747617701,18037760381411821895,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=9228,i,8811751626710356234,14841498547922263320,524288 --field-trial-handle=1908,i,6823596884733176322,15608409552092338475,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:7928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4744
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5064

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw"
  2⤵
  PID:1096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {cd98d2f5-0284-4a22-aca0-a8ce44f26173} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1760
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {05fe52a0-7814-4c0f-b026-4e0613b99703} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:5888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27274 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {829b86f1-c58b-4afb-afc8-60a393e93647} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27274 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {bd511cc4-b2dc-487c-948d-e5c16f6ff583} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4400 -prefsLen 34773 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 4392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {c5855c20-5174-49a7-9435-7b2121044a0a} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3296 -prefsLen 35010 -prefMapHandle 4420 -prefMapSize 270279 -ipcHandle 4616 -initialChannelId {41ea1205-58cf-4a2a-9582-3d1d0a4b9b2b} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {5263ba86-f1d9-4574-87ba-64ead92b9126} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {222944c5-ceb7-41ed-8d9e-ba8f83bba18c} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5980 -prefsLen 32952 -prefMapHandle 5984 -prefMapSize 270279 -jsInitHandle 5988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5996 -initialChannelId {890b938c-be46-45a9-b74e-c187b13ba2a7} -parentPid 4748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2516

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:6620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1300
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Ransomware.TeslaCrypt\E906FA3D51E86A61741B3499145A114E9BFB7C56
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  PID:5516

C:\Users\Admin\Downloads\RansomWare.exe
"C:\Users\Admin\Downloads\RansomWare.exe"
1⤵
- Executes dropped EXE
PID:1140
- C:\Users\Admin\Downloads\RansomWare.exe
  "C:\Users\Admin\Downloads\RansomWare.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3136

C:\Users\Admin\Downloads\RansomWare.exe
"C:\Users\Admin\Downloads\RansomWare.exe"
1⤵
- Executes dropped EXE
PID:6988
- C:\Users\Admin\Downloads\RansomWare.exe
  "C:\Users\Admin\Downloads\RansomWare.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6096

C:\Users\Admin\Downloads\RansomWare.exe
"C:\Users\Admin\Downloads\RansomWare.exe"
1⤵
- Executes dropped EXE
PID:3112
- C:\Users\Admin\Downloads\RansomWare.exe
  "C:\Users\Admin\Downloads\RansomWare.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6176

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\ResumeUninstall.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2512
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\Catapillar.E\.DS_Store"
  2⤵
  PID:7084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\Catapillar.E\.DS_Store
    3⤵
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:5020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27057 -prefMapHandle 2032 -prefMapSize 270315 -ipcHandle 2108 -initialChannelId {10ede39b-d38a-43eb-b5d0-1a22fffb27a6} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:6940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2332 -prefsLen 27057 -prefMapHandle 2336 -prefMapSize 270315 -ipcHandle 2372 -initialChannelId {dc0e970e-383f-41b2-89f9-9c7f320da400} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:3956
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 27616 -prefMapHandle 3824 -prefMapSize 270315 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {48e7390d-fd97-41b2-abd1-b107f7511053} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27616 -prefMapHandle 4012 -prefMapSize 270315 -ipcHandle 4020 -initialChannelId {bb1708ab-2f51-489b-b512-8c608becc690} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4752 -prefsLen 35221 -prefMapHandle 4756 -prefMapSize 270315 -jsInitHandle 4760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4768 -initialChannelId {9d2a36e3-a00e-4faa-b857-aba23943ec8d} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:6764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5336 -prefsLen 35275 -prefMapHandle 5340 -prefMapSize 270315 -ipcHandle 2588 -initialChannelId {026eb8a3-82db-40f1-8c01-0d361495adc0} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:7720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4672 -prefsLen 33200 -prefMapHandle 5780 -prefMapSize 270315 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1244 -initialChannelId {9dadabfb-0c11-4811-a485-a5bd2faa5b21} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2396 -prefsLen 33200 -prefMapHandle 4960 -prefMapSize 270315 -jsInitHandle 4964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {2df52e22-4a5b-4036-8499-08c5cdf4043f} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6104 -prefsLen 33200 -prefMapHandle 6108 -prefMapSize 270315 -jsInitHandle 6112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6120 -initialChannelId {bf7053dd-8bb4-4c06-97f4-9acc1fd66a5a} -parentPid 5020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5028

