b017b2713cc3de62d13489f154f52b20186b71bfb7a6fc0abd96e4b146ca57ec

Analysis

user interaction
yes
max time kernel
900s
max time network
465s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gladius_launcher.exe
Size 23.5MB
Sample260721-src2lsyfrc
SHA256 b017b2713cc3de62d13489f154f52b20186b71bfb7a6fc0abd96e4b146ca57ec
MD5 f105fc5dcf93c3c5e26ef7af8fbc2589
SHA1 5cfca0d7962e3e74c89805c719a9f2424a2fc3cf
SHA512 2b51cfa85d2813d5b0786fd74d23f9722f31461ec6270d6a7f28c2ee4ba66e4ddabba33892ad557b7360c75f5d7f9824185143b2daa7ae3730952e230a97641a
SSDEEP 393216:TLxAeQhES5hbd7AcHeI2rhtg2VZm8nkc1tr:T9AUSbhChT53mO
TLSH
T1B0478D47F49215E8C1AEE1308276A673BA717C9917246BE70B90F7342F36BD06EB6710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8104	6424	WerFault.exe	170

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5420	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291209770265174"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{4152A964-FD27-41B4-95BB-A92A1998E3F3}	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1976	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6284	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
7536	mspaint.exe
7536	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe
Token: SeShutdownPrivilege	5888	chrome.exe
Token: SeCreatePagefilePrivilege	5888	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
6424	wmplayer.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe
5888	chrome.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1752	Gladius_launcher.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
6284	EXCEL.EXE
7536	mspaint.exe
7536	mspaint.exe
7536	mspaint.exe
7536	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1976	1752	Gladius_launcher.exe	89
PID 5888 wrote to memory of 2092	5888	chrome.exe	93
PID 5888 wrote to memory of 5420	5888	chrome.exe	94
PID 5888 wrote to memory of 3844	5888	chrome.exe	95
PID 5888 wrote to memory of 3844	5888	chrome.exe	95
PID 5888 wrote to memory of 5740	5888	chrome.exe	97
PID 5888 wrote to memory of 5740	5888	chrome.exe	97
PID 5888 wrote to memory of 4208	5888	chrome.exe	98
PID 5888 wrote to memory of 2588	5888	chrome.exe	99
PID 5888 wrote to memory of 4208	5888	chrome.exe	98
PID 5888 wrote to memory of 2588	5888	chrome.exe	99
PID 5888 wrote to memory of 796	5888	chrome.exe	100
PID 5888 wrote to memory of 796	5888	chrome.exe	100
PID 5888 wrote to memory of 2536	5888	chrome.exe	101
PID 5888 wrote to memory of 2536	5888	chrome.exe	101
PID 5888 wrote to memory of 3728	5888	chrome.exe	102
PID 5888 wrote to memory of 5156	5888	chrome.exe	103
PID 5888 wrote to memory of 5156	5888	chrome.exe	103
PID 5888 wrote to memory of 1232	5888	chrome.exe	104
PID 5888 wrote to memory of 1232	5888	chrome.exe	104
PID 5888 wrote to memory of 1936	5888	chrome.exe	108
PID 5888 wrote to memory of 2996	5888	chrome.exe	109
PID 5888 wrote to memory of 1936	5888	chrome.exe	108
PID 5888 wrote to memory of 2996	5888	chrome.exe	109
PID 5888 wrote to memory of 1096	5888	chrome.exe	110
PID 5888 wrote to memory of 1096	5888	chrome.exe	110
PID 5888 wrote to memory of 5020	5888	chrome.exe	111
PID 5888 wrote to memory of 5020	5888	chrome.exe	111
PID 5888 wrote to memory of 3332	5888	chrome.exe	112
PID 5888 wrote to memory of 3332	5888	chrome.exe	112
PID 5888 wrote to memory of 4060	5888	chrome.exe	113
PID 5888 wrote to memory of 4060	5888	chrome.exe	113
PID 5888 wrote to memory of 2716	5888	chrome.exe	114
PID 5888 wrote to memory of 2716	5888	chrome.exe	114
PID 5888 wrote to memory of 5528	5888	chrome.exe	115
PID 5888 wrote to memory of 5528	5888	chrome.exe	115
PID 5888 wrote to memory of 4828	5888	chrome.exe	116
PID 5888 wrote to memory of 4828	5888	chrome.exe	116
PID 5888 wrote to memory of 3236	5888	chrome.exe	117
PID 5888 wrote to memory of 1156	5888	chrome.exe	118
PID 5888 wrote to memory of 3236	5888	chrome.exe	117
PID 5888 wrote to memory of 1156	5888	chrome.exe	118
PID 5888 wrote to memory of 2036	5888	chrome.exe	119
PID 5888 wrote to memory of 2036	5888	chrome.exe	119
PID 5888 wrote to memory of 1344	5888	chrome.exe	120
PID 5888 wrote to memory of 1340	5888	chrome.exe	121
PID 5888 wrote to memory of 2664	5888	chrome.exe	122
PID 5888 wrote to memory of 620	5888	chrome.exe	123
PID 5888 wrote to memory of 620	5888	chrome.exe	123
PID 5888 wrote to memory of 4240	5888	chrome.exe	124
PID 5888 wrote to memory of 4240	5888	chrome.exe	124
PID 5888 wrote to memory of 4560	5888	chrome.exe	125
PID 5888 wrote to memory of 4128	5888	chrome.exe	126
PID 5888 wrote to memory of 4128	5888	chrome.exe	126
PID 5888 wrote to memory of 2232	5888	chrome.exe	127
PID 5888 wrote to memory of 2232	5888	chrome.exe	127
PID 1264 wrote to memory of 4520	1264	firefox.exe	129
PID 1264 wrote to memory of 4520	1264	firefox.exe	129
PID 4520 wrote to memory of 1284	4520	firefox.exe	130
PID 4520 wrote to memory of 1284	4520	firefox.exe	130
PID 4520 wrote to memory of 1284	4520	firefox.exe	130
PID 4520 wrote to memory of 5068	4520	firefox.exe	131
PID 4520 wrote to memory of 5068	4520	firefox.exe	131
PID 4520 wrote to memory of 5068	4520	firefox.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Gladius_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Gladius_launcher.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:1976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb48bdc728,0x7ffb48bdc734,0x7ffb48bdc740
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,3769897008345003268,4190542731192693470,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,7022281515552686878,13924892004350094453,262144 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,2623640184789832292,9527697293300010054,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:13
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,8596596981338351391,3640565272139998435,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,2452690587949698684,4889645357865852179,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,6693458085552207889,6108842391558033022,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,1706770882068923018,17064779441889782589,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,13228252781679559651,14332871861065985136,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5472,i,12226285592911477954,14162298776532339609,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,17659379974781829839,8383370727507890756,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,5816511940984637163,14136603697552555599,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5800,i,5326292771347082715,10475302049314710258,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5572,i,8541409835695671623,16807505792162962709,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6216,i,8143446090584187349,9192013587989192658,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,8308468398029996803,18192029473886477280,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6492,i,7574816532926633591,7711981868136208028,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5796,i,11087716241222971366,6136101697837241941,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6600,i,839244945652187527,652808868964221668,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,13741991511173694085,9188975232032443016,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5420,i,16238460660765938058,12647414866445256749,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6284,i,14849386792393890955,2854847366812535091,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:9
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4708,i,16456635867972030005,1259904724772179771,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,2429356703388454891,2587440441713967294,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,11043126385349112010,4844162753689255338,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,13252388704731409602,9917999717183667653,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6104,i,14394578681174308402,15878185977443038994,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5504,i,1695096180296167396,6914334470083456440,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3420,i,1590478390755007078,10091401318868673072,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,10847343781382576042,10300563705926920751,524288 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:12
