245ca379091992a5f08df8982752b31e8bcc0112bd819d88e00dc272e03c31b7

Resubmissions

22/07/2026, 03:49

260722-edmr1aac888

22/07/2026, 03:46

260722-ebp5caac796

22/07/2026, 03:02

260722-djfp7sxfrb5

22/07/2026, 02:46

260722-c9jzwacm514

Analysis

user interaction
yes
max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
execution.dll
Size 5.0MB
Sample260722-ebp5caac79
SHA256 245ca379091992a5f08df8982752b31e8bcc0112bd819d88e00dc272e03c31b7
MD5 d7531d0a18722476905230b7f4754d15
SHA1 7e6b69e9036dab24c9fd53c3c031024ed201392d
SHA512 5a9c73945d24e5e129a9da32c014dc6a829cd302036c2d4c7ce1ea013b55189fca3a0ed30e89b7fd6a6f5c05cdf6c97cd17c23346f476bc429cddfdcbc0783f0
SSDEEP 49152:yC8trLAufeP658JO/JuVDOaBRV/J66lk9TQ6ZmGmV4djyJ8zBnWH8UF20pae5kQc:ye+2SujW87LN/yKzQ/dBZ41Sh
TLSH
T1D8364BB1B34440AEC417ED7A890FCFABDAF279530E2C46C7B1D0F5A6A9761908724DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
720	chrome.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291656367964194"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{3452C68C-B8FD-45A8-BA04-F2E758587408}	ShellHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{CB25E78C-41AF-4AC9-9238-026F3E2CE9A2}	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{433A028C-155F-48A5-8864-1CFA90958136}	ShellHost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5976	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious behavior: LoadsDriver 18 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
820	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe
Token: SeShutdownPrivilege	2804	chrome.exe
Token: SeCreatePagefilePrivilege	2804	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
6804	ShellHost.exe
2432	ShellHost.exe
6724	ShellHost.exe
1504	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe
2804	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2184	OpenWith.exe
1504	firefox.exe
6804	ShellHost.exe
2432	ShellHost.exe
6724	ShellHost.exe
2572	ShellHost.exe
2880	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 240	2804	chrome.exe	97
PID 2804 wrote to memory of 720	2804	chrome.exe	98
PID 2804 wrote to memory of 4188	2804	chrome.exe	99
PID 2804 wrote to memory of 4188	2804	chrome.exe	99
PID 2804 wrote to memory of 5432	2804	chrome.exe	101
PID 2804 wrote to memory of 5432	2804	chrome.exe	101
PID 2804 wrote to memory of 5996	2804	chrome.exe	102
PID 2804 wrote to memory of 728	2804	chrome.exe	103
PID 2804 wrote to memory of 5996	2804	chrome.exe	102
PID 2804 wrote to memory of 728	2804	chrome.exe	103
PID 2804 wrote to memory of 3244	2804	chrome.exe	104
PID 2804 wrote to memory of 3244	2804	chrome.exe	104
PID 4272 wrote to memory of 5460	4272	chrome.exe	106
PID 2804 wrote to memory of 3024	2804	chrome.exe	107
PID 2804 wrote to memory of 3424	2804	chrome.exe	108
PID 2804 wrote to memory of 3424	2804	chrome.exe	108
PID 2804 wrote to memory of 3748	2804	chrome.exe	109
PID 2804 wrote to memory of 3748	2804	chrome.exe	109
PID 2804 wrote to memory of 1504	2804	chrome.exe	114
PID 2804 wrote to memory of 5812	2804	chrome.exe	113
PID 2804 wrote to memory of 1504	2804	chrome.exe	114
PID 2804 wrote to memory of 5812	2804	chrome.exe	113
PID 2804 wrote to memory of 3152	2804	chrome.exe	115
PID 2804 wrote to memory of 3152	2804	chrome.exe	115
PID 2804 wrote to memory of 1488	2804	chrome.exe	116
PID 2804 wrote to memory of 1488	2804	chrome.exe	116
PID 2804 wrote to memory of 3400	2804	chrome.exe	117
PID 2804 wrote to memory of 3400	2804	chrome.exe	117
PID 2804 wrote to memory of 5972	2804	chrome.exe	118
PID 2804 wrote to memory of 5972	2804	chrome.exe	118
PID 2804 wrote to memory of 2892	2804	chrome.exe	120
PID 2804 wrote to memory of 2892	2804	chrome.exe	120
PID 2804 wrote to memory of 5240	2804	chrome.exe	121
PID 2804 wrote to memory of 5240	2804	chrome.exe	121
PID 2804 wrote to memory of 888	2804	chrome.exe	122
PID 2804 wrote to memory of 888	2804	chrome.exe	122
PID 2804 wrote to memory of 4800	2804	chrome.exe	123
PID 2804 wrote to memory of 4800	2804	chrome.exe	123
PID 2804 wrote to memory of 4292	2804	chrome.exe	124
PID 2804 wrote to memory of 4972	2804	chrome.exe	125
PID 2804 wrote to memory of 4292	2804	chrome.exe	124
PID 2804 wrote to memory of 4972	2804	chrome.exe	125