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 82KB
SHA256 7a6f21721cf7a54d8c517ee4b13105dd9cebefd69c73df6b5b0bcbe6cd17f493
MD5 8148326fce587535de762f006257955a
SHA1 8ff00d217f6d5ab1d78ff1028ccb099a0863275f
SHA512 9ce3f942d4f916b7d98618d345f389dad1cea9aafb65e31e3c9fa1730c3b50d84ed815fce9405b2ffec468e4ce361129ad6ad80c97398520a6c8db3b0fb8b30d
SSDEEP 1536:TP1iF3C+CyRfnF9Hsa5YtplkbEEoIbw8i/6E09P/QOz+DWWpro05F5aUXADA3P:z1CbCyt7K3kbEhF8iCTP/QsrWpHT5aWH
TLSH
T1308312F21CF1AE1573943CC9AD09213508D7EDE54CCE6AC0FE19693C21B29B73A1E628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
Size 514KB
SHA256 08fe559817964123a66906f0747d2e0364f0cafdbf87e1e3af9a44dfea1fddcb
MD5 f6912a8183c98b36df648abf1ed71df7
SHA1 af1efa7fac6e5a522996b0aeb121988bde8aa93b
SHA512 005c95687634a8f34d1761e603f741ee71414c0c5af76e05e0268d66918729bfefae29c8df4d0d0af7ae2da57da4c473ec49312ce877166f8c89ffc5ed538e3a
SSDEEP 12288:SBlC7Gro5BZXZ6aEiCNWnwtoFmOl8blYO8Oq:SBYTBdZzVqOlO2O0
TLSH
T161B42321DC9B26527092C4C00BEDBDB971BE95532A60940C5B393F9ECA38FB41B27677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d
Size 60KB
SHA256 d1fe727b00c05e1f155104527043d39af0049809a520fdd20daa5cca0af08708
MD5 678e37401ccda8d40d2886c8c71eac41
SHA1 3690c094af87f251562d9a49883604a5da9d088f
SHA512 761b2147f6e0c846ccd2577eb0bcb1d0b060643443f8a8ceef11c8a721d3a25cfa15e379bae4ac4dd689c667c180135dc8d3e5c8aeb8f1d1b8c66357a0c44bb3
SSDEEP 1536:KY86QaAnZ5feos7cgFwHNJrNBKzAxvDpkU7ZTrGzZnzXjy:d8uAneoshUrN8Y7GDG
TLSH
T1EB5302FB3CD54AC6DA241F2DDB9AAE4E3970CF4F469D5A102BA50BBC1408F932179D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003e
Size 70KB
SHA256 3279ca4f122ecf2cce261b69b35408748ad79b3639065754d8c213912ce22915
MD5 e0bc606fd0164b7adaec88dbdb0f9d24
SHA1 190a83c89693ac877e115f0bbc1a7df31f06d018
SHA512 0dacc68440233ffa8429d194e61db8e89d6e346c6c9f69689a06b5cd142ab15a173c0298a7baa4702055cb7b92f0965a3662ec483ee30ea8f74ce836fc3d193f
SSDEEP 1536:bCVGgN9LHjwl7QmjYoSH3lvKB7XAxXRj+93TKGPmWxU:bvgNpHENjYowlvmQxXN+93eYmqU
TLSH
T18863023D710D08EAC1055109E65366953B1E03965BBBAFE43DCAAEFBF47210F6722960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000041
Size 16KB
SHA256 a7375e08690ac281cd9f1e42b4bc40389279f838ac76fe7927c524b1223d9f31
MD5 512ba3307adb1d6392a9713986fd15b2
SHA1 9f0f8ace5619ec5263929da8428a0a0a368ea46e
SHA512 bb6e726ca893a9750e817fb73219b8e4f6568c49fb3c2c11fd6218b09550df9f80998236294d74f14331826789199ce56afb654e54779bd3c05dd3239a9ff189
SSDEEP 384:MsyFvPjHURlHaCYEAM7GIX0ZhhE6qONjeaRXnPMe09eBmjMq:MZyYZo0Z8DONjem4yyMq
TLSH
T13572CF940325966C860B0AA0B00B3BA5D42FB64F28C16D968F31FE8F719DF4E6D37152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042
Size 21KB
SHA256 57dc51cc1b4111313ce8ef6a40b1b6a2a55dcf50f7eff016398deff3b9bf9881
MD5 ce2e78f9a1b35756e2b64bc50a9986cb
SHA1 6a7b67f6184e3610a77164c64ed4dc6b26da62a8
SHA512 3270dede176a25d4af2e8a3252d9fad50d34e149ba0bb8051d73a3e3da2ce3c2f9ba999eeed4ca8b70604faac63512cb5185b007dfafa085559963883ea6b99a
SSDEEP 384:syN7g7a+wI3OOBvSMK3MV7Qy6odTKlyi0kAXJbYyjuLewZSP7:syN7g7a+/5SMom7F6XynXNYySLe3
TLSH
T10CA2F1E6AE3C4D1B192E5905982D28A1B364D47CD05FCAC1CF351D23363D9B13AEC687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043
Size 42KB
SHA256 ff596da46e2dc47d424ff67abb32e376c96a9ca06ed4f3cfc9f55d8642227948
MD5 025a167c4f54565eeca8eecd8c627b6c
SHA1 d4cee4c54d6e48f7d4c86b291e84714695d643cb
SHA512 fa0c408b1645577edb32e49602fc3cd15a4205e776d13c3a0fe5e5b34372cb4afe3b7225ab9f9a49ebd5611f5b84e7cec6d4462a46eb078994bd436d4b86d29b
SSDEEP 768:sIbaX9585Yf8/wLd39Gup8jU4n47Zi0vSdXY1p6XQsSBqKIAM9KBPppp19D1zONH:sI+RYIMKUY1p6XTSlIAdBhp7zONDT
TLSH
T1011302DF67451EC5D9D83D6A38CF3405A50ABDD8EA318CAB2F1831697B01DD8CA91327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044
Size 22KB
SHA256 9953ace96670bcb1e411b94a1ab3c0e9de0451f6d4487b18f98ff907a7f8f02b
MD5 94c732dcd613df7b7d5cc2db8a56e062
SHA1 6593a001ce77b3ae571ab866b5bb88175b0b597b
SHA512 aca8cf3a3a634893b1a7430c77b4604d8a43e08ab608a3c3102667165d51bd5b89dfabc3dd60241a6de6b71f9bcbab6de6e97fbb8a82d3e22229662dd600dfa6
SSDEEP 384:yvv5/ZpQe2mu9xeCZ+RPZ/v9iLxW85nZ/jZ3OzA6euwRGY/ROHowZRfqeezE:cFv2mu9EZn9WW8Z/F3ouuw9/RiPtlezE
TLSH
T1A4A2E19F2A49AE58E06A31A708D899DF0777C27F1544917781FED4D4F722E39C02439A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045
Size 33KB
SHA256 2f83b78b9525d7a0c503b39f1ffc47adcf0d024a45b5954d2e08a0ece7887c17
MD5 809608b60232eca18003950380fbb409
SHA1 fd420fe61e3ba59d84b873dffbbca7dce06dd7aa
SHA512 4cfec34305f662fce69e434fcdcf671d522067a1570334da6087c3286cbab920b7d8fd34cb719e54d21edd74ca84095e667ee13c6f2f5832c11663c83c6ee8cf
SSDEEP 768:iGET4zMufXivITvgbpECOFH9IicasPO7oYD3wBxm4l3uivNI4vc28x1:ET4zivYgt8HZc9WELrNz5c28x1
TLSH
T133F2E0915A7743B435F83F04794FD3AB062B92845B508A90BCD0A63F06B5A4BCB03DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046
Size 39KB
SHA256 2b1791d9391023aa9dc93b416d5c953e3280430d78ca9f600e01f54e41fa34cf
MD5 5dd17290c489f2ba6dc982ff9e655884
SHA1 687399b05bc7fb6acdda7aecfe09b7387004b380
SHA512 16cbb9c83202061e3c51a93fa1195ebd3a9b5c7938ffe72283ed832d56233badb3d521ef9814538a7041e0be53413ad5bf48868dc34a53c755edb61ae126a876
SSDEEP 768:VDzQZ+/uCvwQjJBoaczta29S2E1A/wdlTbYdoyOUw35oEkxE:VDzV2XrtaOS7A/KZOoyODKEkxE
TLSH
T14703F126718F356736902E90B476FF0BE0EF54E492BA9EFB14360FB47F26C641982416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
Size 20KB
SHA256 18c1a9429559116a0c1f3abae83b2b474e4628d5231ee4349f541e267bccb66a
MD5 b7b7510fe2f267e9a9e7f8021ee6a431
SHA1 e6353be8be9d1fa7e89b6e031019211a7be5da1b
SHA512 1c4dd14fd0be6785d4d9b1778461986f872acb39c88f98680955547f42cc0ed7e1cb4404e1fc85509685192cfc709df34cb3887515a3bc6da49a9e1f62f92ae9
SSDEEP 384:XLVGw282yBJvDFcAJhVFwkMNfuqkaHC/aCmeRpb1/I08XftJFvStS45Ut:xa8fJvDFcA+1NNkaHCxhx/I08XFJFX4a
TLSH
T19B92E13E5BDB44E1C37ADE85FD19214A6ED155C0CE4357845AB409E273C0450A7AE9FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048
Size 24KB
SHA256 536b38c7954fbee5fc8e8a9744f8985690ace89984fc3a50f9ce665e5fecd40a
MD5 d5c0e42edc169612b47dc996cea78899
SHA1 ba2344a7d4a69ced61dc6a54e4f390bc18995c43
SHA512 4245ef8dd32b9ee6459bfcd4ff1b753517e080237d6323d31ea839b04ff3cf183374724c89e291d02f24df1a94c3b84c19e8f2cc626a1ffd39e517bb8651fadf
SSDEEP 768:aRvdnBR5i2RbHYrIE49k7C7EpiQ+ycFVUHX:aVdnLtHYU9k7C7EpPeU3
TLSH
T14DB2E16621DD5F2C2D3612EB05A531BAD1D573EC54F90978826D662374FFE0C043A8B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049
Size 18KB
SHA256 23367fbace1a7952f2a23da3bbb82dcd24e7f48b766b6a59a92e69e401e044b5
MD5 79d843385035538c1eea44198ed6e08d
SHA1 87f2a72cafb7f60df220ab2b08625ef6a67e083b
SHA512 074ab852bb2c0cfa1d65688a2b3f2e5d8ba2d24fedae15ed5f27b7aab1c4e203d032d1ac42292699291095b0eda1504eb8485c304c5a08c68b52102e81b87e3c
SSDEEP 192:awmoDequNmsAUIYHhZzJOC1jivavS5lkIVP404SaR6UGwPSC0R8MSD4Prc1M3aYm:gtmdEYv53k6PLa21R7i2c1MKm2XoJwh1
TLSH
T14782D1D78BA999A0EB7BB0F0C2E909B34ACD0EC0D9FC65607013EA4F91A054A8617DC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a
Size 17KB
SHA256 6eedf762abaa59ce12d87c3873fcd8b6061835bccb7d07df9af059a4145f1cff
MD5 1f74802754934de8d900f6269ed271e9
SHA1 07d49da6288741babf8ec407a35cf1124e891cf8
SHA512 0de5ab6cfaf629847f121096683695c4f9b7170bbfb4a35fe2ec8482efe14700665c16f65e941ffb49d8eddc648eba68fa9b218aa37a3f9b9d32fc2697ec25ea
SSDEEP 384:OfE+3B/QD/kg/TXCK9XrKKgzShHod4lRyAXQD7v3xY4GEjg0iv:OjwTTh75JhHoPWQv3xlGqP+
TLSH
T18882D0BAF8F75981282DA15F21F7D63CABB937755B794CC08FCD82610331A49D890497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b
Size 31KB
SHA256 d1b85462a1080fac20613953ae08dbff34e28b73bde5a7f14aca20a8e87a0cc9
MD5 1783c6ba4b2b5a295759ed9d38004077
SHA1 6dd055c10b9ddc92f1cd406a912c868649327b2e
SHA512 959ff0fd0a92dfba535b8828de35a0cf7346c737849c17c12bbe952b45eed24e845bf362839f38fbcc11cb5f4bfdfa8cee78d2a4165cf927d12cfc93105122dd
SSDEEP 768:U6cR8T97WrlXbjjEvMo5s1gH6u/HCdcAv2CMlt1RbKEs:UlMIrNbjIzS1q6uK72CW1hs
TLSH
T1EAE2F11B961A9283CEA04A287CF31D9CE3462C79B010672BA37D29378DD294FFAD6155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c
Size 22KB
SHA256 e8ff6ab2802263596bf7a5f75180b745433dbe9ec9de824840aed8f59af62cdc
MD5 37f8929031651f3d776f2adb1b4e589d
SHA1 bf5958acdd4bd66dac08259837db8bb41f9dbba0
SHA512 e98877c3e974f874c8e9d998908467f4fa7c3d99037ab587609c29ad5ad4cd7ef7033225e2b9489ee83f15b3aba6be50f77ca11256efcb0d7d04065520e83ce6