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5500,i,5417343786817685550,5960230898137314388,2097152 --field-trial-handle=2044,i,18217146200464099229,13483545743538766305,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 26983 -prefMapHandle 1972 -prefMapSize 270110 -ipcHandle 1908 -initialChannelId {b6168ad8-6bf4-4cc3-ab8c-e9dd5bf2c4c7} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27019 -prefMapHandle 2420 -prefMapSize 270110 -ipcHandle 2428 -initialChannelId {c836d9dd-3940-4d05-a10c-717f1e4de9f7} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4000 -prefsLen 27160 -prefMapHandle 4004 -prefMapSize 270110 -jsInitHandle 4008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4016 -initialChannelId {dcdab617-74ce-4b99-9697-260b2f370c87} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4156 -prefsLen 27160 -prefMapHandle 4160 -prefMapSize 270110 -ipcHandle 4216 -initialChannelId {5a290942-c8c5-4a49-96d6-0c34b5b7b857} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3004 -prefsLen 34781 -prefMapHandle 3008 -prefMapSize 270110 -jsInitHandle 1268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3256 -initialChannelId {5ec5e395-5e37-4312-80ae-d55182c8d4ba} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:6108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 34907 -prefMapHandle 5016 -prefMapSize 270110 -ipcHandle 5024 -initialChannelId {935675b9-b299-4b72-8276-40e1eaa4885a} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32938 -prefMapHandle 5236 -prefMapSize 270110 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {f0439d5b-5857-4cfa-b62f-0cf912217cde} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:1860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5444 -prefsLen 33041 -prefMapHandle 5448 -prefMapSize 270110 -jsInitHandle 5452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {bf54fa21-e541-42f5-b306-cc4e82a8693b} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 33041 -prefMapHandle 5712 -prefMapSize 270110 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {20bb47c7-6e01-4c79-bfe8-47bc401dfca5} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4644 -prefsLen 33212 -prefMapHandle 4640 -prefMapSize 270110 -jsInitHandle 3168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1072 -initialChannelId {26f4281b-6afa-458c-93d7-6ac1f7e373ab} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3216 -prefsLen 36161 -prefMapHandle 2640 -prefMapSize 270110 -jsInitHandle 6244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6844 -initialChannelId {a431442d-dcea-4804-9d64-53adef077014} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7016 -prefsLen 36229 -prefMapHandle 7024 -prefMapSize 270110 -jsInitHandle 7028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7052 -initialChannelId {3b41c9a6-73a0-4aab-8875-d1a067f9c8a6} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6264 -prefsLen 36358 -prefMapHandle 7008 -prefMapSize 270110 -jsInitHandle 6940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6936 -initialChannelId {bd933173-d528-42e7-b743-131ffdb2e2e6} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:3268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7152 -prefsLen 39752 -prefMapHandle 6836 -prefMapSize 270110 -ipcHandle 7364 -initialChannelId {195da30a-eac8-41f5-88f4-a09145e6c75a} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:5420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8580 -prefsLen 37029 -prefMapHandle 8760 -prefMapSize 270110 -jsInitHandle 8764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8772 -initialChannelId {3c878b94-0182-4946-8579-b18ab47c4cca} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5944 -prefsLen 37029 -prefMapHandle 5916 -prefMapSize 270110 -jsInitHandle 5920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5688 -initialChannelId {67ca8b29-6b2c-4b2a-aa34-08036e9d666d} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7408 -prefsLen 37029 -prefMapHandle 7192 -prefMapSize 270110 -jsInitHandle 7188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5944 -initialChannelId {3b23fda7-803e-4700-8ea9-cd4cc768032e} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6972 -prefsLen 37029 -prefMapHandle 4708 -prefMapSize 270110 -jsInitHandle 7268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7156 -initialChannelId {688cb3c6-dba6-4d21-ba0f-5457942af95a} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:3016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9632 -prefsLen 37029 -prefMapHandle 9636 -prefMapSize 270110 -jsInitHandle 9640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9648 -initialChannelId {2df7890c-5c42-4665-b2dd-1d1dc7edbac8} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9496 -prefsLen 37029 -prefMapHandle 9500 -prefMapSize 270110 -jsInitHandle 7244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7156 -initialChannelId {63738177-c6de-4bc2-87fd-e028686d720a} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10140 -prefsLen 37029 -prefMapHandle 10144 -prefMapSize 270110 -jsInitHandle 10148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10088 -initialChannelId {417e269b-d4dc-4880-b6d8-e6d07ffcef41} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:6420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10440 -prefsLen 37029 -prefMapHandle 10444 -prefMapSize 270110 -jsInitHandle 10448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10456 -initialChannelId {2f99ff4f-6b40-478d-9f4e-a6edf023eb72} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:6640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10652 -prefsLen 37029 -prefMapHandle 10656 -prefMapSize 270110 -jsInitHandle 10660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10672 -initialChannelId {05d37e55-3630-4541-8a32-66d388ad8206} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10872 -prefsLen 37029 -prefMapHandle 10876 -prefMapSize 270110 -jsInitHandle 10880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10888 -initialChannelId {de81dbc6-1ad1-40e3-aaa8-3c6745329179} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:6660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9496 -prefsLen 37029 -prefMapHandle 9500 -prefMapSize 270110 -jsInitHandle 7156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10560 -initialChannelId {8b9f6d80-351d-4b48-b3e9-f6dd88121819} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:6248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10356 -prefsLen 37029 -prefMapHandle 10604 -prefMapSize 270110 -jsInitHandle 10324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9500 -initialChannelId {24815fdf-87a2-42b5-a3b3-f13d2adf62a9} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:6260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11324 -prefsLen 37029 -prefMapHandle 11320 -prefMapSize 270110 -jsInitHandle 11316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9868 -initialChannelId {cf4b494a-1626-47b5-ba34-7f54057f5195} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:6352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11540 -prefsLen 37029 -prefMapHandle 11544 -prefMapSize 270110 -jsInitHandle 11548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11344 -initialChannelId {ba9b005e-5673-4f38-b8bc-1724f7e39f16} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:6392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11636 -prefsLen 37029 -prefMapHandle 11632 -prefMapSize 270110 -jsInitHandle 11696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11712 -initialChannelId {733e54b8-03a4-4157-820e-45c41733c3e7} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:6468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6868 -prefsLen 37029 -prefMapHandle 6872 -prefMapSize 270110 -jsInitHandle 6876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11744 -initialChannelId {2a36df3a-66ae-491c-a8a9-24c395d1b175} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:3268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12140 -prefsLen 37029 -prefMapHandle 12144 -prefMapSize 270110 -jsInitHandle 12148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12008 -initialChannelId {d68ab848-dacc-4161-bd06-1dc4e6a5c35f} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:1016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12280 -prefsLen 37029 -prefMapHandle 12276 -prefMapSize 270110 -jsInitHandle 12272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12348 -initialChannelId {690008ec-5499-4e6b-94f1-0e10a218bbb7} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    - Checks processor information in registry
    PID:6816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10592 -prefsLen 37029 -prefMapHandle 9608 -prefMapSize 270110 -jsInitHandle 9876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {cce816df-08fb-4383-8c48-1b03e46893f9} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    - Checks processor information in registry
    PID:7972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12612 -prefsLen 37029 -prefMapHandle 12616 -prefMapSize 270110 -jsInitHandle 12620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12628 -initialChannelId {0ebe1a9d-9be7-44d8-97f2-bdbb6fc4f82b} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    - Checks processor information in registry
    PID:7980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12836 -prefsLen 37029 -prefMapHandle 12840 -prefMapSize 270110 -jsInitHandle 12844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12852 -initialChannelId {0146db9f-02a7-4e8c-bdfc-e8f9d27e2b0c} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
    3⤵
    - Checks processor information in registry
    PID:7988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12652 -prefsLen 37029 -prefMapHandle 12640 -prefMapSize 270110 -jsInitHandle 12744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4868 -initialChannelId {a1065bc0-e8d5-4793-be45-d86b20c1e03a} -parentPid 4520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4520" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
    3⤵
    - Checks processor information in registry
    PID:7572