PID 2184 wrote to memory of 5976	2184	OpenWith.exe	126
PID 2804 wrote to memory of 4548	2804	chrome.exe	127
PID 2804 wrote to memory of 5920	2804	chrome.exe	128
PID 2804 wrote to memory of 4564	2804	chrome.exe	129
PID 2104 wrote to memory of 2840	2104	private_browsing.exe	131
PID 2840 wrote to memory of 1504	2840	firefox.exe	132
PID 2840 wrote to memory of 1504	2840	firefox.exe	132
PID 1504 wrote to memory of 4520	1504	firefox.exe	133
PID 1504 wrote to memory of 4520	1504	firefox.exe	133
PID 1504 wrote to memory of 4520	1504	firefox.exe	133
PID 1504 wrote to memory of 6036	1504	firefox.exe	134
PID 1504 wrote to memory of 6036	1504	firefox.exe	134
PID 1504 wrote to memory of 6036	1504	firefox.exe	134
PID 1504 wrote to memory of 6036	1504	firefox.exe	134
PID 1504 wrote to memory of 2776	1504	firefox.exe	135
PID 1504 wrote to memory of 2776	1504	firefox.exe	135
PID 1504 wrote to memory of 2776	1504	firefox.exe	135
PID 1504 wrote to memory of 2776	1504	firefox.exe	135
PID 1504 wrote to memory of 3540	1504	firefox.exe	136
PID 1504 wrote to memory of 3540	1504	firefox.exe	136
PID 1504 wrote to memory of 3540	1504	firefox.exe	136
PID 1504 wrote to memory of 4908	1504	firefox.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\execution.dll,#1
1⤵
PID:2944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9f6a8c728,0x7ff9f6a8c734,0x7ff9f6a8c740
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,12761353924597028575,3947664847655673362,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,3529853193828785490,5473436354480295875,262144 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,17924463705641866949,15028162780571143998,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:13
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,7345993629280338749,3758823897522501054,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,5404816255931111202,17405960146625131368,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4588,i,7287598571266549956,15656481377283579561,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,1739933654707165392,16570075530959639067,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5936,i,16046431169172965173,4438759397402406019,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5948,i,15217928766737284836,7764157343504189455,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6240,i,12598297549747153938,17232521047263634557,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6232,i,3468696233491843145,7850702457793148616,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5060,i,5277884028690454595,1936050955687953506,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6128,i,2678600114695030403,10695811337660515268,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5076,i,6532251045394840197,352698852656048603,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5920,i,7249457179831958615,9944613461293775144,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,15426512160816191842,4530336250886735588,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,543276283388739092,4512158050952249514,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,10719375870415297327,13762958798195495252,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4592,i,11734280228632744759,1802179490852106508,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6152,i,15740315517342837288,7067605874965058044,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:9
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4724,i,1210299588631378533,16676452203347438870,2097152 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,5170313768956437783,15027315537496537632,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,14355367705976669564,403333716718902063,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6356,i,4202168269641029467,10465621448316452124,524288 --field-trial-handle=2004,i,4975043008977674026,8354292207816775913,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:4564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ff9f6a8c728,0x7ff9f6a8c734,0x7ff9f6a8c740
  2⤵
  PID:5460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2364