SSDEEP 384:QsFGnRQG6fLToX57u0LH4FRJPphMIhinCu932YZpUXqasZm+e20/TkcWxwUEdtmc:DGnxYUX5HHOPzh6Cu93T0qvZm+e2UTk8
TLSH
T11DA2E106101ABB07576F16B9DED4CA4D4B24692730B33DD897C9CA84BBD3EB1B66110F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004d
Size 31KB
SHA256 dbfe961bb7b9c17d68e65660edee8c22ecf2b1ea6b98d4e9f97ae1d154b12bf4
MD5 8666aa8497a22c349c18ba60d922103b
SHA1 346e8522aae183f4c16cb8e8fa8ac5ffd080e5c3
SHA512 6554a48dd289a21a6da52737f51f163d15860105e2b1736d966e2cb13b732865bfc9d055d9c81fd3e1ada1da39bf8c9594a32df91095a27b6b736c9960e98cdd
SSDEEP 768:qaWI8onU0rG7sWRgycOqOStKmp2RSkTAYguVSUy+txdnm6emzbv:qapUBsW0HgmASkMFu0Uy+tfpbv
TLSH
T16EE2E18706995E9B1E0D0F230F1BE9B25836615F76E241C6AC7AC807FF97C8B9C85486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004e
Size 19KB
SHA256 b51e7b0b689f2ea9cedea83f23d1b30bb4a6a206c1a5a3e76218854bf828e855
MD5 32bfa92e51b6cc7304b93bbdb9df1bb4
SHA1 418290202dd67b6be089adeab56531a9a425cdf5
SHA512 f4357b8e7edb2587055fbb7bd4dfacd8d66e1bc4e0a7d092f8d566dd6ae9bfaac0681e324ee59f2a1e9cadb68b35eb7c698ea87a2a8c5de6b6c40aac9952e737
SSDEEP 384:tCFK7n5mUG8e/HHaZN9b8ELHM8zvX/MsssBvSi344636rKtOpu9K/+Tp7tU/kZfT:6KT5mY5ZN988zXMsZKZj3W1p6tUsZb
TLSH
T1DF92E155EC2CF3D79C1E40CEE565B3864CEA0D177033D04372E52A7DB00E390A53A5A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004f
Size 77KB
SHA256 e0889c38f95b351945fbf23909104bb53adf39a3778daf8a8880526cf712ac9f
MD5 5b7e9622c25bfa2f1c71f6d933e00857
SHA1 7cd4e87d7e3089ebeb95bc780df3ddeef3b0892e
SHA512 55c1f5181925c944098b2b8f53a6c0659457ff942f8da2b5e8b90d93648804527cb0461a6e167e263bf16844bc87653a3cae1df7898b434dacd9288d98fa71d4
SSDEEP 1536:ZsnptQ7W+OojHdKgKt/gcui4zWIGQZJcosQYQ3jOFh7:WptgtjPKt/g8UWIFsY3Uh7
TLSH
T18773026BDE622C8910CE90D370760801ED7E79AD035686D5CDE7B9F908B9CF22D27D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000050
Size 25KB
SHA256 09e4aaf8b18eac6d39c231238136d8dd57e87d1117cd6a81488e52df7a4906c0
MD5 fd51155185f641fc7689b08052628732
SHA1 462a39d7f4c613ede14883f5ad11573ac41ccb11
SHA512 cf1579490fb313dae02a55366d05d8caf787dee9a06b3a013d01a731652b1f3f04ee5fce659d0949e1a97afc7e042f99c99cd9ea5399e0fb281238e3cf3f8793
SSDEEP 384:NUGC57Yib/C5yEj4bDb9whtFphviiUfmR0P0RYkW1w837HMq3dDlLTn:IV7b/YyDbDb9whbfTUf2RpkwAzdDlLTn
TLSH
T135C2F147946F7D4445E98C04D3ECB9B7B2CF62ABD2E69C2D2908E7A40B73150283B9D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000051
Size 87KB
SHA256 342cd6008cb657a1e7460c1a8b4738468c4c42fa312c250e2faac005be33edaa
MD5 2d64b7b3ca1b6148debb0d8bd4031e47
SHA1 07c465e330dbd8d028e562fde4d81707789d8020
SHA512 c44d2994af3b1cae1234f98bdff5b7a9d0ea7de1a404cfb42462911bec1aec8090066397e09f2b85ad11eece83125a94a2ad98f0925df2a5a927fb503bdb2a32
SSDEEP 1536:PCS4v4q63R3Hqo//HXj53Nf9Ky5vtKXsizfHc/sewt7f6ZRguOTksR:PveO3j53NfnKXbvc/sew5YOTH
TLSH
T17693124ED7DBA7D925E07F812EBCF0090D4912F42688674CB362A83E7142CE531EB769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000052
Size 53KB
SHA256 39fd0e712f48a67442b3b833e083b75c59523fc89d1d597584364abf8ac4dc18
MD5 c3d97bd5b55234e04037a43a06ffd2dc
SHA1 b50d4d358e3fa3d87946836a7e898bb100e9fe85
SHA512 c8a51959878ec3eae1a878dcc72e8311e147b5a6bf0dabb7e85941163b48e44fe9a4277cf48122818a37c4c91c3b55aa986ebc92ed20adec336c414ed466b656
SSDEEP 1536:/4sUlc4mGLS5a+TXlQurA4jWfhm0Bsa8jpJHaKK:rUlNLL6XCuA40hLBs71aKK
TLSH
T1DC33022395769A50D79784437221CB79582F3BF8EC73AA8874B5376084C1A17325F6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000053
Size 17KB
SHA256 5f7d124e56ed84a80f614178578eb03c8d4fb8a8b0e93eed57b008c64e6b8aee
MD5 eff4418a7668b522966d83f621e81bb9
SHA1 ea27094709deebab4df28e234256e46c6050baa6
SHA512 f519c534754b7b85a96961ffe22a312b65603ffff83f054799ff10b01935374e85ea3819fae1feb333fc258effc321188195a5c874271ff04152857eb1174d15
SSDEEP 384:pbyNM5GGkwn8qu/O3H5VqK2apUaJ90xkHd8ppJvtGZqwGgv:WM5GPwn8JG3TN2anUeSppJvcrv
TLSH
T1FD82E01352DBE95CC0087CAAA4A00C21EAE77278AE79F463255D0BE68C7D7443E249F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054
Size 25KB
SHA256 32b2f52548cdf813920d452e9ac712f5c1f9415070e6a1c16ea367b8d0638a99
MD5 223f79c43c0568e540bde32a385c84f9
SHA1 d0a4e09a766aafdd9b4d238f394d1ae021f90c8a
SHA512 cbf717c04a6e6043c3ec956aebfcec263abf199a4c64c7754029a594ab98de5a91a2449f52e3f68eedf35d3faf4125d24e50aa91640a69aa27f903a2e2efad6c
SSDEEP 768:1Ee866w+4dxgT583vwODJYNprZbAzOZrxN1DtxzK:1R6Qp3RurGzYVDjzK
TLSH
T182C2E1B64E0C1DE0D119A927E3BE74BE6A05512DBA0580A9E05C90FFB3F071E22566CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055
Size 103KB
SHA256 b5bec02818c3763c7a3d1f54666ea8ed1879b45cb4057eadde4ac63fb01992ca
MD5 36e23b54cdf719bae48a3f6c5e2df8e3
SHA1 18ac6ee526db0557ffcc94b0edc08ca2f680260d
SHA512 20773a37d8b1a53c7ca684616a912d7726050d69fdacadc71d2f68cfdb728234cc21ba677777bdfd01bca909f4bf6c40e97fd624b805b0e60a9da85ed9b0bccc
SSDEEP 1536:0Dxa3uLu32zw2CCW+9+JUgffNQkyQXAgN40qlW3N6/eJis2vDDfsHtm9g/MNNPnR:0Va3uLb1W+IUg9L1T0xe0/DbsHX/MLPR
TLSH
T112A31253B48059E6F1B30196AC40E4D7A160DDDE6F79FF80CA190A344EA3AD79ACDC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000056
Size 156KB
SHA256 e036cda0d23b6e9541c286b95485f4859ca12ce9c5319620b0d13fe103acf52c
MD5 4a01234110a7731e41960eae90220d06
SHA1 f5520c1881689f3da17178049b15613a553b2293
SHA512 8e9c4a214d940f947fc0661c7eb8968dc7ff4a4a2e497c88b2bd73bb93bf6908284efe3efc73d4fa6c6ae8694f6a68a32c761fe14b462728052bd4aa28c3d540
SSDEEP 3072:A/FlYlWjQBy0Ox5mo70hv2PPpB/SxLyzLQyEfO67xmOJac1KefgvGPIr:A/nSWBLL7ks3/SxALGfTAc1Kefguo
TLSH
T197F3121C7572BBBBA7E3A630E6F45DB53CE885BAF19097452CD749A893F03354826803
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057
Size 135KB
SHA256 41101a0ac84ce01f2d6cdb7e32dac699201dfb7c72d01deb4bb6fafc4ccccc9e
MD5 683f6e24463a0db9c9691b3682342ae0
SHA1 b1e829b21634c8b7c39b47381f039e6c85af67d0
SHA512 b4496e68f052a2ff2da4919b7e354cd4b201b78cd4e7a9324b65bec62161385021b578e2cdeaa35ef1e8a5c6aebc094fd9ccdb695087c4ff6689dd80a728204c
SSDEEP 3072:ZmQuviDcSClTxiCw2r3EfS9WruL8Jh0FMFgtNxeAAjB:LuvgcZBbE69Wi0h0FMFg/wL9
TLSH
T13FD312C9129C5C10DADF990E62639923949DE25FCEE3DA30C03936CD779ACF192568D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000058
Size 16KB
SHA256 e2a4eb4ff098a6e296e23c54dc9905a2e4a1935b7c73dc044a4efd981485713b
MD5 f04e3699eea5b84e2d69c65afd3344af
SHA1 97c40569c0a694b20435e4201de42599a401fd60
SHA512 8bf3d8f4d800ddc8da0edd84700943e8da1042d62edecc43601ad5a044cf79d40d9962075902068668523fad413b4e09045d4c395da2168729dc055905e03b4c
SSDEEP 384:HDo80kvIZbsXZvp+ZkR904TnW6iZxQUoEkyI5le7G//9LDH:j9WQXrhGVogsz
TLSH
T1F372C077B39B7C46F744F927953B02ED665EFF38EDC6D2016B5AD8100A6C880260B432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059
Size 36KB
SHA256 ed672ed37bfdadddb835de8c346655a17b653094197a2d6080e6777fa59785ea
MD5 01369d5062d49b270c8dd6ab535bc403
SHA1 39c654df64cd7386081da8108f23573f331debab
SHA512 de704934135717cb62e4d15ef1666e78b3d43c17ff5d50b279c21a5318ac2ce0cea88ebeb17b66f4668e1ca1a8801bdd6bab0194b157b1da6bd90c71b29da08e
SSDEEP 768:cfWDt10l7IWSENqPZxdv8aNdYjie60vLP2N4fUtbpSErCB3X:WI10loxxh8aNdWie6wb26f8m3X
TLSH
T150F2E1DB71CE318629F9249EA282A35489DCD6D3D61C358064C5E38E2B43EFD8B17B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
Size 18KB
SHA256 179d741ca671fb124c4dec8acbf65eab4c9863c7a5553363203131f8004dd6d7
MD5 f6fe53b8e47c2f3392b2ffc2b014a879
SHA1 e8526c9e553db3f85addda206d89f3c6bdf7a574
SHA512 d6cf18d47fe1d8f1f4e171929601ddd76ea84e5426051f34ef1cd5a7d5db15cdf0550f4f7e252a8cad011de4b0b1697a3e9a6ec6d507dbfd4759f3a3ae4aae96
SSDEEP 384:zOyiBrDwDDzGCdP28nQD5ufA27J2Sgele8VLy0reqYn6/NK0fI:6yiBrsfGsPrnQD5078Zele8VheV6/NvI
TLSH
T14782E183C9171C0EE66769C66C57723C7A344F38EC13F996360319A325695D90AE8B78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b
Size 19KB
SHA256 70000cf6ee1661281ac7666ebb7762e50c95aec833604b43589e5a1c0f09e79b
MD5 6158707cf0fcc305a91a00a7a604b8d2
SHA1 b406a3948716a4523f9aab7262ce910ccf90d57d
SHA512 82de7f064d380586bea283a163513f4a0d12477a4b459df9c1031590a433f0be599c5459f741d522485d19d30c4465610448ae7196081ceec8d7a41de37b013a
SSDEEP 384:kBP2SmHjHPDtUXQpcYYy8Se52GU/3gX7jU2yoxiQVEDaTQXDz:STkTrteX9Mb/3ULVOaqDz
TLSH
T11992D1B17816150C7E4E79D26092203B929DCD9F3EAE799F10D28BCD30A275717BA056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000db
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dc