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\CheckpointOpen.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6284

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:6424
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6476
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    PID:7036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 1192
  2⤵
  - Program crash
  PID:8104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 6424 -ip 6424
1⤵
PID:7424

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RestartSuspend.dib"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:7536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:8016

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ec99a8dd34d20ce49ebcde5d9e0724b11515559eb4454a2ec26acc7ceac96160
MD5 d937f3c78258a584257517d2845052b8
SHA1 e05c961d0df474e12adbd076683cadeecb41849c
SHA512 816e1f67216995e9b6257b2a87085db15aed25948af366d0c36b9aed17db19fea94f898386d8485d0750dfc73251a6151816cb5ed3ca890274020400125fdf47
TLSH
T16641EB86ADF3A422CB74237004AD9D3330437AADF614F6356201AA7C101297973777BB
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 61483e202a9d56a935f4437505fd42378de72b74ef40f2a166f2285b244c6cbe
MD5 aa5fd0c39c434020a13767bc55263abd
SHA1 4f3a2670b3ede958e30f6b552e1db794f4506a2f
SHA512 94535f44140faf6a653d741d8c3dfed46317415048d55c258b83e4a3b4e23a4413cfab99074790bb94b1b9ce2a7c3680b2cfe6f70f54d36e89dcfabc2d3c6ed5
SSDEEP 192:D+Z6NGf3lNjHHD6JGe4JoJnIY92ZBUtKEUaPGmUDrFI0GIv/SICAfPP1BNPLgIUs:D+Z6NGf3lNjHHD6JGe4JoJnIy2ZBUtKD
TLSH
T1D1327CF7C3D8C62D881156F49B25BF1FCE2E1A18532C3D2688D9AE4B93E2871D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 a7aaff55876b4024f2f7d5a854dfa45c3c35150bca2486f1f37c09fc9c6ca888
MD5 0416b0f26a9b690f9c7bb3d24016ee1e
SHA1 a433a94ab344102920cf4ba9d931565a163394c7
SHA512 29e700170c04f0fe9f080b7089c065270fdc97a19cfd70cef738cb814c86bc7b56ed5b795632f23b376b999c2b9c83f6c59743b4f46c6c071b89710877972fea
TLSH
T13A017057E5BEB46B50795D5A0E04790D79B568311581B4F9CF9A426DF0C1DB30B42412
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 958a8a1d73864ce291b1b293ccdda8de822881f129a4ca0077d3c8113031085b
MD5 e2f17922931e2a9404607b6fb1c93d23
SHA1 7ee9bf81df187df4b0a1df96abfaed77bba25640
SHA512 439b1530c6f90779e238b97409162b9147ae39010bb635a30978863029557324b91343de1b42a7458c5ceccf1bff4c1bf8d0b19054d956b12fd63ed60d52edb4
SSDEEP 192:WRTKcBXF7CDv7cTuPRpS/Hm9pHsb+WNn1T4lDYSFIwEkwz/x+VyIsnAUgE:WRTKmXFe7nXrTwZSYSSDx2E
TLSH
T12E42A56FFD506A3B6DCFD22AF9657B53E2F4102162942E84E6FC8A2C14E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 35f1fadf11586d124a83030d020d968a6d6121ce1acb2e6436ef6163fd2dc07f
MD5 83ed6fd6a95116b4bc3379e200bd35a6
SHA1 933dd0fdae2d183726b0e698eccde0b5d9cf2c0d
SHA512 adca531b56e6acb92ebbef604210c021c0ecc75318e6b03cbd42b1c5991770bfe96c453fefbc7ab4bd44dc34b6506353a4de70e1f8358516f09d82e19d9bc467
SSDEEP 192:WRTKF7cVv7+TAPRp2O9pHsb+WNn1T0sIwEkwzGx+VyIsnAUge:WRTKF4l3XtTwZ0Bix2e
TLSH
T12632B56FBD54693B6CCFD22AFA657753E7F5102162942E84E6FC8A2C24E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1dd880110e74fea5c9638afcc8f7ad28f2ec0c3b54edebfd28631deabbca87a4
MD5 c5bc5bac41751f0f36472f21b0af65b1
SHA1 0527560f440d9ec4163f73468110eddd051309bc
SHA512 c117af3add14333a67b83979038e0a8aa5901dbafdf396817fc788d9a59ceffab7304924b2ae8423c6127ba6b04e2387aaca14dbf3e5d9685675baa2df073cbb
SSDEEP 192:WRTKF7CVv7+TAPRp2/769pHsb+WNn1T4M62HIwEkwzGx+VyIsnAUge:WRTKFel3XfTwZW2Eix2e
TLSH
T11342A46FAD646A3B6DCFD21AFA657753E7F5002162942E84E6FC8A2C14E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 452d113fd0c77386555599e91c0301ec1b1d4725925b81b77d7be853aab435be
MD5 15a7086f2c0af1a7296bc528ab064a48
SHA1 c86b81bf5554efd1804ef39df8c6247d376295b2
SHA512 e1fddb93100088fcc86bfc3327503821b8f1ad06fba90ca3477f1f187a2070452307bdecaa4e96a4d0cbbf86f627eccbe60e3f03660a34dd28690b2c6dbec3a8
SSDEEP 192:WRTKcBzF7CVv7+TAPRp2/4O9pHsb+WNn1T42Ee7IwEkwzrx+VyIsnAUgE:WRTKmzFel3X+TwZ+e4vx2E
TLSH
T1D842B56FBD546A3B6DCFD21AFA667753E3F5102162942E84E6FC8A2C11E79CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f60638960cd752685354f3f78437865010612e97b7475834822c14040f709c63
MD5 b683eed62f047f703433043571727132
SHA1 8e03c75c92b9a5f29ab78342b908851d8248ca6e
SHA512 df56e48b9517ecc6110e94c695d059c7c17d0fe5666fb61d9c562c148841b676393d4b0ef2dd1c854588ae2a536ba17dc43c5ab04348dbed9d5772c16e85d979
SSDEEP 192:WRTKcBzF7CVv7cTAPRp2/4O9pHsb+WNn1T4lDYcIwEkwzrx+VyIsnAUgE:WRTKmzFelBX+TwZSYxvx2E
TLSH
T16942A66FBD546A3B6DCFD21AF9667753E3F5102162942E84E6FC8A2C10E79CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 9ec2be2ccfc0a7978f49246a3a85d1f68c3c922c48443f096e77e6dcf15ba3d8
MD5 c33a33f30c36a89939297f9da5e8aba1
SHA1 2d8b61ed5db65eadd4561a8d71f8626e317a7e15
SHA512 8ce39da0f42eac86be2afff56bf8434670d28a39ebf6d47e3523f93240e7a7b83478a0863b7a78db6daf29928c83eb5da9b4c250756813c4a38da400fbd5cfee
SSDEEP 384:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLtXODEL+ErU3mFHGqnSx7L:uIEn7KxkXqKf/pUZNCgVLH2Hfgs9JOw2
TLSH
T1ED520967684D9A7F0FC8D54CDC577F4FACB5015B66A8482857FA9C0803A9BCB120A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 43e9b11654eff98fd78e3e482dff282a453bb3f54b7e4d9525f05432c5f9456b
MD5 42d242055539e9612a68e6b426b10c77
SHA1 e5d1b25b5b62652528f997902c559e7deb0c9648
SHA512 2b807f6358691252af6b99c8dd4bc9d5478704553dacf48d3a8fa7a6a47669d789d3292670cd8e340b472a1757ad386c384103e3955a88a2934c5a7d15f5864b
TLSH
T152B011280AC2CA22C800A3B8B3A208ACB3002A0023002AAB828080A0A82288A8800A00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 549a7b08de5258297c4fe8286943ce8a7b5a812dbd783876d8e12cd16b975326
MD5 32a01daebe2a705444429685a607bda1
SHA1 8fa796ed7458ab456e9741a9af58175c6d3551ef
SHA512 a4bd274e94b797745839c24b7fe85c6f8cf6d56e540daf92c48529a373fa6f13592374d69823a5e18ac9ec9ca2bb947ce5638939de5cd6eae9caa6b019001aac
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 613fe629dd42811003ca1d9085ca8f327e95cc5cb8c22eca8fcdbd05665ed559
MD5 544dea5db36cd85d6ae90c586e4d9a31
SHA1 5f791ab9b50957fa5b9dda3d1fb442109ad5720a
SHA512 1b812bfc231a1b15dc4d3a1af0d9afaa7f36f911ade1197b55061a28fff86b538f87affe6654b4c75255b007a05320e27a30c4a4cde829a461daa951b3f617b9
TLSH
T16AA0025251E91813FD3883B96463579573634D2D1A61A31354A10584C85B1C04231120
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5af86b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5af86b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 157B
SHA256 25ed3e41d5a9da596d8ed3fab9869e06e85a7d60170388957a28a72c34c0abef
MD5 05846fcf52c4ba8c729303cce298e59f
SHA1 9367ec67bff20d4b6d105c74bf6a5286fa4c4b55