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GrantInitialize.ocx
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  PID:5976

C:\Program Files\Mozilla Firefox\private_browsing.exe
"C:\Program Files\Mozilla Firefox\private_browsing.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {5b1856f6-05f5-40aa-8c45-dbc9e2ee2abd} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {05fab457-36cb-46f6-82f3-c55e16bce020} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:6036
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3908 -prefsLen 27247 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {dd89a89b-3b55-41af-973a-89b9769e7811} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27247 -prefMapHandle 4088 -prefMapSize 270279 -ipcHandle 4136 -initialChannelId {ae90ce7a-7347-42dc-b028-8cace5f0c26e} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712 -prefsLen 34802 -prefMapHandle 2948 -prefMapSize 270279 -jsInitHandle 2896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3296 -initialChannelId {23220111-897c-4a36-b63d-a0009fc6531c} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5312 -prefsLen 34802 -prefMapHandle 5316 -prefMapSize 270279 -ipcHandle 5328 -initialChannelId {872d5291-0559-42c8-9163-1a85b7892407} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6500
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32924 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4872 -initialChannelId {336904e2-4b94-4918-96cf-1ffdf9335700} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:7032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32924 -prefMapHandle 2844 -prefMapSize 270279 -jsInitHandle 3132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {8b1b6c1d-b440-4e93-9cb7-5d73506d0c03} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:7108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1608 -prefsLen 32924 -prefMapHandle 1612 -prefMapSize 270279 -jsInitHandle 2808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5708 -initialChannelId {1477a013-c572-467b-af0b-6715d0ccb75f} -parentPid 1504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:7116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:6216