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000dc
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000df

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000df
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e0
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f7

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000f7
Size 41KB
SHA256 75fb7769ac4a592cc3d9d83bbaceb0cac3867ecb247c385609a2b934e949c448
MD5 1c538adf76b82e8dbc907c376b2edb86
SHA1 044271aa82a53bbec84fe1df58506d5468262ab5
SHA512 8f1dd76149d10058b5b81b49739db9927a18cc2f56c00cff8806e4f4b6882b3456da81ada92a8c7533230c481a53dcf29abd72dcbd361f38e183dc4fa5686ce3
SSDEEP 768:uiPeGCTU2LKdTjK1rl0Ync9I3PHw1ALw+wBAPYqaia1PsbtUZE5JCaUvZGJatEGc:XUQS1rl0YncC3PHGA8PXRiMPmoKkHZGN
TLSH
T11313F1CCEFACD50A0CBFF1C9707960525D565F928829EA7744C2BBDA01748633837B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f8

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000f8
Size 76KB
SHA256 32262861d5f326c8192a5a54ee00b656ff7fea19645bcbaa52f3ccd9311a5289
MD5 849fe0c032309b7ef721562fe5ca0acd
SHA1 290cac28577207a03da4e7717a9104b40368cab1
SHA512 52a6394abbefd2348368008bb08e32e8c8a06ca026c18f2702c9554242a3e335e2e52c4f9f6398434962aa117f5136fc6253036e07e964b0d2d2b7e301987aa7
SSDEEP 1536:NP2s592WtuNCcRZAJF2j9hHOq3aKyvby6WPJolbejwycwF:N9592yECcRiJgJhH1aFbXmcbzycM
TLSH
T121730293ED5ACFF15EA8D8B4F2CE8FB36446B4569E26F099A4CBDFD0E3645520014324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4774fc00705417b7_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4774fc00705417b7_0
Size 2KB
SHA256 47c1996ada89af18787b84f1be84cdd0f61b7719dd64ac6e057b5aeb00066764
MD5 73b907a6794fd29619cdc87bea3cb174
SHA1 845ea3a3bdaf33e32049115f4a684fa4bd79a408
SHA512 675e7044aa78edff64468942a541fea863360014d0d79839df1975b0c7a132e8ebb1708b70350d40267bf82d325cddeb375a0a7f46016b5dc20b2f1dccaf9380
TLSH
T1B24143929614ED5ADB3723F84505C645AB31401C7F86E36BA0F6FEAA2C0E9E25E40C0F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 ce34e0538cfc278a19bfb4d4127195f6b0b6d67ebcca2b0780e4da86c39102d1
MD5 f21c9387caa0810599442e355e44df3e
SHA1 3fdaecb8749b42156ca585defa24fd663d65f43d
SHA512 e0871edabecdd9a5e702a53b9bebda48f704fb77411afbb00c5949db6bed427b3c560d476b94315574533af2e36aeaea28d58cf625ef9cb5290be0c59c4ee733
SSDEEP 192:h0v563cU+oRVm1Apf4KK0cZNSjLK2SlCoBTcOVI1/gn:halUtGQgKNcyLHUCoBTQa
TLSH
T1E8F15DB880B12D0ADBF9117774E7ACC63AF03B7450271EAF184BA87C16933E96E53020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 cb3f39c454a699c1a3b685aed646603ec2c9437c76dfc902e9224ef88da2117d
MD5 d281bfccad169f8436d7eabaea5fa2be
SHA1 21f43e6d9177fc3de6dfea26a01a7e1bf9c8a689
SHA512 2c1ebd395de82bf502dd1e4594bef258c3733f666da67b0c4b37dfe765cacaf6af4ce1c0c348ccd3bfde47b817630c08279309d0cec8849b572e5a6ac8616b72
SSDEEP 192:kTvH69sWU+8RVmvApICNKK0c0K+N/77K2SwCoBiOHOVu1J+7:k7WUBG2jKNclk7HdCoBbn2
TLSH
T1540240B980B1390ADBFA167364E7ACCA3DF5377450672E9F2496A87C25933E85E53020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 bdd0f79599dd108224ee4d947740388046ab340ee3b02d9e7b208aa848d89fac
MD5 ac85449da95eb9c0f929ba86b5999064
SHA1 d9750d360db20c5fc2d2c5ff82fcb9a8a3ee0b55
SHA512 390ba79dd15cd8e8c0b8ff7d4d9b5579b3b7af7004389a45d61a60db2e7e6a29360e40515039ab98e26fdceb4f84e900ba4ce9418c9fb79dbb60180dcbf8f7b0
SSDEEP 96:KUMDBZH1IF5SV+AGMkjgIJiUzdG2rruO5T4hMSFM:KVXVIX6kjgIJiIG4ruO5SM
TLSH
T1B4B1942C80B12C07DBFA553734D7A9D439F0337920632EAF245A557C5A937EA5F57401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 189f0a26fff3fdbebd95f1c5d1ff390ee890b084bb2f524e0be3f8aac72bc1e6
MD5 30c8305d0788320308d889452a75c61f
SHA1 061b38c21ee65d473e633c436a9dd7833710fd62
SHA512 2b60bd3c00f0686a2bb7d0cf9c652cc74ab827c9cbe2cf114e7d10daa0f6ce222a8c23c70520648d7f6d07e4c154e404fa4e324858a1daa9d814b3e367202f4f
SSDEEP 192:+0v563cm+oRVc1ACfcK0cuNSjy32SlCoBTcOVI1/gF:+almt8/kNc5yGUCoBTQo
TLSH
T1CBF12DB980B12D0ADBF9157374E7ACC23EF03B7554671EAF185BA87C16933A96E53020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 ab0fa3a39379b9781c5566e76f8866dd9a6056392035d86fea4f7d3dbaca8523
MD5 31a6c0f408294f82af4ad220d6e839f6
SHA1 950a97fea46fd8450af4e3dd7dde13e866c01ddc
SHA512 9be0bd191255b9b66f411f13038454498e1ece2ce26ece6f9ea89d6ca51abc37755336b9bb3f9c2c29cb74a4502abf05775eb5443c2fba74ba862a610eec6e79
SSDEEP 96:R+HkEDUj3sAI0zzYZUVVuBtPGqUiEI5d03NUDr/wsmau8FNtOfNgCMSwsEJ05:kEUe5IQYZUSzURIWN+ssmD8FNtOfNl95
TLSH
T152C1191D40B12D03DBFA1537308B6CD4BAF0337812672AAF2557986C5AA32E97F83431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6a1a9c2a7af56aa38c1db310f3051331c0039111f7e908543b59468343d386a6
MD5 66fbe648f4f83effbdccb2dac4436a0f
SHA1 4a7d08a8b8f3b21a772e0110329f80055d746068
SHA512 b4e561b18eed62e9b0ce43af2432f54074cb6b3cadfc34bfd3dd83dbe21ff7e5c1c532e50b938b2f953d9ce68946cda7f6f922653221251b6beb1858f74f960c
SSDEEP 192:nDvNCULI48AgFM0zBjNKvmSmmkc+fOREYG:nr48leHquzmkc+51
TLSH
T1FBE10E2840B11C86DBF50D37B4E76AD439F4337520673E6F2846A87D67A2BA5EF47820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 be751b662250580962094d7e08e663e199c0c03c41e25b52eba3e4cab5dedc9c
MD5 a46680eb1f733df05acb3477297adcd8
SHA1 bf9a56fbef4db4f74d23eed9f499082e38469652
SHA512 09b3e380cd09939d0aaad8ec81fb63f8978a8c5c757a17d37d6d6ae634aed52720ccd8388222b86a203fc19086df7acd8bcf8b3a07ff0f7ec968848dc492c28c
SSDEEP 192:bDvNCmHoI/8AXfbc0FRBjNMJF2SmNmc+fOfEEc:br4mIOnz3FWJMzNmc+D/
TLSH
T10BF14F6840B1184ADBF90977B4F72AC035F43374246B3E6F2446683D6762BE5EF53824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 57KB
SHA256 660756c0f9855ef6c345800966dde1b5e3875168f759a2b42d3fa3cfab9aab3c
MD5 ec734bb26aff064b3c6154411df930e2
SHA1 0b82c04848422eee83b20386e3c566daf19c3f23
SHA512 ea8658b63b28e5cdd28832684c75c90c76eacb67524ca86c77f1d820df7c1e3354e30791a56de1c19d5825b4bb650502aa68cf424b3ae514016029650c64b980
SSDEEP 384:fIxinm1fh6wn21giSpXLgrzxinmvKJ9I8hnHfIRwmoyrTaf6Re7BfIRkmirxIxiV:UiqjWLXKs5M
TLSH
T19343F188B8EDEC369EAB490334F2BC1486B3F236AC748DD964191C1E42E2FD15CD5693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 5b45b61ba0d3fd22ec32b1c9ad084e3c6e9826213e4b0a4682c4b8283bce577c
MD5 957e98d441d64bee9e30de8c785ac43b
SHA1 1f1a0217ac8b3d96c910e883603cac3098450125
SHA512 84029cb800f400db0712d67049667a36a8392b91d1a32c09fff592042faca8ea9a898810d80e47bf88282c881fc34ac316d8bb9725282e118cd20d91e7f65936
TLSH
T1FBE0C05881C8C9FF118880A24034770FCBF7200DD7DDADC90F42E83470C940880AF320
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 30KB
SHA256 6b4bdc6f7709db8daf924243acbbe99ae41c9025c12b90bb786cd471f0c79862
MD5 085e6887325e8f47c7ecde7a91737e7b
SHA1 e8d14aba65c640d09483d4d7bf85a71c575c95d9
SHA512 56b2306658b7fdf88c871d5e8378666f5fda076564ef0b68ae584de03a23b7e01d7fe3bd717ebadb9c018015621030efcb46efa7a429c984ed5d222883a40e75
SSDEEP 384:DLmDOhu7SjjyBdJQVJQ6dUaxkjYQl+A5ht9sLmOVHxyQugJmxemA/R+pUJvGzezO:IclYVQKACEsnKUC7X8iX/ScuIZY
TLSH
T1B9E2CEF787E8866DD86256F09B157F1BCE2D0524431C3C2AC8E4AE5BA3F2471E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 eeba948a4b19dd6116c3dd4f68633e8e6d8c0316d89f9d3011f643e6fbaf728a
MD5 873260e0d66631760f091a92f980d6da
SHA1 4b3a1170b710e97c192e0ac3351fc4f9b627ed31
SHA512 059982a67116c8cc51492a0ae503d76b9c2272ed99a4b89ed36ae57d9ceb0454d30ead81da08ef207b1f7f2c7b63964db0f1dbbaec339d3c7aa212a17d2c4ba6
SSDEEP 384:DLDOhu7SjjyBdJQVJQ6dUaxkjYQl+A5ht9P6nSp+bvQugJmx4mAZR+jUJkd7exSh:lc8YH87ACEsnAbC7X8iP/DcoIr
TLSH
T17FD2DDF783E4866DD96256F09B157F1BCE2D0524432C3C6AC8E4AE1BA3E2471E191B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 d4c6e25ef3dffddbd5d931a4e48d8a2bbbc6e3837ae21ee8bac92981be10c426
MD5 cc9d4f70d5c449eee59e8fffc75179c5
SHA1 d92e92177f62cd06bcb112c60bcd52f489812deb
SHA512 f29513dee02f33cc774e8a66681786200a779f8ece44c936e260230a745bb410c95f40ca86194a4b76879369588621491e6df1652eb3bb1e7342d95ab4b29400
SSDEEP 384:DitLmDOhu7SjjyBdJQVJJJQ6dUaxkjYQG9cBEbBDsLmOVHxyQugJmxemFk0aQEdK:FcPCYVBACE8HKUKQs6yitX8Sfv
TLSH
T181C2DEF7C3E4866DD96256F09B157F1BCE2D0514432C3C2AC8E4AE1BA3E2471E291B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 551081965512cf38c6a3ff2dac1f4997bb0896697f0948160b3cbf7c2a4e6ee8
MD5 2838a2f285064e227a1b8939779548f2
SHA1 76f31ae5f4738a509e381f82945ded277f275c3d
SHA512 5a243d2739b538b65c26e1f859d04a295eeef5a6318db1cea5d3e582171c42cb34336407c8d73dc56fbdc3c2ab7dbe5293568bbac2def15384d7bece445b35ec
SSDEEP 384:DitLmDOhu7SjjyBdJQVJJJQ6dUaxkjYQE9cBEbBDsLmOVHxyQugJmxem5k0aQEdS:FcP8YVNACE8HKUKPs6hC7XFS83
TLSH
T1ECC2DEF7C3E4862DD96256F09B157F1BCE2D0514432C3C2AC8E4AE5BA3E2471E291B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 9e444126109f5f6fefe8631b1dd03cde95823f5cb996692eef4707d1fba7199f
MD5 ac75e00729fc05ada771be52ef6a1d29
SHA1 606f2844bd627cd4df3b812e3aafe2821f3ea4a1
SHA512 1a1e9e5ed5aeacaf609cb9011d5cd18beafe93492ff32596ab4b8411be140361f0a54ccbb7569616801b4cac190328a43b4c7e8d4117e3667e66adb9d6005d3c
SSDEEP 384:DjitxGrYPN9s1tmEQCJkRJTJeJmdmg6BbWBkY5bQG9cBEbBDsLmOVHck0aKjgB3w:PUp8YsWVx7F1vY3ZEHGNq8QiwOa
TLSH
T1E4D2CCF7C7E8866DC86216F0AB153F1ACE6D0914432C3D1AC8E5AF5FA3E2471E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 60b904a083a12874e142ddf5e1d6fa4279098ece2bf7b35d0e1567724c398d1d
MD5 dcf59a694a04f43e15d5aca74ac617a0
SHA1 9bdc4c58498aeb03bf0b0049b6c13e1f613c9e5d
SHA512 0ae1eec2f0fb6294f4fd5e719f53a1c6e07a9f2fc05d4700c23bac080da6538bbe86df9035134645c413e677bef6c9c7441642d113e21283df4fac9491fb4c5b
SSDEEP 384:Dy611GrYPN9s1tmEQCJkRJTJeJmdmg6BbWBkBk0DrtKjgB3uwawZQJR26F1Me6hk:4Up8Ys6VZxxK4xDe8dSPw
TLSH
T1FF92ABF3C7D8862DD95252F4AB153E1ACF2D0965432C3D1AC8E8AF1BA3F1470E29165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 3472a64c0e2bdcbde0d99f219f45e3064c8f22b00f3baf5dac8ccf29ac234899
MD5 e7b48ef9934f3eba15e7c4f0234b3029
SHA1 d17c3d597cda863a7ead690acc73f823c0387c36
SHA512 ac6956c7a2c1ee507c1037b462593024045697edd2b929676e0bb6278b24228a1f5ff54da9ffec659df37bb287cd40df995aeae3327ef792d95721792789ec6f
SSDEEP 96:BU2UftUlUuieUtUf+UtU4UARUOQbdU0UG2UehJUMUF0U+gUaU3UFUuUseIUOUpUv:BU2UlUlU6UtUmUtU4UWUxdU0UG2UiUM2
TLSH
T1578169A395BEB467203D59AF1E047C152CBEA8360282B4F9EB97967CA0D58F70716027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fcaaabea8a5547533b3fec08d7b7fde4f30bec1f2340c627b81ef115b23a0740
MD5 c5404cd3aab67570309e1d86fda465ec
SHA1 11cc4d9528c0600533251108ff0719f1c34e6be4
SHA512 2e602527b9e5a4e4fd65d052bf4db7c2a8222b6994f0bf74183dfc2ae6761f3144e9f65d924e93ac117cfdbb6637fa32a7f2a71e792df9d4e948306394e7c3f1
SSDEEP 192:TRdZfyEXvv7gAPRp2V/ee9NLHsb+WNnqx++P0+To2PXeoVyIsnAUge:TRdZaEXnVX23w5BZ2He
TLSH