SHA512 20a300e96d62a96971cfc722f4807dd9d95264d41b7baa1c542c7cbfe54eb0f6b3c6aa6c95938d43e6348b16ca9f8263cb5a4219997c8fead84e2cb8425b84c0
TLSH
T14AC02BE3151045AB0F30A9E53038B14CE62BCC4C4CC0CCFC814E30032178B33C901938
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 090f3ba554914254b68e9606725f84737ec879270a21678c3284776353d3361d
MD5 e5835fa1561c6eb04c7e9d51db653a6c
SHA1 86e826951ce14c2cbd373ab727458e6da7ce91c3
SHA512 7df961426fbd86a8521a49b693bd7f155566b396da705c1f2bfded160480057936859a27ad7875aa68a749d7cdf6a97d7d90f134861922cc689ef13aefb7ef75
TLSH
T17FC02BF3150089AF0F34FDE83028B11CE61BC14C4CC0CCFC814800031574B338802938
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 8f441e76f33f017cab5079f674728cedd57895b13383c71c675a1af5f8e70ac4
MD5 1e339eb2f1e53989c2aaa411643d958c
SHA1 df02551467ce04c41eef1de7f06d68976f206bfe
SHA512 36446ff11b2c8bf8569bb2c55809b49fbcd2ba4ea82ab51d3d1fe340c676829421cc8905b79c102d3434f2af72625ba00e6f848fa06f9afeed46c7348c8d5d63
SSDEEP 3072:EtZoY1HfXsQ+rNaN1HGd+zGYpwpxBZz0iuK2/LlTno:/YNXsQ+xa+d+pyBZILKOLlTno
TLSH
T1E6C312FE651D8F5366A9CE08B68F131D2AF45743D9C6D39AA3F137402606D446F8702A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 64c5ed31706f4d2251d16c035fc33ae04b4db4a74832ab85cb77c04a9e532c91
MD5 dcff1a8a129683e1faa598fee6b12212
SHA1 032c561111057ea5f656ee80b0277c9fcc04b7ec
SHA512 852b202cf85c767bce23d0861111bc2e8a870e995c6742dd5fe4e756dc228dc627a786c61f81b8fa2b18b097c119ecb96cef0302635a9294413eedb83e9b827a
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5EVDUB6JGyvTNm6zji+PEhiv4a:mC0Nr7OJRPrL9/EtDUDuY9Imgji+shM
TLSH
T163A13A33A5BE5CB749B78545F1563B03CFA4716B9621BF84E9DD2B0C14A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 a3a59c7f978f0084b4d0ee06fc26c2f98ac6b87f7296d1886e01df8aa053d9f6
MD5 0da12e688c9e66f899b9c680e5322c72
SHA1 1543c9d875b3eafafcd889fcbb105940f6f8ba6c
SHA512 befbd34aa75a7d9e9312da749918676f9ddfc38c6851fad39710cc0e2f058f9f9854de8087d8d209ac87bcc2dc78d8b80224bc7be1234ebcd65730ff6a248789
SSDEEP 3072:DtZoY1HfXsQ+rNaN1HGd+zGYpwpxBZz0iuK2/LlTno:IYNXsQ+xa+d+pyBZILKOLlTno
TLSH
T15AC312FE651D8F5366A9CE08B68F131D2AF45743D986D39AA3F137402606D446F8702A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 fba7cbe79773cd86eb02bb38cac9d895e432fea28e361af2b3f39d628aa492bf
MD5 bea542039019263632f8f676651aadbe
SHA1 c20a3758a32e6264cd047ba0405a6a636d6e5aa1
SHA512 8b2672bb00d9e17eb85cc64ed59f7431d9438a2938f45157e526094ced1e190728e0752b5cd1478488ed232ef7653a4e69d95c14f9cfb0f4ad18ec0d53da10fd
SSDEEP 6144:FkYKXLyj0x0IMja6w942YNXsQ+xa+d+pyBZILKOLlTno:Fx+07a6Ahks/a8FvI/u
TLSH
T1B23422F94D0C5F875E9DCD6C51C7060EACE0BF62E9E6F21AB2DA3B858245944C74341A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 11353380746dd7464b9428e99ee0398fa831c84a70d6feaa8ceb060a538ee5e7
MD5 cae064643eb1cbd3ba657918edb57339
SHA1 a6f2b50fbe4ce6cf3820bcb47e163b691225d089
SHA512 5eb30cf7d131d4c907800ed439bae0040a8a0c31458c77980f728bd9cff75a706b2c9c246ca39168c38d7ff9dca9fe2252159babcb220241eb15c78bb429199f
SSDEEP 768:5f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3b:569tQeoVYoUxYCutFCJGAKt
TLSH
T19CC4FD37A470A098DF3C35B1E2AC6B8CBD72641A12E006421F74B57F7A337D99A0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 55732ab1b665d0485400796571d13937588be52199777a3a690eb4d7bcb6319c
MD5 a5026d6f6ce7c5e7d5461b4581396b76
SHA1 5b30de09543b62a040a8e170560d2afddb923747
SHA512 ffc27a9d0b546edb8877c5e58f3e55efae46943616c98e80d7241dd605b7740b56d80f13d22ab0629a286f5464479b388942a44199955981b5d88201ced0bf09
SSDEEP 768:40aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba1:mZP2tFP3vqY8VqEMqTaBacg
TLSH
T1CE258437D190B0C5CE2C7171E9ED8F09BA33A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23C0796A8F9CB63EC643981147FCF007B3E922E1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\23C0796A8F9CB63EC643981147FCF007B3E922E1
Size 91KB
SHA256 633f9893f3daa843ef47c750ba8e3b82ee9f6fb61d7148bb5b570424c447137d
MD5 d7a3054cb6f8d7ba9d2f4a94a30a4bd1
SHA1 89d3beac1da7bc0be68dde73c5597f7a6a06d238
SHA512 7735448cc7d3c28045ca07d5fb2a6a396936ffdde30982e046a559c5e391467887d89861db85783b6a5d3662c78788b81a17a7cd102c6da100f6fa045b0ea2db
SSDEEP 1536:TPhiFbiLcU6ABlYfHc302PiRb4Spx0bm5UuHKRf8N8KoNlYhgIw88m7JWVZP1W2C:zhJo5uYfq02PgbFa9kKiNvylYhgWTwjY
TLSH
T1F39312739B22BE8CDDC1665595858A8C2D49DB239BDDD0ACA002A1D8CCC8FFA1135D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 3582bc51990c22383d40b3b46b3e3c5c8fa95ac4d60b50b38691c1c3c45fffac
MD5 6c00a20bbee358322af61251cef50940
SHA1 d0a2bada917e3c43877bcb896e1269287e5c1561
SHA512 418c2dffb507817a6e80155d487b01c1c557b5cc5445a363ab4b867a8edd2357000f69cad8c4715e21df1430424de908cb6d4b6f8d4a399ae8560b977c5ea45a
SSDEEP 384:HwCe7iO024Ytdcs3hk2nhfdDE2Ba/rIVy8eABN+kBN+J:QqZYtdv3hk2nhfS2sDIVy8vN+iN+J
TLSH
T11C728DBBDF512C5D1957D989C8AD9366DC05F9ABCBF690B608203449C78432AB0FA4CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 1988d6d922ec18c8453ce3ec478e8832915ec48e22e7f318b99dc88e53d8421d
MD5 31f1b4a628ca35fb34bd500152eeb993
SHA1 87723ce9401c1d480d100888c4d74047142c19ac
SHA512 2fc6636eef1c6ea688e1757576f5e2a1d0c9ad2ca34f7d9039f0311a1e40ca36a01002b7ef3bb2a499dc5d3f58a14cb456df4701370525d1f93e18f297dd104d
SSDEEP 384:H9XghOiO024Yadcs3hk2nhfdDE2Ba/rIVy8e35kUn5kUJ:dX+ZYadv3hk2nhfS2sDIVy8+5N5f
TLSH
T114729DBBDF106C5919579585C8AD9329DD05F9BBCBF690BA08243549CB8432AB0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5888_466389422\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 0212b2ae6d05d8875ef1ac1aebcc466ad2b07620fb1b9e09fb70bb37136e9092
MD5 dc19012e57b6b8b8154e63bff8f16bba
SHA1 3263e6a8ce581ba52878c09e276b14a80e0869e5
SHA512 79162930a58d745787756ecaf111482d26cf2b8e1f1c2279e67ca68af1380cd1165aa7974a1e8b8b82e586f3a2249da9babb853e76268983b3fc328968d542cf
TLSH
T1D5217E574A0AE4B5CD6287B369CC8A2773B6B7CB5364D015B38AE02E490113F133D17D
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 359B
SHA256 48cf5f1589f8c569cd4a1b378d27f8fac111671414edbc3d05011c2b080930db
MD5 b1ebb4f4fb68716b8f2519bb66758f65
SHA1 0da5cf4c8a83c196c6c706f4e8e8202bc2fb696a
SHA512 692dd3504c4509e488b1b772f911405e2a8ca15d7232dc40d1671ed0bc4861ca199859277f8961b3d609b0aeb2f8cf3ffc7d20216156125db6f6d94dfb1c15a0
TLSH
T199E01A5B5332E7E2937C60E87C756EE587F388E8C7A9016880CD4C850D98947446354C
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 b826ee69c71a8f20a80500292df4fdb22ae0da58661c869c7555e5de8894a919
MD5 476808f24fe3a48b8694519f14e444bd
SHA1 8720022fd60590436c906dc9eaf0975bc3e16a53
SHA512 dc8f7f281708d43a68ab07ba2e851b640bde440d7532bf167f9d38f4bed3f97d817432cb65adee1604890543c6b856c709c2c9e88c5c0c7e692ee1e8aaaa8c14