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F0
1⤵
PID:2568

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6804

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2432

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6724

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2572

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2880

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:7176

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
1⤵
PID:7832

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
1⤵
PID:7872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f0ffa0ddfde7b3e5a5310a12f2196bb47b9cdd9ac0acd8b3382c442fa84d5a88
MD5 389a185f9046b3510f2369b739678889
SHA1 4c8d2213cf38d71142d82fecb3fef3ea2e385c9e
SHA512 010cf6af38440a96deb00da0eb76f3e05b06b53efc7697a0c19837f48cec3c4e92be885cfcb5686530dc6cd05ace2711b2b8adeaf76fe603956be6f1c9cebd22
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 014369ba5461b3e2f58ad98844e0f6c63e3818c846e8a48def626b0decab0694
MD5 faa931b8a8ed14f9b2803744b9a50fec
SHA1 b8a6ee8dfa41109283fe24ab4d98b19ae4f292b4
SHA512 87fd1043a7aa9e1a5cfb1453d435a995e4df4f5fdb02c0de438bf193f23886562e743ab9adf45a536e0905991a0a3d09f63bc24fb472997a1864eaf22e91fd20
TLSH
T101519BB3D7D4866D841162F49A217E1FDE2E0A18122C3C66CCD8BE5B53E2972D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 55b7cc7259453c3dffd63f1e7030ec0d7937f676b3f4f422b8e3836284741dfd
MD5 f1ab5f09b8b0a4dcbd9ca60eb18d6307
SHA1 6920efd556fb8579f2fa54a17878c3279d594d78
SHA512 7bfb4502f6ca7f55b48fda14d209985802cbfc2dbc2b281a78ea85d2950b9d519b4408abb1d0d97102ca7c3c04a9f21b9d2a9f5535951a88376f8ba96cc21766
SSDEEP 192:MRHjb4Ccv7DvAPRp2X964Hsb+WNnPcnGpEkw4ezYVyIsnAUgR:MRH3xIH6XUbw0nVY68R
TLSH
T13632963EB964657B6DCAC22AF9213B83D7F5102265942E84E7FC9A2C11E76CC631B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 290c2c72f046779e2a6785fc1a813ccc886d3bc1312c82088d4cf0e2abf79339
MD5 4b7ebab1db57c7a32c6d9a1e70d85e81
SHA1 07d9054676d1effb2e7d4f318130438a540430f2
SHA512 1b56734d8434f30579580bf528c0fc4bc4306cf16cea2e019a387ca667aae98a3936298779eb18ae75e1c1052284304ad23194bd63bbd60430db213e4ac33a60
SSDEEP 192:MRRjb4CNv7DvAPRp2X964Hsb+WNnPcnGpEkw4ezYVyIsnAUge:MRR3xtH6XUbw0nVY68e
TLSH
T11232B73EF964657B6DCAC22AF9217B83D7F5102261942E84E7FC9A2C11E76CC621B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e8f3562e31046899b93ab4cd5b31cda6ce5a605b7d9312149c9e16eea1a7b0c1
MD5 aeff20d20cec7a6ef5b18815197cc3ec
SHA1 282e10996a4437119c8946a74627bffea1bb6455
SHA512 c39431d3a1eee3ffeb77ddf5a31c810453ea12fb7c2ecdb2fb5da7f9aef8afc31367b183994d759d93027df6cb5f5bf6c4d1684a9bc97aa13dc0b7c84565e572
SSDEEP 192:MRRjb4CFv7DvAPRp2X964Hsb+WNnPcnHpEkw4eZYVyIsnAUgE:MRR3x1H6XUbw0nmYM8E
TLSH
T15032B83EF954657BADCAC22AF9217B83D7F5102261942E84E7FC9A1C11E76CC631B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9fdf892322bebbd5434939c4ff9f48d8a6c80436f5db2580d0f69b790e4d5001