T1EC42841EBA20697B6EC6C21AF9257B97E7F5102125942E84E7FC8A2C15DB6CC3213447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6109f8817c6064b20260e7a1dc0bdb848753b41484ce45758a6b517707b1caf6
MD5 815d001b224c84a7ef886de3d89c73bd
SHA1 923bd0e543e00cb8ae4433bf1107d2facd1ee534
SHA512 d7ef4e09d262eeff430f90fc3d4b0cef94107f6e752398a0104700d60eb899ac9a39aa1f5ae970bf96a88e5e821f4f4755d50edbea0e98c9f4452d2f07ca5a1a
SSDEEP 192:eRBcBzFfyEg8v7yLPRp6HOOqvyejN9NLHsb+WNXUfitF+IlOkpBurrR+vrKdpAAj:eRBmzFaEgoeXZ3wHDVMeFAFt
TLSH
T18262D75BA920197F6ED7C219F925BBA6E7F5202166D06E84E7FC8A1C24DF6CD3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f605a34dc9564b44c128221337abe8364106cfbc1d36662558582795a033a1f5
MD5 09aa7653ed8efbbe58ab56865df6ad1a
SHA1 9db8a873254a612628b142eef0896a98ab94305f
SHA512 c6997957db4ee05a3dc939782b4c91a67302d32d56b0a4e7b7408818daafca6fd383babb9b18360fd3d5bd30e1aacce186d4f8aaae4fbe8076b50fe67be44115
SSDEEP 192:TRBcBzXfyEB/v7gLPRp6HOOtkAnw9NLHsb+WNX52x+vAOcNXt0rR+UqeHXeAVyI4:TRBmzXaEBXYXr3wbtYewe9E
TLSH
T11452D65BB960597B6ED7C219F925BB96E7F1202166D06E84EBFC8A1C24DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 89ba9cb4ea7a28a2fdc328a92b9ec91ea1660a4f78fd59b0e9e5dcae75b9c405
MD5 47374d0a67853a9468a1c93de1e214c7
SHA1 95e3d448fe9cf68a48cbc9a17766aedf3a84d3d2
SHA512 e211c23d3c21f300016c47be584e69c04d4aace6b6e8bb4712143c5b0e72149a212d87b29d3f828a0448eca968006db21edd4fb1d981e6570765c310c2839c7d
SSDEEP 192:TRBcBz6fyEsFv7gLPRp6HOO+funN9NLHsb+WNXUmmx+vUtwNqkrR+D42JXeAVyIJ:TRBmz6aEs1YXI3wLQLOZ2Dt
TLSH
T1A362B45BB920197B6ED7C219F925BB96E7F5102166D06E84EBFC8A1C24DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f0c5c697fd7c1c34b71238646cfccf5500c5730c13f727be09c49af7385e1c1e
MD5 63c1dba8083bb7538c77ec2e79c8a13e
SHA1 bf0513469138607780e57e265c70a1218b85f823
SHA512 029773c39b93b81c115bd8ac3e4189c11def88bc5d1a1c9758dd82d2a9a74ebd4a1bb402acf098aa8d6ffd33f5ed23161bf4a0154878dfbac6ed956f25d4f0ba
SSDEEP 192:TRBcBz6fyEZFv7gLPRp6HOO+vunN9NLHsb+WNXUmmx+vuFWXYErR+D42/XeAVyIJ:TRBmz6aEZ1YXw3wLA/uZ2Vt
TLSH
T19662B35BB920197B6ED6D21EF925BB96E7F5102166D06E84EBFC8A1C24DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e9d631c0253a17f98f05cba6cac465f4c52fb1ab051206bc629b0e05517c9380
MD5 9f27a475bda504ff1e13e0d44791a0b4
SHA1 c4f5d4b63ad75a70d6bd32db09a345590af79d66
SHA512 447985e87afba5a6288c6d366fa6f55d6a70bb44bff809e70dced6b475096b6fcd29bd095b5a4463eb0a43bc1091d27ba4c14c81036f5089d6388988060c8409
SSDEEP 192:TRBcBzFfyEZFv7gLPRp6HOO+vunN9NLHsb+WNXUmmx+vIlO8BIrR+D424XeAVyIJ:TRBmzFaEZ1YXw3wL8zaZ2Qt
TLSH
T15962B45BB920197B6EDBC219F925BB96E7F5102166D06E84EBFC8A1C24DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 875af3ab70bfb15d0c45087d3aa0470f8430c3027a4362376213664fa89c10d9
MD5 242d3735481776e6daf3f937c66fe729
SHA1 704d3219b5f50b56d2aa86a86d708345901ef556
SHA512 58d2a3be7c4dfc45325ae64f79f2dd67c00f34a9d19f13554440e6f4e7ead83ec669ea04f85af2dffc5d244a35481f179e4ffa3128e5f71f22c458066692c216
SSDEEP 192:eRBcBzFfyEgFv7yLPRp6HOOqvynN9NLHsb+WNXUmmtF+IlOzvMrR+vrUXXeAVyIJ:eRBmzFaEg1eXg3w0DuWeUNt
TLSH
T12B62C45BA920197B6EDBC619F921BB96E7F5102166D06E84EBFC8A1C25DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 28932b83db1cc38bb945fb9f78a21893a52f29be6fcc8fc369578ae75f3126c1
MD5 ce548a1f76701e1fbabf5ef51332a2cc
SHA1 776a36f8c301ce289fc950edcdfd323d8b8da3e2
SHA512 da256a53a2989aa68bf921d05d277789ec81e38a4093a6251f5365afee2de1eb49744b0f7c4b959bdf18c26d367391b209056b1790aae88c05cdbcfb68270219
SSDEEP 192:TRBcBzJfyEXvv7gAPRp2H6mgge9NLHsb+WNxpx+vBu48jWP0EbXeOVyIsnAUgE:TRBmzJaEXnVX53wcY3ZE1E
TLSH
T17342831FB920697B6EC6D219F9257B96E7F5102166D06E84EBFC8A1C25DF6CC3223403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 26d43dabfb155aaf00b2de030416a5d06eb9b97491cc2ef26633eb882c2c568d
MD5 3fc9420bfafed9d9a9267f205f34dfe7
SHA1 3b23237a700fa8e8bcfbd81731a640c73dd69ae5
SHA512 1d979de4fe4726e68d6c0ef4b4777ab4a7bbc9bc93035f6fb71cd480d5e2658c79f24b78ecf1336d108a80a68f6a04defd44f71a9e03211d50e6f057099412ab
SSDEEP 192:TRBcBzJfyEXvv7gLPRp6H6mgge9NLHsb+WNxpx+vBu4IIcoP0EzLXeAVyIsnAUgE:TRBmzJaEXnYX13wcYPJ7Ez5E
TLSH
T19452941FB910697B6ECAD219F9257B96E7F5102166D06E84E7FC8A1C25EF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 25cb16138529cee5f1157312e045c69bcf9e1c9092a4ea8af246707ffe25dc48
MD5 a57a001c33e3cd65d217e80e50d31a12
SHA1 d991f6a519b0efae152a91e0903c5674aed17d76
SHA512 2f11659842ed1e7b75462a242b4e10b8154eca48a1a31a737e78efce17602ab05fc227663dc2babfa36904a08299d1d5942f3f3a1e582abb7cf78eebe43dcd13
SSDEEP 192:TRBcBzEfyEXnv7gLPRp6H6mCle9NLHsb+WNS5Fx+vic4pi4P0EzXeAVyIsnAUgE:TRBmzEaEXvYXQ3w33ZLEhE
TLSH
T17552B51FB920597B6ED6C219F925BB96E7F4102166D06E84EBFC8A1C25DF6CC3213413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d8bc24442fbc25b053dd20e978fc8879af6d31473e3a759103d1ae478fcd4d31
MD5 ddd18889949bbb39bbc23a91f6176de5
SHA1 6614f55d495c594c63921d4800c9a6678bca2ea9
SHA512 a29d46b8b2bed05415907b2b80791800f3d3a337be85d9b28e7ecd6f9322ce26a7a68d5953adb57e35db8f01f236f3dd20b4e51555572650dd49953d523832cf
SSDEEP 192:TRBcBzEfyEXXv7gLPRp6H6mCle9NLHsb+WNS5Fx+vic4JKGP0ERXeAVyIsnAUgE:TRBmzEaEX/YXQ3w33BJErE
TLSH
T1D052A41FB920597B6EDAC219F925BB96E7F5102166D06E84EBFC8A1C25DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 39ec1f4589a7889b916ea0613b2a03a7f1c12fe5e5f166929ee5ff08c95081f7
MD5 9dc05cebc5f18f0b143154bf5955597d
SHA1 7f6def85d59952db2229b360a976b5c6f53a4549
SHA512 8f0f31c50ed38c03ec752b581bb6754e7387507f61e82bad0451d0485a4726486b1cb752a5696459f71a754734ec5a87ed340dbfca091fd0c1e3cebde36f30fc
SSDEEP 192:TRBcBzXfyEXXv7gLPRp6H6mCle9NLHsb+WNS5Fx+vAOcNx3kP0EZXeAVyIsnAUgE:TRBmzXaEX/YXQ3w3tIfETE
TLSH
T1C352A41FB920597B6ED6C219F925BB96E7F5202166D06E84E7FC8A1C25DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e639e26e65b1883541b6becadb4d9e738d324f3ba3c6894973e0cb29ea2f3354
MD5 2f12373457855e6fe0e19cdb601ceb33
SHA1 ade13387f73e0c2de6d3a56fbebab1b4405f4a2e
SHA512 16d2c84ea261550c153e8dfc1f449074cdcc76ac3cfde36d9756bbe839affe1ffb7e5abaaf68d0633dfe0afb1cd62e4537702550c55bef4c92616db77a6bb3a0
SSDEEP 192:TRBcBzXfyEYXv7gLPRp6H6tCpe9NLHsb+WNDLFx+vAOcNhPw9rkNXeAVyIsnAUgE:TRBmzXaEY/YXd3w2tQak/E
TLSH
T16952A51BB960597B6ED6C219F9257B96E7F5202166D06E84E7FC8A2C28DF6CC3213003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f359bee90bff4221a64c799a44bca72c30f3efcb6cbf2cad0341a598a4320627
MD5 61105ac295e89af5871bb1d6ce101af1
SHA1 431b3667af9b1aad122c8d15664820fd0370b35f
SHA512 16dd20c3c1fad154f2f401ebab9885ee77872be4e5a7fb66f6b7de08b52c22e6c2e4f407aba47009d2e0bc6f71270bc3cb3cdcc2f35783eb0d05fea6fe5f0132
SSDEEP 192:TRBcBzXfyEBXv7gLPRp6HOOtkAe9NLHsb+WNX52x+vAOcN28+UqeWXeAVyIsnAU3:TRBmzXaEB/YXX3wbt0weCE
TLSH
T1D152B55FB960597B6ED6C219F9257B96E7F5202166D06E84EBFC8A1C28DF6CC3213003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cb6d89dc3170ee370342c82b47c052e1e0bfe77f658b2b8d35db66cbee32e545
MD5 082c9c871a08210d4458cd4617be61f5
SHA1 216b95a802c99c57f8be95fb8b4ef1dd3d84cc78
SHA512 300b7623d8c535dd4f57bbe79073f55a527a0d1feea4187e4e244abf739251a6a4eb9b8bdb4ecfea6218ed695ec6655bed3f37a6eab5d7942774526fafae3e0e
SSDEEP 192:TRBcBz6fyEBXv7gLPRp6HOOtkAni9NLHsb+WNX52x+vAOcNg2ErR+UqegXeAVyI4:TRBmz6aEB/YXp3wbt8uwe4E
TLSH
T1D352D65BB9605A7B6ED7C219F925BB96E7F1102166D06E84EBFC8A1C24DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e90319e6659b497f3eed47c8a04b669027cc6fbfd0a43fd8295df587818550a2
MD5 d2647a87723403ed9c3e50066a38b0f4
SHA1 ee153dc25bcc1a4afefff62b9934b857894ed5e6
SHA512 c42d1b7bbe0437b152ed04069af240725ba1187365718295d6f26355b4c2ec5841e4e1f2103db213bf8329e510107163fa0adde0a11be894e860c661a97abf68
SSDEEP 192:TRBcBzZfyEXvv7gAPRp2Vyge9NLHsb+WNnqx++P0+JuWvXeoVyIsnAUge:TRBmzZaEXnVXv3w5BhWne
TLSH
T1CC42941EB920697B2EC7C21AF9257B97E7F5102125942E84E7FC8A2C15DF6CC3223447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0202e03b4eb1d92ee945b37c2c006c2f9404476bc5cd013305e49b3682112a04
MD5 50d917a4e538401b2357c07f98a0acf0
SHA1 1342c1a5551142f9dc1b0cf140b47bb8a1254e3e
SHA512 aba1c20c13e9a5936edee1e8328bd62b07737cc43837d4ddca877801d9298c18636b2c38bb0317ab8b23d982933204c65358fb6a511cb1f3e902d376535c2267
SSDEEP 192:TRBcBzXfyEBjv7gLPRp6HOOtkAe9NLHsb+WNX52x+vAOcNAukXN+UqeoXeAVyIsv:TRBmzXaEBbYXX3wbtUeweAE
TLSH
T17652C55BB960597B6ED6C219F9257B96E7F5202166D06E84EBFC8A1C24DF6CC3213003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 50f7899c9bd14f5c41fb8b9f5029bb366a026df5e9f58c0da196418905a15009
MD5 38b0a84a385016ab6a6b41a8a77a036f
SHA1 e832c8cc2fb26948b8a0d9fbb987a32433e3886c
SHA512 30c0990ed41c4415c77a287dfb21f97a66269ba1b89f990fcde8a0a0f67c2b9c6f8643134cabee8f0b3046b76386b7904d86bfa571d6c3b598970cf0c85197c9
SSDEEP 192:TRBcBz6fyEsIv7gLPRp6HOOtkAnN9NLHsb+WNX52x+vUtw1aArR+UqelXeAVyIsy:TRBmz6aEsUYXi3wbQ/ywe3t
TLSH
T15752C55BB9601A7B6ED7C219F9257B96E7F510216AD06E84EBFC8A1C24DF6CC3213403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88018cdba38cd661_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\88018cdba38cd661_0
Size 194KB
SHA256 c02746b5d532df1264f55a1d6ce46b17bcc54a3af998d5135ce91522dad2d9b8
MD5 d0d7ca9799c5569280605190917a3d27
SHA1 0e1da08da15cfe0982ce835643788db41389e64c
SHA512 167d301ea4342a8785bfa28712d456f256a83d3adf537da5ed65de696658ec6595910278c1751dcaab6115de0c67e0315b1aa69acf36ffe19e98033338ae9d2e
SSDEEP 3072:EegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:EegF1cc9zByRIZa8HlI93h
TLSH
T19B146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 cd85826d0ebb4b1f74cd2ae9224816c7d93c18a0dec6b915700b872ca6fe6b15
MD5 5f6a5766066c6794a9019e11e6bb4c5c
SHA1 ce4505060a6ab2eb422a05f77a49ff5b9ab128c2
SHA512 8b8fe8d70a6ea094f18c9615d44bcdac4bebc167152892fc0de979d4cf3b14827789225cf3a0903cb1b0f482579bd1cef1885c8e9230bd2dbd32c4322444df52
TLSH
T197B0122011B00E1ACC9057B012CEC0E162A45C201357470B28A00015582609D614003B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt
Size 150B
SHA256 8eebe4bf28368dd3d7b24301566fb8d299c935284b0322f3da0937919e026c9d
MD5 64da738d22fc9c67e23b9c48dbec4880
SHA1 291db1fdaef67fa475dbc2bc48c85ab10841af20
SHA512 105d7e5f1f745e1cdc95a1c803b72b9c8c35f38f48094e33f3d1df47981e010fdda10df2de4a6c0cde087577e48c2b4518b55200a2cea0dbc79c079a92e429b3
TLSH
T185C08CD72610988B4B309ACC1018311DC067818C8CC8CCEC840C040621789334802928
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe6121fe.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\6\CacheStorage\index.txt~RFe6121fe.TMP
Size 157B
SHA256 f1be7f9aa5f27a39000ca182d9d26d09e84b2ccf0215bc4f6d16fe4c147faf7b
MD5 331e32d8e519a1abac23ce890f48daf1
SHA1 21bb828977d519a974626edeed63bb1b510e700e
SHA512 41273772f7d225b16c8313809f8ead25c359bd9fd58d22a76c611bae4d61ff87982a276beafa2610a0d89f3e5ce5bfd194ce3ff2ddbe250e7c9b1f4b9d483929