TLSH
T1DA31EB10A3D11259E0A3A633BD37A7026B39F802EA1ED64E024C521E0D695047E7BBBE
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 1d2c5c490fc1e812ec39223b212a7ab5c90e4584b987be6921f30f8dbe3d0302
MD5 16ad00b5f6053f870ad522d0b5811819
SHA1 aaabf479c1f15ce5411de491b1e6b66475abed36
SHA512 b789ec96988ac89d1276e443ff5dcd0064bff2cb4815ae65fb3950dd76ed8c6d8c3fe64af3eb141c440c8b7e1a2fe56e818c129909ac305c294bb9d47781606e
TLSH
T1FB71ED10A7E1125AE0A3A633BD776701AB39B802EA1AD64E424C525B0D65500BD7BB7E
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
Size 8KB
SHA256 6ecbff8476ab8ac5391edbc0011f0d50eba515700e7174a7f79851a54ef64d29
MD5 ff5a3c04c858a0504be4b878cf8c2edf
SHA1 e00cb5a5ea169da835737abb30dd53440ccc5751
SHA512 649c10f664ff8ded157ae6614b50c517eadfa6d47094b727661372823e55ad1527d1217a7e8cc546a58b4bb753c2ce1ae2292f3ac29106a4847539452c48db49
SSDEEP 24:k9uhMZa91Ib9x7c9Vve75q9F55A59w9BYo9Fy:kIu59OBe1I5696aiI
TLSH
T13702B6E767B2A472F4A28FF14068725C9C3307261ABCD584C648A0F716D1FD9903EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
Size 13KB
SHA256 bbea83484522835bcf7a8ca77b170030648851d37af81e49bf0fd23234da73b5
MD5 730ab5fcac58f6e344045d8332ced6e1
SHA1 6599313734fffcc92332ec488dab790c620c3d67
SHA512 ab732ecb563a45d97e4f38147caf4e5230a607076a848382bbd024caa9d0c60c68077a998691363a06739300cd04ba4f665fc71850f05101615f3c537dc61c4c
SSDEEP 48:k+w59OBe1I5696aiIjPBt89e31HSD1HWHR:Dw59OBe1I5696aiIjPBt8Alyx2x
TLSH
T1065275E76BB2A872F4A28FF14068715C9C33132619ACD584C648A4E706D1F99913EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
Size 18KB
SHA256 eba46714d0607c88f5c9e7c3773d93095d6131691119256745a1200fe791c26c
MD5 8d51bdf8c5866e1b71a0c15001980d08
SHA1 3fbb002724fd81f50d431b3d25207f4d77fbe173
SHA512 3df89e820f394bc97c0de9686095e0ee13494458067ff4edec5f2d887a595e13455324e9dfec269ab4429c3eeecd83af432118501629914f639c61e2a379edc0
SSDEEP 96:Ux59OBe1I5696aiIjPBt8Alyx2xA4cSl/e6Jh0y:I22b
TLSH
T1278298E72FB268A2F4628FF14468716C9C73072519BCD590C648A4E70691FA9D13EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
Size 38KB
SHA256 7241b893cf0fbdccfcfdb22649800a96f83dc342200cf8273286b7cd64ad6750
MD5 7ab45a8adb97537330e41e6fb9d5d0aa
SHA1 4e6281ec16debffac85c9ce46ea78f7776c503c8
SHA512 9b27faf8049fb7507059b679db26115bb253e1b8bb268b9dacaafaf0c4c25dacb7cf32d84372081a227d98cc6c6a7fb8cdff083df1b96d4e06db2f1abc284391
SSDEEP 96:5O59OBe1I5696aiIjPBt8Alyx2xA4cSl/e6Jh0yoPQs+EEPbEbEx6gUEADEHN2+n:U22bGoseIg2pTCWAeAk
TLSH
T1C603FBF72FB66862F0628EF14058755C8C3307261DA8D6D4DA1894EB16D5F94E03EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
Size 76KB
SHA256 1dcff5411d95ab1c2d74a3f6aa6af7d0d77bc0d9f5400e95b8f731e1829628d3
MD5 c3b0536db7080689dacc494df62a2dc1
SHA1 e1befaf42d11609832c9d6bcea0df16024ab95f2
SHA512 49b354f95ee3efcac21dc5da1287a5e7556077d9d9094a98d85899348c450424d09d29453c2ca60a534d0e3e1841d8ef487a5268f65eb2d1e9b262af7427dd89
SSDEEP 384:Q22bGoseIgWpRAkiPjpkYxp9BJB5BPMs:Q22biAkYX7
TLSH
T1CF7329F71FB23856F1628EF14098386889334B251D94DAD4EF18D4AA16D5B94F03EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
Size 91KB
SHA256 06657d05c2e36e0620a2f27ed49b5a7afe43f27df8d0551291b55ddf90d2a405
MD5 6b6ddc9a9eef693cfd89e5a901e0b821
SHA1 2d141fcc61b6ad82c10a30ac0fec3249fce66612
SHA512 b9766fa2d3c30ebd4602044c2eb795d720a834c6e5d4340073bdbc38b99cfd59ab39f01ef9e018878314bd30f1ba34c9775144247ac6f612538ced3ceb43f4f2
SSDEEP 384:z22wosvIgzpATAkcPj6kYTpaDBJB5BmMs:z22ZAkwX7
TLSH
T11A930AF71EB23856F1229EF14098386889335A151DE4DAD4DF18D4EE0AD5B94F03EFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 2fc0ff3eb02fe0b30e32ffa92486dab2bac0ef6a3662e749ea0e8489379c1281
MD5 1f890f6ef97a64d9b356301c4dfa6d96
SHA1 1da019ba398f047c369d8e7062434ad6f623e924
SHA512 ba12df7e0ad183da176a29610afe40270531ae4c3cc19be4c19b3facc3366f38e39aa810d6572d20ea62472556a5d2be641cd46bba1c99067dae2842c7b4c147
SSDEEP 384:bXCIc983uVuBEsGcm+uJrm4HKPK1oubPbj7YOboHCQyjpgd66Joz/zgC1jd:bXa7sGcm+u9m0KPK1oubPbPj2G1/
TLSH
T138D2E054EB2E913FD45512BBDCA50B042F79B88958092FAB3A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 92KB
SHA256 0ad0b10128ccc1f3e80d50e61091c06646a026291fd27db6507abe559d6ae550
MD5 1b5b9605d23e18273b3db12c205a7941
SHA1 a67b6a185a765ac5b627677761bc8f7fd688ffba
SHA512 4707c3b94dec4ea484f79afb1526702101d9c4365772d58095edd78f2f163147d316f777c58989a5d5007bb360b95f281811cf029410edde7e81728d2efffe21
SSDEEP 1536:3w5VN2rkJ1eAeCZ9jBzepyF+I0z5+9I1ua6e30Q08F5szv8zRxcf9ii:3WVgAjAYl5cIX2mVPFO5sjao9d
TLSH
T13493EE44EB1A953BD96803BAACD21B103F79F4895B1A2B67271C64343D873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d57bc01d3ac92787492fb0e146f2c81379458584f2e82913c6e9c934ec70fcdc
MD5 9cc59f3220d844bc77540f6c36803cd2
SHA1 65ebb1d7abf4b2d7c688201e1b7fb0de2bf47bef
SHA512 2505c4825b75f4049ba680c421930a2962701cfb977529ffc649c7a88d66146fab4cf9807bec62ccf0b56d7097816f1f76402d5322deec241d552afa15c55396
SSDEEP 192:PROv5zbo7AZCQyjjdqy0g1d66JoztdzgCl6mc0dz:PObo0ZCQyjpZd66Joz/zgC1jd
TLSH
T11EE13FA8E628863FC418427BCCA60F440F35389A9C4E3F29359C655C2D572DE76DE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
Size 1KB
SHA256 06623fc36ef0fbd8b8a2c124d7efb87b6c2af82c16e0fa56fe6024ed4b678912
MD5 80567d0254048e2fc0e6f3b7c76601fa
SHA1 8bcc931d81f88d6d2bf8d57dc1b9a2d42188d5f1
SHA512 6fe445dad791f64aeba61216d8a49fab8f722aa4ed3baadfc3a166e0a255c17abf2cd8171c03de7037b467b8129e9e3fbffa59b5c45147e80e8a764bdc10c914
TLSH
T1D831235C39B94CEAADC7E25CB010138D47554A03A9C32C830E62FE4CCD91FC6312A87C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
Size 5KB
SHA256 4b5b3f4310b0311eac0c0545189b146a891aa733601cbae002906b241535af4e
MD5 3776d6986cb888bb787e23f9f0c1fd8a
SHA1 a48c545da43a3a1f3186cf5ce1f5a0101ec0412b
SHA512 d4021842748571a06aa4a7fb65ef1638106efa7c24dfec0d1f85a94231c05c4bdecdac41a12df3da6fb0f527fdf160b6455781ed67e8b43c0ab7296fa691a7ce
SSDEEP 48:YEhI1GApIj0gSZJc7QxAcTjnoBTTIQi/WnhkdNCD4V0iWlAIe4BpTKnD6ymHzkZU:vYD8s3je8cQCDE+e4B50DsHrtch+
TLSH
T133B1001D75AA0CBF6DCBD299B441028D86C84703E9C72D874CDAEE88CD4AF96320F579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f0f6552-4cd4-44ee-b0f4-22e5c5fd009a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\4f0f6552-4cd4-44ee-b0f4-22e5c5fd009a
Size 2KB
SHA256 33e3f6af238a2cb670860028ffc9beb79408aaf191c76ded74fd30136837f7d1
MD5 768cdd03ea5d98f6254fd72a23180a91
SHA1 a8f11ce74bddc26ee3ed1530b92f4dedf4b28900
SHA512 223d49249b712961daecf985f0f98cadc3de13c7376c9041f17b7cff40f61e03c4e55dd1404a6a4d5059fccc546f90523f1152820ff76cafe266e14e49cdeedd
TLSH
T1DA4153AD36785C764CDAE65D809233CEA360890340C618C32E51EF0DCE9635F73B6527
MD5 SHA1 SHA512 TLSH