MD5 bd3bfebeba06f9e5a74ecc8906dccedf
SHA1 2a299e27a5f992e3873686b2601e7f0f62c6ceee
SHA512 679f055783c542383c7f1ed64fefa9fef85a2fb1dc9fcf153633f02d8bbf87937760b7142bd3ebfe83828c67cdb1cd512189669fa35fbe28cab2408f45076952
SSDEEP 192:MRRjb4CFv7DvoPRp3X964Hsb+WNnPcn4pEkw4eNYVyIsnAUgE:MRR3x1HiXHbw0n/Y28E
TLSH
T10E42B83EF954697BADCAC22AF9217B93D7F5102261942E84E7FC8A1C11E76CC631B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0bcdb6ba68443e6803e26b4059e299e7629c84c1ec1ba46dfc6d21ad5bc5d55a
MD5 d4acf5f01e8b5ef04246e17b1b1007f8
SHA1 ae56d4cf3eaaf5de12ac8a12d7393a3c0a314d64
SHA512 5931cd08ceb8d6e1f28e5e7aa9bc5b45ad7a0cd95fb7f73eeaac6fa5483742407b5e81161a9e62dec66b05fd64eea46f8514abc5653ff48ff2e5f9e0e4eef97b
TLSH
T182A00258CAD14812DD11927075751995B6A94C5819655703E49D06879C5B1C441C1210
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b1113.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b1113.TMP
Size 48B
SHA256 0a34529c91afff43ebe2f4f85ba19f12e035c54322ba9c19709ba92501a7e4aa
MD5 25cd55a982cd4fb2f0d5a877e891a0d2
SHA1 25ac2b57b2a961e591bd0703cb53a6e201435630
SHA512 cac497ab6729aa431e620593ab6fc15f970c18a4d541a77e9543cd9a970f663bee194d7ca79f01240db4f942db738169167770d36e0b2576637b3c4c7579c166
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 8491100a250c7a60b61456e0fea48996a915f823fa98209fb45216f9b76200ad
MD5 60da852eec602ee1a970001766574ece
SHA1 8c02c175378d1f57d0c0d0fc232540ac4ff2d849
SHA512 a0cbf882b9ec90e4bbbd74bb5ad851344e337b7f235e3a1ba572dc21a06f8c897b0f4dbd49653ccaf669bd2ea7e79b2f63de659f4dc9ad8935e9c487f74298aa
SSDEEP 3072:JNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BE+s:JKK692ILxkFOol2WGMbrMZM+s
TLSH
T1DCC312FF94AAA94538685C45E1095F913C28B10B9FD4347885F87AFA29984C0F712FBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 fd4f102b6ef3317bc6970d7d2d335349e725ce92d7fa3531d4334f611a794841
MD5 02b81f22458232214193cf478c4f019f
SHA1 12b247f502fb8ed21cf052882af0e86971d481b0
SHA512 1a9b3302aeac2bc20d80ac6c11320d2026921d0eabf6de8d789e33fcdc445b6acd13cd4429b169b7e3bcff3ec4081dab81925c88bad7e997930aaf738fa62c07
SSDEEP 3072:yNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BE+s:yKK692ILxkFOol2WGMbrMZM+s
TLSH
T19FC312EE84AEAA0138589C05E11D5F957D2471079ED434B482FC65FA39E94C0F712BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 56014c27ea5d320c50d1953b36e5ad864c1021f4ac52006491261ca47e13b124
MD5 5cd76f0018456e29bfbb0925e53edf69
SHA1 ab87cec7d377e6fcfc3bb889b4421aa3c496ad0a
SHA512 b9c5d58b3e8c82dfde8f8ae4c536a4980a5fb6e81c3b749cdb01ed4e3fe8fdeb386571fcbd8a24235346df0322408df0bdb29d5d7d6cbf1ebb9cd1f9daf9cc18
SSDEEP 96:CC69d+cAOIt5aDVmufj7acuSl8h4otop5cMrDhB6BGwv9JtFiO0AuSwpSDMq0j9/:CCCLA/TE57UiU2cEXxMtFGSwpSDMqUZh
TLSH
T1B8C13AB0B86D5D726DF69440F5427E43CEB4A05BA921AE9489EC4B0C01C75EC1342A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f3e8d50066e4b7300e82880370597f211d543a2c4f55f1f7da8b94a08f5d6391