TLSH
T196C02BD3251058974B30BACC1068B14DC0778C8CCCC4CCECC40C34063178D338801938
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 829b99be1a8d46b7729ad4464ad1b83adbc88d80efea9036942b5f8940d4e6d0
MD5 9e9d5bb92ee7c493a8c37f9527a99216
SHA1 203917b88ef79846197e9550f9727e4091aa28c5
SHA512 b2eb7e4acba28c8c9d7aa10afd5662752cd00a1283211cc2fce5279736f914207cb503fbe851b44d39299ce9f1114636dc7bc72e619c780b2b3119267c8d46f9
SSDEEP 96:hbJ61d+hDK+UyKovbfaNQYjt1Sl8h4otop5EFDnB6cgGtvUgmKfxeRNC39ISyVNu:htqqDHUgvId5iU2sB/NDmKfxeuCz4v
TLSH
T1C6D10975A42D9C7B5EB2A549B0132D83CDB8602BAD61BE5CEDEA0F0C01E74DC1383563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 e63326c1782c00c4b121423f3c107c460b19eec2cc56fc6bf0e9ad3fae4d7e49
MD5 0d2e70204d613d72fe30baeea5c74a88
SHA1 3ebe87f650f1f3d90be11306fb80021891e6e8df
SHA512 bccbebae9ea92ca134fd9828fa0736edf27dcd1aaffdfbc122813c0907f0fe083210d4c44f0b811d0ccb6cf65e95a1e349880351eb92fb808768e5b26cce943c
SSDEEP 96:hbJ6Bd+hDK+UyKovbfaNQYjt1Sl8h4otop5ETDnB6cPGGfvUgmKfxeRNC39ISyVQ:htKqDHUgvId5iU26B/PvBmKfxeuCz4v
TLSH
T135C10975A42D9C6B5EF2A449B0132D83CDB8602B6D61BE5CE9EA0F0C01E74DC1383563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 3d34765241477b4d9d772fc7508c0fc888f676716c84232afbe0ac63b12923f3
MD5 07cc2458a7c0ca747475e07d700f627b
SHA1 83454a28f2ed7547a8d63c66f0df2e4c42ce87f8
SHA512 c3b8eebd2ea57859bacc8c3c6e107bbbc7c069fbd344e73754d4dbcbe2ab08007b1dee12d02da7dd03056274831adbc4d41feec3c46f51d450cc333e49e3607f
SSDEEP 96:hbJ61d+hDK+UyKovbfaNQYjt1Sl8h4otop5ETDnB6cPGGfvUgmKfxeRNC39ISyVQ:htqqDHUgvId5iU26B/PvBmKfxeuCz4v
TLSH
T112D10975A42D9C7B5EB2A549B0172D83CDB8602BAD61BE5CEDEA0F0C01E74DC1383563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 64542afeeb8145fe2aaefb02b481da01306af64e94b5b5b4912de8d6ee50c65a
MD5 24ce24eef68bebd31a311799c790c293
SHA1 46b3afe51cb1d70a28f3495476fb2488ddd5bd75
SHA512 29289a8ae2e7c47e198073f520dc267c87e30c254405e7ac9db380721924bf98c04dc94691b34d5083c3dc56ed3f9abbb3e940317298bbd1c28de6b987cf9063
SSDEEP 96:hbJ61d+hDK+UyKovbfaNQYjt1Sl8h4otop5EcDnB6cnGovUgmKfxeRNC39ISyVNu:htqqDHUgvId5iU2XB/GmmKfxeuCz4v
TLSH
T19DD10975A42D9C7B5EB2A549B0132D83CDB8602BAD61BE5CEEEA0F0C01E74DC1383563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 00ef3301ed8875ad48a4bd9cc8cdcfecbcfbd8121f2517f27de11b0b2aee0c0b
MD5 98f29dc141701107366643ef4499efaf
SHA1 0eef2a7f356ea66289bfec458e3ef8bf0b99e147
SHA512 7fdd8ed0d13c58466f6af500554ab53eddf5bbdd6ef48dc46d2d217e242efe7b5270570b273fb016d5a4ce4285f563f6205ee28e4dce6d7d8738520771b6eb0f
SSDEEP 96:hbJ6Bd+hDK+UyKovbfaNQYjt1Sl8h4otop5ETDnB6cPGGfvUgIlG1QzbOQxEfxIH:htKqDHUgvId5iU26B/PvBIlTLxEfxIUo
TLSH
T108C14B36B42C9D731DB2D64AF4132E83CDF5606B9A51AE58D6DA0F0D11DB4EC2743523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 cd9c670ba23778688e9d5ee6dd44e22ec9645a05cf68cad250a08399c849a8ac
MD5 f30d67420eef8b5abacfb641a4891e20
SHA1 4263f7f50710f44542d3b08ea7966addbf5a75df
SHA512 459f83ac4e24cebb444430fc9231a7c48b4f318b80d04d439838c9e99b40c9b1bcb10a88983d2cc5c4b42c456f4835c76a99c0eb3c6b4bbb615a78bba293fdcf
SSDEEP 96:hC6Bd+hDK+UyKovbfaNQYjt1Sl8h4otop5ETDnB6cPGGfvUgIlG1QzbOQxEfxI0W:hCKqDHUgvId5iU26B/PvBIlTLxEfxIUo
TLSH
T12FC13B36B46C9D731DB2D50AF4132E83CDF5606B5A51AE58D6DA0F0D11DB4EC2743523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6b6641ff3a12b3544dd6829ba6f125fa2fd72134627e53b535450f18fffa4ab5
MD5 77f61d8e035d70f1aae4107515f27513
SHA1 231b12145adfef830f38706eb8d656aed62538ed
SHA512 bdbff5eba7c5df4095307d468454cb869904ddb8b88637af30f5f3a86011036c01a989537ae433591ceb1aeeb06d544721619cd1946cf105ae8fe3bfd8269537
SSDEEP 96:BC6Bd+hDK+UyKovbfaNQYYeteRDotok5EqDnB6WGyvUU+xsbL/Mmv4a:BCKqDHUgvIdaDUD5BCI+xsbL/N
TLSH
T150A1FA32B46D4D776A76D549F92A2E43DEB46027AA21BE88D9DE0F0C11EB0EC1342613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\activity-stream.contile.json
Size 4KB
SHA256 073ac0c4c569e6b34e48e8d9f2dcb460cd9067a77a819ff028cbb0e8fcfc9f9e
MD5 6f8b0663578f217ec1aa458623787c6c
SHA1 9819ca3026c0dbc64c56d72f9aaca50e57cf86a7
SHA512 040d9e2490d9e8bda3254ce4dc81a61c5ef530fa1990800ca273f589d3fe001d47927a1c65cd2b7d54aa73c8abb639a074a4e162c92aa7991e906bedf5b9ae6d
SSDEEP 96:Thxx8DN4CwNlxuFKYNcpndji6Y6DgxW2A8Lxtol:z+z6xuXI2FwgxW2jxtol
TLSH
T10E91B38F8CF98C830732BBF63C4A3789B11AB10BDDD84A84F7969805C5B585F80DE648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 dfaae23cf77345b77e90125ab6338dc9e092b68da1048a24264f8ac6a7df7edb
MD5 eddf531eed8a1d7f3edd08448f3404c0
SHA1 e315ed47faaf1390deb3353a7e970889e7f2a1fc
SHA512 3eb1d1fd82b7da53cb7c7b4a1b3eda294d6cb87dffa7902985b4cd975e556de29dfd17899bd2652638dce025acac64be8e4b8f17d603f3c2658fbd2e01d291df
SSDEEP 768:kyD59OQ3YJH7h0RlXcM82FAxRh6A7cVUuG2Bym2xqKvwe2XTqFwz5Vl1qn7jLawt:/pQxM82kZPfkdDDXA0on5b
TLSH
T1A4731BE356A9B2FB0FA137C62C0F757B52E64145E7820AC9FCEDDA1C819D750023A5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 330bb83db2569bf94aa63a25f2065945afa3773b01e18ec6cbde5f208ec38f4b
MD5 6fdf92fdbb7aeb70c4befc2ac7735156
SHA1 f97bf5542fb25f7683b901d88a0839251c7eaf31
SHA512 e8f0b853d6df8d27bc42cd4b466f7ac364a5e3f9a6533ac4028bab1e12db8556fd0ee5a41d58d3bddd201e7e0448e841b28310eccf76d3822703d37fc8383803
SSDEEP 384:H9XghOiO024Ygdcs3hk2nhfdDE2Ba/rIVy8e1Py:dX+ZYgdv3hk2nhfS2sDIVy8T
TLSH
T1A9729DBB8F017C592967D585C8AD8379DD05F9ABCBF690A608203449C78432AB0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 b4f4dd9f912abaeb15af04d96ee5c72374f391ca3365251b3f462df704b47971
MD5 096de87dccf7647a00ccb4640b161fbb
SHA1 e8d4b177019e597d4c11ea0f4808b09524aee576
SHA512 fec2bcf24ed86894a4c6629099e7bc5e19d39278f4dc6ccc4e138c38593a1665959f23d7bb717b3e1e8071afb56d223106fe173bd958f0e6acc9f84e0c527dee
SSDEEP 3072:j3l9zuDT6VZ8vqrEmEOSHNuTANGTAuFMgKq:p9S6V6EEOEeANGTPPf
TLSH
T1FDA3AFF7DFA28D3D65FFD429AA82C97EFD262400B3A33405C9632750A2C6B747674648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\_ctypes.pyd
Size 120KB
SHA256 b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
MD5 9b344f8d7ce5b57e397a475847cc5f66
SHA1 aff1ccc2608da022ecc8d0aba65d304fe74cdf71
SHA512 2b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41
SSDEEP 3072:+7u5LnIx1If3yJdXfLIOAYX5BO8NImLPcPZx:+wxfijXfLIO9BO8
TLSH
T147C35C1B2354109AEB63407CC5B35E17DBB1B859172087CF02A4CA9E2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\base_library.zip
Size 1.7MB
SHA256 4ab0deb6a298d14a0f50d55dc6ce5673b6c5320817ec255acf282191642a4576
MD5 ebb4f1a115f0692698b5640869f30853
SHA1 9ba77340a6a32af08899e7f3c97841724dd78c3f
SHA512 3f6ba7d86c9f292344f4ad196f4ae863bf936578dd7cfac7dc4aaf05c2c78e68d5f813c4ed36048b6678451f1717deeb77493d8557ee6778c6a70beb5294d21a
SSDEEP 24576:mQR5pATt7xm4lUKdcubgAnyfbas0iwhpM2dYf9P3sL3TWLdma0uHH7:mQR5pQxmmG+KLgaT
TLSH
T113852B817992B5B7F804F3BA4026090DB328C5F4FB40C75739AFC1A6AF9E6A46D518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\python311.dll
Size 5.5MB
SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
MD5 e2bd5ae53427f193b42d64b8e9bf1943
SHA1 7c317aad8e2b24c08d3b8b3fba16dd537411727f
SHA512 ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036
SSDEEP 98304:AtcGVQE2EKmLX3N1fn/q+VHzMzDPFE+syIqPzlJ0:AtcGVQE2XmLX3ffGzJENyIqH0
TLSH
T121467C22726584A0C97B8076EA2F864BD7B27C505F10CB0B6164B79D2F33B531AEF746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\ucrtbase.dll
Size 987KB
SHA256 b3591e2ba725934a1a659882444b85b186da44d2dddaba3b66587dd3f97364ab
MD5 28647d8fb402416cb1c986894d849c50
SHA1 bf0eaa587001214a4d6e6876b8adfcb49254450b
SHA512 689346b9d9fa2f93a5d50af15eee9cc18ee819c00986dabbdd102126556466adecc412a8c539a8d22239cddccc1c3d3dd5783dff047f593bfd7be761c0ab9b12
SSDEEP 24576:AkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkd:pmZFHhp9v1Io3h0TN3pvkd
TLSH
T1B825AE69F76C0AA9C07BE17CC91B150EE9B23406477096DB03E64BB93E2B7D5163B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 c2f1d102011818d7a4aaa78b8ad0f0dbf3b21d38d19bb12081b876f7ceec952e
MD5 e46dad3071da44e79112bcff2d6da2c6
SHA1 a933ecbb54b18a4fadf08ca6c94c7d1caa1a7c97
SHA512 3014e2bad76e0a6bdb9ee93787c859ac4b57aa22a31054e17686ca5b82a6391e5e267de0bc062a8012804152d1538ed2e9e3d92f26d75ccb48dfeb7956232bb9
SSDEEP 768:GNFZY4v3Gcm+urM7rKibMTVb+bRb6bLb2O1wSs:GNzY4d7rvH
TLSH
T1B6D21184FB1A953FD41952BBDCA607002F79B88A59092F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 0a4015020b05c0b59b1c46695e36defb60f21456313ff60371f5516b4a451e5c
MD5 940bea1fb173e18e3cb7762988fba00a
SHA1 444f5cad97cfc36112708fed11af60406f138375
SHA512 273442a34feddeacfd8be005156205005dec83ca1d22dc1ee38d798b4c43140b4e1f0e97f2a5bc13596c1f8cf6f6aad9ba37338592bc9b26b1b3d2f48c16b84f
SSDEEP 768:j1TNFZY4v3Gcm+urM7rKibMTVb+bRb6bLb2Hfs:hNzY4d7rvk
TLSH
T13FD21184FB1A953FD41952BBDCA607002F78B88A59192F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1fc9f3be67f45e5d0d8cd8aa5767f40ae5ddba0251e7e55d1549afcbe3025284
MD5 5a146a9c402ee7442454d278769d7fc9
SHA1 c21515c044512037a0f26bfe36f21939b44203a2
SHA512 f1f0954fa7723072db7722052da77581c9d591d10a47ef837f377e7df3330af65a57870c0d7716dd96a7413d1d9d07de1ceaa0bb1375b13322bb1bb8ecb378a7
SSDEEP 192:LC1d66JoztdzgCl6mc0dbOv5zbo8bAmyjv7:Yd66Joz/zgC1jqbo8bAmyj
TLSH
T1B4D120A4F628863FC444533BCCA61F404F39395B984E7F19359C65082D9B2EE368D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 137c0e1a2e169f353a8481c3052ee8bdc52e1db9ecfdd55853b4868514ab3d30
MD5 4915a5a8163b73e26223447c617ac846
SHA1 5d6ff8d1b260baac380f2051494b875fac921433
SHA512 093c4a3a84748dc98c89ab5aa75639c5ef509847449ef6a07e0cb29b454371b75109dbc82daa50a570eeaf54a46f7bff26cb8afc1c798e7dfc561816b2e74099
SSDEEP 192:LC1d66JoztdzgCl6mc0dDOv5zbo7KZAmyjv7U:Yd66Joz/zgC1juboeZAmyjw
TLSH
T1ABE10FA4E628867FC404537BDCA61F404F39385B984E7F19759C640C2D9B2DE368E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6242a0b314a058c51f67380c1f52780b37a3b3417d04bfb508793d527531ba9a
MD5 9ea92c8407346053232b94f1a4c4d968
SHA1 e79072ab3f783c27df009dc527d3ddd4007c0e6d
SHA512 3e400dbc0eb271dad8e4a46b2f8d225d8b8e42b3c6115502fdae373cb01b99a5469eeec8db05b3b6e37bb484ac9e1c3e85dcd2fd90b9a2da7885cbc7e3044d37
TLSH
T1E8216A6C39B84D6A5CC7E29C784012CE53998A07088B2E474D12FF8DCEA5EDD327E539
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ffcb103ea335a625d4b749a5e3ae5352d0ee1f237d1c1f51c2672c4a85e38cae
MD5 e2542bf6468563b0edaa090f903dbf37
SHA1 9b4a3121a4563cf09e72501688efeaf2870000e6
SHA512 4e9699ed069417a662d42043fd19a6fb51cc4216617056316a10b1bbc6f44244ca6bde3a79917830f13c826d8a6d7674dd2aff172d2e586df426affc8755396e
TLSH
T1BE217C6C39B94D6A9DCBF29CB84011CE63948E0604872D470E12FF8CDE91ED932BA43C
MD5 SHA1 SHA512 TLSH