Submit Download

7aa75e51-4fc0-4b52-9bba-d65a9bbf5c9b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\7aa75e51-4fc0-4b52-9bba-d65a9bbf5c9b
Size 28KB
SHA256 4f756da4f67364c7a2d656035d7366a613b4897bf9555b2c10584d2497a59606
MD5 1c10d366143fcee63b89a062e2210fdb
SHA1 c5b938d130220b09902fc4942b35d97b24038c93
SHA512 814c355bdb1c192475f7df7baabba2c9c00a4cb40acbf73c1223d4de896b6574e9031cf15e9c0b89d70b11504630839b77947bd3e42e6157364a45d7831e4655
SSDEEP 768:zPeUGl9jKA5ebMjg6Je9HOSP944Bwe/w+6nnlv45taPzOpQIf:BGjleev0/eK5sWQW
TLSH
T12FD2CBFDCD1240473D65E52AF2E9A96B2057293209CCC3DD6AFC483A2BD6D7B0527728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7dbd328f-b3a1-4aa7-9715-c11978e55b04

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\7dbd328f-b3a1-4aa7-9715-c11978e55b04
Size 235B
SHA256 2842cb4e385bc2eaf02e90d9f1110e98553b8102bffee1897ab80c5486ea8314
MD5 8c6ff9d3ec99d485d0f7feeaba361692
SHA1 2f8612f41a62587c19a98cc796ed3d59d6e959ec
SHA512 63c3579bc3a7b090853413f68f0805eb7d009372587dd5b0549a70552a8de596315947726d96e1c884298f151c7d2ec68a7e2b05bf38b4bcdd062b6b4b42831d
TLSH
T11AD0A785349C676D08180F07F0E1A9D670988C3714B49820AE925574EDBDEC88162D67
MD5 SHA1 SHA512 TLSH

Submit Download

977ead1f-cc3f-4a5b-b800-71ec767b660a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\977ead1f-cc3f-4a5b-b800-71ec767b660a
Size 235B
SHA256 704348b7154a9efd2b02954851ea4c719a2fbd3dc69696e4a6253a852b397aea
MD5 d0e445e2f90009a7c8e0e9c20f6a74ec
SHA1 1c9fb267d564a3a1ea3f40ccddef09a64088ba93
SHA512 1913ce462b401c076452bf03afd22d46e126f74511da13acf0287c79cc2cc073fb38916f3a4144514a6c63719df535304424e3f8822baec25aca5b47cef0c48a
TLSH
T1B5D0978034AC671C08040F0BF0A1A9C230448C3354709C20EE62463CCABDAC88292C06
MD5 SHA1 SHA512 TLSH