MD5 bb9c9cb39e01cfeeefe822a5ef5916c3
SHA1 787d488e99d89d12a33b56b3caa894c3a86f81bd
SHA512 a53adefa260d435fc8784f9275a962cdaae165b7cb29623c720c8a9425d6c86ab481a84894e255673044ee3d5b64438ce3a3d79f2e523c0ff4f46651cc1af2c5
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5cMCDhB6/dGyv95SMhbb2Jv4a:gC0LA/TE57cDUDcnXUweSMhbKl
TLSH
T142A10871B4695EB75C768545F5827E83CF68A117A9216F80D8EC1F0C11A71E81382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 053ad602631437c6cdd36a3703a710a7a4cce35f7591e69969549f153e2cb28b
MD5 616baa03fcc95a3e393fd83bc290ae94
SHA1 bf5e2ad5cc6ee943f6f4dc7ea72ca9f620721a16
SHA512 3e8e6b09026be6b60ad7154b6c3cd6d5fb663a436f9b7827fad706945fc772c9d58f32db490024091c09ebc5787f7a897dd55f40b7643c017427fcb4bbb4af73
SSDEEP 3072:jNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BE+s:jKK692ILxkFOol2WGMbrMZM+s
TLSH
T19FC312FF84AA994538685C45E1095F913C28B10B9FD4347885F87AFA39994C0F712FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 2e9dc9787c727051059657d9ee1dd2c77dea6b49202713c6d0b634566639fb00
MD5 558b31954272ccc226559d484c96035b
SHA1 05af4b4abf02109dc87f4b49f0767981a3da5622
SHA512 f7db30e5d8162cc172719d56f134240e93ed38abca3824b6a39952e3b247454fd629c5093692f8df356e8d66ab0e54e70e24b79e2d52f581b129f6ea2667c823
SSDEEP 384:HwCe7iO024YTdcs3hk2nhfdDE2Ba/rIVy8er9j+X9j+p:QqZYTdv3hk2nhfS2sDIVy8i+l+p
TLSH
T1C6729DBB8F516C5D2957D985C9AD97699C14F9BB8FF6D0A60820304AC784326B0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 6061e413ef84f7b5e6d1f11ae67db9e02774bb202eaa1d89b810f63d7adca960
MD5 ad4fb5d462e517e9bae17bcf5cedd690
SHA1 a27a4ebd6ec223e6d2a348c6de8a414780084353
SHA512 fa5f9080452cde2c99ca9fc9a481528e3de24c0ff4e03f20e1410bb9ee2b2d7ed2de9a9e80d2f9ffbfbcdc9d0041be86d4d846a39205f781d26ec2177c131928
SSDEEP 384:H9XghOiO024YCdcs3hk2nhfdDE2Ba/rIVy8e1bv:dX+ZYCdv3hk2nhfS2sDIVy8i
TLSH
T1C5729DBF8F117C5929679585C8AD8379DC05F9ABCBF690A608243449C78472AB0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2804_869310721\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 39f0fc67f2df08a49ed125e578dbae6997bdf64b1c6f5583bfd8f6b91d5163c2
MD5 b3d7c17b271e1804ebdbfcf6d36563dc
SHA1 b59d095532552d963c4124a21c5150660d175299
SHA512 8e1c2c1935b80e8a05968ccebc59a6c9a6cb67dd2adb29293dac0497ccad6ff07f10fd54750af383e65b9a5a61afa0c4b1b980edca8c6bf30f46b2bfb09827d4
SSDEEP 192:K81d66JoztdzgCl6mc0diSOv5zbo7pZC9yjHYxgdz:Hd66Joz/zgC1jwRbo9ZC9yjH3d
TLSH
T1BEE1CD64E629867FC458023BDCA61F910E75388AD88E3F2536DC241C2D572DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 45d87c22969905fd4cc6272cac6cb1e7da521c6e1dce9239b26daf27df0ce641
MD5 a550d2c47eededc3f86418facef18804
SHA1 326930b9a549275351651dce6de5fc896b9eab54
SHA512 e8892f2eac48d7f826b495ad5957e2937222705b0519b3ee257c7e246477a7b114188220369352a1ca5cda663d3be47bcf960cb279b556243518241aefe6a4a2
TLSH
T142213A9C39F84DAA5CCBE29C7C81128E93D58E4718471D870D52FE8CCE95ED9326A438
MD5 SHA1 SHA512 TLSH