Submit Download

1806b067-63bf-491a-af0a-d4cf74d85896

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\1806b067-63bf-491a-af0a-d4cf74d85896
Size 235B
SHA256 c69a281e50645e321c312e03e01a5c06e1fce535c3c766818c78e119a20e099e
MD5 7fe67427448c1927dad4a21857d041a4
SHA1 97b5918387145cbfb9c57f983705aa98369ac2d3
SHA512 1ee835775245c76c38330d0f9aee78eca97b958f9681c4ca32e9fb1a67bbe39add3db97076877cb98029e9ee35b04ddfdf3f43ae9e7ce75d4309c7a0d72e56fb
TLSH
T10CD097A028886B6D08100F23B0E069CB30958C3399B6A810D99004B49DFAAC442A2C4B
MD5 SHA1 SHA512 TLSH

Submit Download

54e14d4d-c7fe-41da-bb3c-0ac8dd87ff66

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\54e14d4d-c7fe-41da-bb3c-0ac8dd87ff66
Size 883B
SHA256 a592450b970daf43ed4595ffc79fe1cf9210dce6afad96247653c73866752477
MD5 efa863b53b19e4d1ba5ddbb5b9c097d7
SHA1 8e56ebdb80729ff3725bb3a0ac3df9e721c3feb0
SHA512 3d43c19eb669882195a3f21715503cae2ef74d0e931897c2862357892552a1bb0660fd24b8e6619cf27c6286d7059307d43c43c8df487d9fe68238f53d68f9a9
TLSH
T1A9114080A624B5F2DC38920FCAA5370187E8742380C655083DB99E080EBF52B939A70B
MD5 SHA1 SHA512 TLSH

Submit Download

6b208f06-c1af-42d7-a164-9c8c4099284d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\6b208f06-c1af-42d7-a164-9c8c4099284d
Size 2KB
SHA256 95d6e6a7a2037663109d5b1f6c8864c8d6103fc0c966f162f69d462d7cf6df7c
MD5 de322a82d71cd9ef8d2f359be4761d60
SHA1 1a4de9544aadcfe67e5e3cdeb9081b94277abc25
SHA512 81884c7ea33ca4700034c671aab417b0897d2b60de54dfdf0090f9935a24c965620e6dab49ef77ef8f921edc5bb14dbd20ba4b27264cad346c8850250aac509a
TLSH
T17C41126C35789CB68CDAF15C9882339D93644A4304C73D871D62EF0C8EA6A6E337E527
MD5 SHA1 SHA512 TLSH

Submit Download

7775f07e-88fa-49ce-8d59-17401e338e30

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\7775f07e-88fa-49ce-8d59-17401e338e30
Size 16KB
SHA256 0f7572131fee047d21856a74d00bef798d94926f6889909252412a21ff627f2d
MD5 1753207b18a89538864018760afa4ecd
SHA1 6b26f54657de0648a82f2c04b351c0e5c5c910b5
SHA512 7298d037f462801136d7bdde73ee9f0b3f91e25ef36ecd0892b672ebbc87389f9d1e43113861fa66411e1a868f5a4da17135c171ef17d02d1bbf61f5d4472b54
SSDEEP 192:sfOwuBonyBsX8ZtNo86icCu5+KcR7iKzaRTWDd119VGsBM6ep6DfkpPb6KwKGVo/:mRYNX6sKcR7iK6TKZqs6wDfAPb6KwXk9
TLSH
T18172C956286056BA8151E36894FCBFC7E2F638CF4C019FCA97E4BD085DEE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a4f5da0-bcbc-49d3-9b30-bec6f1b815dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\8a4f5da0-bcbc-49d3-9b30-bec6f1b815dc
Size 2KB
SHA256 347cfed224b02aaa92abf59ea003e78f959308c008b3727fd00691da95217d01
MD5 64dd05456fbebda80fa4f5835df46325
SHA1 05d9805fe66660587e494ea0219c8b08b9c6873a
SHA512 ef808932fb23af2f5fc442f4e6910a422499848106af84e5883f2d734951ff35baaebfc4b9410462a89261dac7accf5e7c893d89d8e122a015eb4fd6ab84c759
TLSH
T12541335C35789D769C9AF54D8486338E83A19A4304C62C873E52EF0CCE9669E23AA51B
MD5 SHA1 SHA512 TLSH