Submit Download

9d88b78e-d753-4a0a-b7d1-d16d660c77cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\9d88b78e-d753-4a0a-b7d1-d16d660c77cc
Size 15KB
SHA256 0703433e683bd07bba0ab91c17bef69f45596b64f3db60a1e5f3cb9a2553dd7d
MD5 362552151a071a91a0af3bbc82cc1a44
SHA1 020b240fadaaad94d99c877ece70f3771c84cc7d
SHA512 f9e41ab34b7ca3d78c2ecde53be85e7c27cb4ff26ba2e0e5830096459f385b3a0b0c276cde84dbf37bc6f9a263bbbe770c6ee5ec64273700777419a21ccb6a8a
SSDEEP 192:7CdRAWztRlvS+mk1mZoSBSjGbHDC/mZ3qCNPdH/8h44LOkpJ79aKaCNcyPQK:iRAWZRlvSVpcjGVLSnEKVNFPQK
TLSH
T10962E9562460587F8591E368D8E87FC3F6F508CF8C029FCE9BE4BD0869EA09E5127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9ceedd8-8774-4fe3-b45b-d8dfc2c754f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\d9ceedd8-8774-4fe3-b45b-d8dfc2c754f6
Size 886B
SHA256 1d943f5c65dcd9cd16919f71f94163779c420a2f6083533489297b90f2081da7
MD5 340bb5d56d470aa69071f655953105e7
SHA1 3666d9f61373849e830426f0ef0ece2f696f77ed
SHA512 c02d9a8bc8db30fa9590a59effcc9190936f4da767660b1b8fd079da1d210e1d2b5ff9c1893e9b72d9cd161f80b70776511712aaaa04809188fb41def66e5b92
TLSH
T1661104D14670B9B28C78925F85E13B4686E4A52380CA08643CA08F1C4EED20FD3F6307
MD5 SHA1 SHA512 TLSH

Submit Download

e8488aaa-458e-4a75-9d21-1b6d8aced05d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\e8488aaa-458e-4a75-9d21-1b6d8aced05d
Size 883B
SHA256 dc02cfe43679a1ec7e5cd48f63e5ff7ea4bc8e725280e2cdb533f72f520e78f2
MD5 93d6d922e8807cfd21a8b57c389b6ec0
SHA1 8df8244e63c0795eac64d271f6ed17f2bb162c88
SHA512 6df7c7347abb2c2e36453c050216604d8fcd0490bff318a9a7d014d0a6f1be991cb130f7a4da30b07c8f145760433b0f4c7df77593b90fc2a09e94066273ac9a
TLSH
T18A11C4D19230B9B2CC78D25F8595371687E4A853C0C954182DA15E184E7E60FE7E5647
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\extensions.json
Size 16KB
SHA256 264e3731f63499faf15220392d11105e4166dc9e1611af59f6762d8556729320
MD5 cd0d0ed3121752fec652aa848f80933d
SHA1 81e300c595af4821f85c88a482e66d5c1e119594
SHA512 1dd6fbe05b456695f5a1f7e4e5aeda10cda9992ae309d38be330cd4133dadd710e110c56425fd96a83b68b7652a0af4598052713f13ef3d5e2ad0e2cc7e2285f
SSDEEP 384:LkI4vUUmldvS8dhWp94z7j96ohiL4HsL4PoL4HFL4HwL4HHZ4hg:4I4cRfHXY4Z6N4G4y4F4S4Z4a
TLSH
T15D72421545049EB8298FA78BAA367E01C37D473B70845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 12KB
SHA256 d75f05bf5cfdba3a750d15beadb145418a4c99ae0b68c7fea96f022f16553b80
MD5 1b6b44076055dc79916b6094d4d4940b
SHA1 b0fa27439ecd30e34bbff8f0e1c2800c0a9a624d
SHA512 65632fd90924cea8b7b7152ecf3a543383191f28541f0114ccc97f66e853f48658aaed17dd06ccecfc8c7277c092d6981a71129a66d53523a5953a9431d7e9cb
SSDEEP 96:xHGqMTUmK4qGqvfNbzSM5SSlPdv9jSnoRpwoDRzJQsZOBw8O4Vp+cYFCT2k8L4cy:oq+KTRvfF5SSlXLRTOBw8O4icYFCTh
TLSH
T10242AC3860448F7F24FA327DAC216AB019A502277BBFBCD705F994C2555CF2481E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 8KB
SHA256 736493b3e0fce84e4196712a550a07cb391c5812b18c8f1d291fcbeeb8fd8844
MD5 144569fb5ae3e5f7eb4a692daf00702a
SHA1 a7acc6cfc613e56787b022eeda65dbd9f8c8c567
SHA512 c8fac31a84ef0dec9bc824e45e98a4f2c5318b56706209118407cccecf52912badb897430bc8b2d0773881806b9eafec0b89a2d0c35e9b7a71b5823965cd13c5
SSDEEP 96:xHGqMTUmK4qGqvfmbzSM5SSlPdv9jSnoRWRzJUBw885krc8L4cnSqoLxGS:oq+KTRvfW5SSl8RCBw88+NS
TLSH
T196020E786004CF7F74B6366CAC6449715A62023BBBBF68D710B994C5451CF3882FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 7KB
SHA256 096d8e6472f70f3a876fce9ab964636acee3f4961eff089c61f50ddbf1717b7a
MD5 8ceff1ab0e5a1efd0e9674e48ddc6c90
SHA1 16b66146f6558c9974cd9a90f6d21b0d847274a5
SHA512 defeeea201f9a3f51f2f9224ecb6de57272319d537e74012ad94c74d21e05fe60dff2a59e8abd526dbd75393ab587229330fec5b376e1d0b2442ffb311148b8b
SSDEEP 96:xHGqXTUmK4qGqvfmbzSM5SSlPdv9jSnoRHmBw8828L4cnSqoLxGS:oqVKTRvfW5SSl9mBw88fS
TLSH
T1B1E12F7851089F7F74B6766CAC6888716AB2023B7BBF68D750B954C4050CF3882F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 6KB
SHA256 29131a05583ad9e201400073bcda694b8d7585978eaf953599d1575bd18925f1
MD5 39a18ba13e0c002b3a1a3026012e6d76
SHA1 89628376cbe040f817a87e0b15f8e576c9a39d90
SHA512 8cdf6bc6c63524721fb90961f5e4fa0d930ec2146974747c8a002f469d32237d6953f2382ccfb5846ae7f401c107ae7662e6672508a81820067805a40743bfe8
SSDEEP 96:xHGqUTUmK4qGqvo1zSGQSSlQdv9CnoRHmBw8828L4cnSqoL0:oqWKTRvobQSS29mBw88fZ
TLSH
T15AD11E7850088F7F74B6776CAC688871AA72023B7BBF68D710B94484450CF3882F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 7KB
SHA256 ac6bdb95f04844e77c086aff79e8b410fa0ec063e16b7760b2a99131338e032a
MD5 1273b8af796d71b0e788c3ef017b5eda
SHA1 a0f06e77027e1251515df3d586c8fea701c44c14
SHA512 ca4e2fda4d33a43b72d7a429065818a892e13d44b18f41943ef2a0c995781dd1dc0c8632b1b29ca7e42816e57e8cd1faae303967b16958591340c58c53b79292
SSDEEP 96:xHGqXTUmK4qGqvfrbzSM5SSlPdv9jSnoRHmBw8828L4cnSqoLxGS:oqVKTRvff5SSl9mBw88fS
TLSH
T165E11E7851089F7F74B6766CAC6888316AB2023B7BBF68D750B954C4050CF3482F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 6KB
SHA256 2c5e4aa5e247476e69d6257237d732b1c5d3a35fccbdeb6cb2561a31818bf660
MD5 bf00d5590d8fedc79ad2779776dda9cc
SHA1 ee2621edec6c4317c7120cf394bea8b425326fed
SHA512 8a5fb97305d3f51aa936a7b8cbfda796ad963151018eef1b3e4b97948f13a627fa9befa9448fad1db210c180d16e6beb6882cb825a16d522ca6134a7bbac0b74
SSDEEP 96:xHGqXTUmK4qGqvfGzSM5SSlPdv9jSnoRHmBw8828L4cnSqoL0:oqVKTRvfw5SSl9mBw88fZ
TLSH
T1A8E11E785008DF7F74B6766CAC6488716AB2023BBBBF28D750B95484450CF3482F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 bbbe407d6ac8dc9d0a248ed0fc39092b19a9bdee7030ca2d6cf3b88522c1507b
MD5 c5c3e60b0f05bdb23c6d59da55661e69
SHA1 22db2f7432b871a97af0cc2c616a8b2b4b6160cb
SHA512 4456a3bcaf46fc63e94770ab4e6c54311a3b304369c69bc42ab3ec6721e13815787354292902e94435ecc99c818305b3992f59b7a1af7d224627e4de5e32d873
TLSH
T1BF21EA663A3BEDFF7610D214F48A3BE5C3A531520EF088E091ED6611A56945323BC914
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 16dcc557480fd6626cdf4a3ee7667cede512149915d1a5d54210ed6f74644108
MD5 f05801d2db4d0b9276f70a2e2e0e3cbf
SHA1 b3ba94f7651ec7db49fcc0c83fe53b51a7fc9d22
SHA512 504507ba9e07d629603f41168240fc0e7e650505e5c4810f33b87f5af189d3553925cbd3002239b42a00e23dc1fed082a8d6762d514c12dcf2a5a69dd05d815e
SSDEEP 96:UxE4jD09IvvXVKCd01VrqM4EcZZi6rLKJyOZOhexPgUajkuRMbB:Z489yXgi0v/4gZOheeLjku2
TLSH
T146B17D77643DACE768A6CA8454EF2FE99BD2118445EC801E9D2A9D3741A8F00F318CDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 c1937f59c7a8b41d7545a37df64096d410350a314a8c8b24a9c5b7d84a54804e
MD5 55fa955a600b79ee72bb9a16387a44ac
SHA1 994c9eb12ffa1e0e975b1cee15b575686ca649c1
SHA512 da366b16cb32048168861ec517e92afde36bdd58432b504c5d1374835b876b22c67dc52281fd0264a9265e95d4f4fdd3545520dde7f50609dd8549ebfe71ecea
SSDEEP 96:axE4jD09IvIXVKCd01VrqM4EcZZi6rLKJyOZOhexPgUazkuRMW:3489JXgi0v/4gZOheeLzkuf
TLSH
T111B19E37603E6CE768A6CAD554DF2FEA8BD2215445EC411E9D2A9D2741A9F00F21C8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 ace0a6565373e77c481f845875d2f74d4fdea952b3682bc395aff6a32ffa3302
MD5 a0f52138e3b24e1cc32ef8ec315e8f27
SHA1 337e34f9fa2d02117ac10ac48d0ad8c98b88d7a3
SHA512 d84624e9f52cf6107177ed2fd4cd57f6783aa33a7470ac7a341dec38001023229e76a1361836608e6800451ee07664ce53a108379b1fd738cbb4ec6f348522d2
TLSH
T1AB512BF31D2A7DBB3135C5A5ACAF4FC186D220200D7790367A69A76242EDA07901D95F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 943327023a1d25961bd75e4a81f29d262890c0a320009e1367d97203c038a87b
MD5 197dee343014d976655c1a92442339ae
SHA1 1dc497d0416b8b921450a5ed019fcab035c9dafb
SHA512 855599e53a66116cd7caccd75877bc4659e578a10be0abe9ae08ed6c72aeeb3eb2d39d07f60f29708fbd7fbfc04f1409682c4aeca56999f4a673bd74fca60fcc
SSDEEP 96:axE4jD09IvtXVHXCd01VrqM4EcZZi6rLKJektBqTFuSFhgFjg4mg0m8q/:3489YXBi0v/4FkqT8SFhgOPgl/
TLSH
T11AB18EB7B43D7CE76D55C84158EF1FF99AD2215048F8814E5D2A972742A8E00B30C9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 e57c6103f49ae6252734649e4b219a28d61f415572c8635918b9432f1d09804b
MD5 5b9d2f3474c1429642ca8c88acdf30ec
SHA1 9296a897c5eb6641baed421bba00d82c77af8af8
SHA512 199d894b4bb198fb3a8e3858f49dcd66f9842bf70d92eb28bf1d485fc9ab8446a50f578cb1d5b9d21954c440688316401fc45a6e5fb06b6d1fca9b68ae3233e6
SSDEEP 96:ZxE4jD09IvkXVECd01VrqM4EcZZi6rLKJX3MWhF4ZA/YjePNYc8:M489NXKi0v/4hWhF4+QqNm
TLSH
T1A9B18F3B743D6CEB99A5CA50A9DB1FEF86D3245005EC40599C2E4A2781E9F04621C8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2309145126w9o9r1kbebr0_3500273b.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\default\https+++apnews.com^userContextId=5\idb\2309145126w9o9r1kbebr0_3500273b.sqlite
Size 48KB
SHA256 51ac40888bcb5826f323796c204273bfc7a4dbcd67b4372ddc512c6082f0b0e9
MD5 d7509ecbf9b2782310bc9e58fc606ef6
SHA1 2f97741f55077fe098fab6ad9196eaa988b72c03
SHA512 9380e481f5cb379a233181484226a319d3e29978b4b89529c776493356d45d744f1de770a85056fff095042c5f99554ddaf4539b137886cb7cf73959a9d215c0
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEF6g:Oa16S6CKnqlizbxV+2xVeU7X2B0Qg
TLSH
T1B3239F8E3F07B511C47AF0B178A08C51B85E321E07222AD57990DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 b48f95236703f7fa77faf74d0ba5de0e47a0b54a3213c795ff383609046ca7e3
MD5 2ad4915509cf4409857a79ab387c3287
SHA1 abd62ce91076a73fb2958f74f43df51f9b312c89
SHA512 12e7f65f84cc6e3992554f5e9115f750cfa8d536bc1393e2dd28eba7ff5e8e5a26c406c8125f00e74a8fe380d8235ba531afff9d03cdc84af4f37991cfa10f0d
SSDEEP 49152:M/WMa9y8GLTzYIz2tr/8DllKrDe+rQY24w9xbIa9mt77NabY464CCUkTdzme7RH4:MepsCtLgllKrqeQY
TLSH
T1CE765CE460E19253F38640B3718993FB20EFC01C60768F44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 0205da2cad87bbcb1db93453c115d42a53c94a272fb7240a8afd9d50a6f9f202
MD5 7c48f28092536c4778a07711357cbd04
SHA1 397b8b59063adfdbc212a190d194d2fbf6de2526
SHA512 9a48acf94fd59f9c8b29507bf3bc22768bff063c56a023b8710da9a114dd966a6decb41f3b39397dc08f0bf3dfe30035442513efe386f76c5d444e7d45c2a89b
SSDEEP 49152:oLBLyjaeUT6QC5zYY3MwYJ0P04rUAeKucioPRaZUZMbuQYu2a9ywGCTzYLzQtZ/h:dlUIUt5gllKr2TI0
TLSH
T150765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1752-1-0x00007FF7ADC10000-0x00007FF7B15D0000-memory.dmp

Download

memory/6284-2671-0x00007FFB28650000-0x00007FFB28660000-memory.dmp

Download

memory/6284-2705-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6284-2708-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6284-2707-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6284-2706-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6284-2666-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6284-2672-0x00007FFB28650000-0x00007FFB28660000-memory.dmp

Download

memory/6284-2667-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6284-2670-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6284-2669-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6284-2668-0x00007FFB2B300000-0x00007FFB2B310000-memory.dmp

Download

memory/6424-2742-0x00000000075A0000-0x00000000075B0000-memory.dmp

Download