Submit Download

9de6720f-7dc9-4ac9-a04a-1d59b611d8c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\9de6720f-7dc9-4ac9-a04a-1d59b611d8c5
Size 235B
SHA256 d84b03a0b1f41055620091efa1ec5c908b05550226d6eaf7c8c3436b78244de9
MD5 a9f138ab8bf3abc412dc00c72731da20
SHA1 8ba603935b50622209a417b10cdc9400d6211991
SHA512 5183486c0341f24574655a45202773e2c77f9f4eed3e4ad8446f13c34ca25d1ce525add80ee4f6de5550e0da08523bee47294be70ed10f76b9213c16362ca554
TLSH
T185D0A785E898A75E18244F07F0A16AC670944C33247858A0EA51597899BE9C84156867
MD5 SHA1 SHA512 TLSH

Submit Download

e167df8b-270f-4676-8e83-26f3d4aa4e9a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\e167df8b-270f-4676-8e83-26f3d4aa4e9a
Size 897B
SHA256 106eeac7143a92279975784948fce91d844a43fadd593cf3a3a1c6e38011c199
MD5 a1ebaaf907012dd324b233800483c2ce
SHA1 f6971626c7c305790bfcd4543da38cffb3b9b4ea
SHA512 576a509921d8501e6c05f3f90126321e5ddd5f221204ffa6ace29cfa4bd405b83a2f9ed0e826ae3d97dcd9c3abe3db9a4e124887aed0582506e82ee09924829c
TLSH
T1411144919628B5F1CD38D24B8991BB5287F4302380C65A087E645E080EEB42B935A70B
MD5 SHA1 SHA512 TLSH

Submit Download

e686505b-79df-4e0a-a9db-e139f48a701a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\e686505b-79df-4e0a-a9db-e139f48a701a
Size 235B
SHA256 1bd16ed90afba4b985eb0d90b78e72d09afe631ef6855ad466d24790fe65941a
MD5 e7c79c06de13d01ab7586c131b4db0be
SHA1 0981ce88a596d203e15722a81ea85257dadd8761
SHA512 d4a8f13081c052f66b067603a8abae50e2de7d1b6db5137a88e49d2c8f62e416c033b53b802ee170f559ecc3393c9a93307317e238e9b90fe409d53f38ed73d7
TLSH
T168D0978414A863AC88040F8AB2E02CC731984C33247498148A6215348AFD9CA421280B
MD5 SHA1 SHA512 TLSH

Submit Download

ec1c723c-957f-4898-bfb0-aae83b696813

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\ec1c723c-957f-4898-bfb0-aae83b696813
Size 886B
SHA256 0310c8c2441f2f1fa3cec9c09988105d88e17875e1111c4c5de5bec437db6158
MD5 71dc8cac824ee9b1f7e48111611f769c
SHA1 8b3d52025d5eb4651e6faa89b477c1248403a0dc
SHA512 1f3e784d561be3aab7bee6b737535c8a1db24a6a6ee27cf0e395122a3c069091b748de7074e63727f87d4bf4abad6f84cdc32c0ed0ecd2c78ca15dbf0ee48572
TLSH
T1591104905A29B9F2CD75D34B8D91775187F4702380C669082D695E180EEA52F635A70B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 7ea20f2f04f8ff4cc26fdb24956fbc9eb6f6751aa364b4da64e7b94b9f50e2d6
MD5 735e4d9b337c3a5919c8f0305db141d8
SHA1 81055f6255befa0e44ea73dc201f4df6db6e44f1
SHA512 b950450997aa804cb6e6ab8334f898eb8a4b54afcece2a185c03cb2e8767dd2308fd0db81b0b11ac0048f319effaee3f91b0cd5369074b03075d1b717761069d
SSDEEP 96:xHSUTUNqGq1DfGBNObzSzSSlvdv9jcXnNeRHIcSqZJghBw8Ou8L4cn1VsAx:cgR1DfGBNRSSCQ9IjzBw8Oj9
TLSH
T15FE1107894088FBF64B6776CAC6889316AB2013B7BBF68C710B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 fec489b2ef1fac6b3c394f87ba80bd74669277936605e5727dd983c8b049bde4
MD5 9af659c2577cc317601362ddea8bcb7c
SHA1 1aeede5956c25655341aac54bfa180dd37094540
SHA512 41030594d12b123cef9d066116cde664cdbc6617e87c5d8ec57877a814e9d30949d0c73c4d3bbbe488f99f88db53a8fe4eb49cfb2e06e9fbf8e82232bced02db
SSDEEP 96:xHSUTUNqGq1DfGBN1zSzSSlvdv9jcXnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGBN6SSCQ9IjzBw88jM
TLSH
T1F8E12F7894088FBF74B6776CAC688D316AB2013BBBBF68D610B55484055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 00c3549a9459560d41c80462cbbd19bd2f598b1fe66ba8ff83729091b40cd852
MD5 fbddaf8eea99e38559f0dc2485cad974
SHA1 e109cf2582a5af6152caf51aa0eb533074465d2f
SHA512 989f05d302374f487446ec9a7a6c26204c2db66a9aa94ef540670807fd5a0904494023f5deed60c89d5f3a36fcbbaefef0d09fba6809ca8865ffae7755c730ad
SSDEEP 96:xHSUTUNqGq1DfGBNObzSWSSlvdv9jqnNeRHIcSqZJghBw88u8L4cn1VsAx:cgR1DfGBN0SS19IjzBw88j9
TLSH
T1B7E12F7890088FBF64B6776CAC6888316AB2013BBBBF68D710B554C4055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 409156fdc9c6e4a8b17d300e34d464ac5a9a368eed831be13e9580d4f322c735
MD5 1302adbc2a926dc276219f26c1ac1375
SHA1 549fcb25c4221886e33db0fda4038ebe1118a1ca
SHA512 4f3b4247c2d2857dbd4abc5ca0d3d61131641da0d374cc1e571f37c3792f324ee711bde4ca5ef88410f780e3c1c4a3fa0b45ca16e6d44ec0544ed546adc8c86b
SSDEEP 96:xHSUTUNqGq1DfG45G1zSHSSlvdv9jMnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45G6SS/9IjzBw88jM
TLSH
T1B1E11F789408CF7F74B6776CAC6888316AB2013BBBBF68D650B55484054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

Catapillar.E.zip

Path C:\Users\Admin\Downloads\Catapillar.E.zip
Size 960B
SHA256 451ccc58579faeb461d8900e3cf9c6a3bc412abaf2cb7a23ea0ae528fa0889f6
MD5 910c2d354eff59b037b957f2a7262992
SHA1 67d66f43911aafeac05bd7a8730311a2191bbdc3
SHA512 a65b6f09b329be15ea0650ede0370c70f7cee6695e3ff9221eb0e3e44fddeb8b1979e42f4e623756a5d09ec00e9691b72a82896d0dccaf9578fb7b673ebd50a0
TLSH
T1CB115052A806C176C26D09F4FD3E9A859B600ACAC7722EA4829C640BED230B81B81B58
MD5 SHA1 SHA512 TLSH

Submit Download

Ransomware.Jigsaw.zip

Path C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip
Size 239KB
SHA256 86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff
MD5 3ad6374a3558149d09d74e6af72344e3
SHA1 e7be9f22578027fc0b6ddb94c09b245ee8ce1620
SHA512 21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720
SSDEEP 3072:p7ykj3uuY4NsJD7kPdSRQLqas/pkPm9jvkEL60Uf7k2BgS6/aFybrNN5ZAdNstk7:p7ym3VNA7w8R5/rxv7O0yng0UtVw5NJ
TLSH
T1263423121BD13B4CDD6F7C19DCCFA43DD3B62D4DE08A069979AA990E0E0E0A1E9F1D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ransomware.TeslaCrypt.zip

Path C:\Users\Admin\Downloads\Ransomware.TeslaCrypt.zip
Size 479KB
SHA256 3b246faa7e4b2a8550aa619f4da893db83721aacf62b46e5863644a5249aa87e
MD5 f755a44bbb97e9ba70bf38f1bdc67722
SHA1 f70331eb64fd893047f263623ffb1e74e6fe4187
SHA512 f8ce666ae273e6c5cd57447189a8cf0e53c7704cf269fa120068f21e6faf6c89e2e75f37aee43cac83f4534790c5c6f1827621684034ef3eb7e94d7ee1ac365e
SSDEEP 6144:xQAq0svy/pQhk1NBePvxGNWeOyqYAGfr/H/h60BHtzbprAvNGTG/fi5QCIq3h11Z:LyKoUlWeOP8HXrINZ/2uJUgVu
TLSH
T1EFA4233DB4A231B8A9F131B479DC1E44C93596C9B73895AC0B390EED55FAA31F00A793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 169659.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 169659.crdownload
Size 7.5MB
SHA256 a11dc79535b89bf6db1760d9a48bda788d6987b6c0a7091e5f4d09cc376b1c1e
MD5 8acdb9d6da888d73386a97f460e3e343
SHA1 34ec30b7b273ce9ca28a5254cfc79d728134baa6
SHA512 aee751de460898c7c598d60a85d37de6b211a78b49c4ccf9b5ecb19ceb5e1c0e64ffd746b850a663b6813b50d11f2f3f313275626d7da95810cce085bd734d4d
SSDEEP 196608:PIY0O7K10DfyGR21X5Sp6GemDMPwyr2RiWDYPnkR:wY0l10DfDspfaMPL+bT
TLSH
T1AA86337162B11EF9E8B7803EC5C496449762B07703A9EA8F4371425B0F1BFA66D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kAI6zDzW.part

Path C:\Users\Admin\Downloads\kAI6zDzW.part
Size 6KB
SHA256 bd1b18e42f0d7e5f7677acde98d789c80bd323eb6103cf3bf48339ff3d0084e8
MD5 ff06b213ccc569eea317e99272dd30da
SHA1 673d5e25f012013dcb8a6a9a6dc307f649d17f4f
SHA512 cfad0b3eeb6c5a0ef9eea477ad896de03299e9aad45c13cbbb4defb4946dbe8bb2fe83bf5fddb69708b4575c63770c656eea4570a1f8ad31de938b65eb98d7a1
SSDEEP 6:VWilXP4w98el5UG/lpX06XkEslX/9ldlXSPnrtHP8//ktLERulXSPnrtHP8//k:QiVGeYGt509EEX/HnXw6XAERqXw6X
TLSH
T180C11257930465AAC47E2B711DE38B206BAED471A6B2834F1A00026D2C373541F72F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2192-3132-0x00007FF806A60000-0x00007FF806A70000-memory.dmp

Download

memory/2192-3131-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download

memory/2192-3130-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download

memory/2192-3128-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download

memory/2192-3129-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download

memory/2192-3127-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download

memory/2192-3133-0x00007FF806A60000-0x00007FF806A70000-memory.dmp

Download

memory/2192-3155-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download

memory/2192-3154-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download

memory/2192-3153-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download

memory/2192-3152-0x00007FF809000000-0x00007FF809010000-memory.dmp

Download