Submit Download

07f1d8ed-d075-4e90-b7b5-5a9aa22d9f05

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\07f1d8ed-d075-4e90-b7b5-5a9aa22d9f05
Size 883B
SHA256 63e588333a6cca7004f4bb20f37855425b99cea0141930739da7d22a61f27758
MD5 ae86e31cadf3ff1f20fd7311a0ac2159
SHA1 e994d9580774f450c9e089996fe69803afb50d0d
SHA512 6f65d18456b1677549b299cde8ca028d7812872f78c30cb149e2bc696c92535615923e60b73f00c7b6af3bfbce97c9f9b5c519beaf441ac83aa5ee2ff10f8aab
TLSH
T198110440D235B5F2CC7CD24B89953B5587E47817C0C654143DF45A080A7E51EDBAB60B
MD5 SHA1 SHA512 TLSH

Submit Download

74366aee-89e6-4d81-adf7-7f9888799b5b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\74366aee-89e6-4d81-adf7-7f9888799b5b
Size 2KB
SHA256 0ac822184b08bfa49386aef629bb9a5378bcf335c4335bf3813153405ad9de18
MD5 fae1d83c08b9c392cf0368decbcd251f
SHA1 76139af50f8bc3e5524cf95dd75d812203b9fde4
SHA512 867bdf69ffaedf8f4bd602b6a1fbfd5c1315838c801d8465e9b5d3ff090b86fd6d87a5d980fdf2f0f70accc25c1be01871cc93462039a21aa7a0d768344ca321
TLSH
T1D64173583A785DB78CCAF18D988233CED7A4891350862C432D41EE0CCE9269E336B53B
MD5 SHA1 SHA512 TLSH

Submit Download

c2e00436-2ccd-4e99-ba9a-9c627f49edc0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\c2e00436-2ccd-4e99-ba9a-9c627f49edc0
Size 886B
SHA256 2b668f015364c0d385ba7bfe639fea29aaa947092ccc88d166daae8c1149bcaa
MD5 4fb8d1fbf432ab95a22ac9bba94f4129
SHA1 c41f5a39869e00237d45a28c3f301bc1409c5ba4
SHA512 facbf2231cd5c5462a3807b0908bb1ff1a10c56adab033d51f97ecf30ca2b47388ec84c22ddc29a96c8399eeabdacc077042d53de3a6087fab4884a73bb73f7d
TLSH
T13911DC51C738B9F28D7CD24798E17B9286E87813C0C668147E945A084A7B51EA7AA20B
MD5 SHA1 SHA512 TLSH

Submit Download

c4b77092-d693-4aa8-b6e7-eba022934ffb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\c4b77092-d693-4aa8-b6e7-eba022934ffb
Size 16KB
SHA256 ed385bb3bf92555bfe76e5c23b4ea3474a7da5070ced74896331b791ad5ea78b
MD5 7982c50db7c9ad4854e54809f077447a
SHA1 084e4f689ab00291a34e9f783ff5b9bb475f03d5
SHA512 8763f4450b81d6ca85f3202fb86fae107d1d8bdf690ca3d377e0daa2e831b4699245ee3842e032c31ea0c22addd810ecf57b59625bc0d450088db8efa5ddb3be
SSDEEP 192:84ZnVq0EGR81eiaziDDpVfh2cIFI3mOlnRYBrpeyh19BHRM63y+rmXPKaASeEJUz:JqPGR81eiaWDYBf3TruPKqeT
TLSH
T1C572EA56682045BAC591E3A8D4FC7FC3E2F628CF4C419FCA9BE4BD086DDA06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3ddc598-8f4d-4e38-9baf-565d814169da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\d3ddc598-8f4d-4e38-9baf-565d814169da
Size 235B
SHA256 620aaaa48add39b165fe28e51d8669b8c83225f1d3bdc4d8917a2e3444c7203c
MD5 4c535076d0e2d7bc2f3c401faed99304
SHA1 28295198d96912bbc61382b97941f1420d1e8578
SHA512 e6a78ae0ceb76577973de5f71da9e602d7273666fb9275232e42cdbb29cec2f20e2e3335a785d09bfa934382d4d885995b7da6e08293118033793ffcb0e1e6fd
TLSH
T153D023C01CAC272E08540F13F0E06CC7B4988C3330785810C9934A74DBFCDC8022190B
MD5 SHA1 SHA512 TLSH

Submit Download

e0189619-a945-45e5-97c8-bd9d345484f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\e0189619-a945-45e5-97c8-bd9d345484f7
Size 235B
SHA256 2524ecfdd6c514d6daa13582ca44459077a5d2b261704cd60c7dfcdbf1d0b380
MD5 1af2a0141045815e9d4addfaf43af35b
SHA1 331f2e7cdf12df93dbe59bba7ce47c1f8ddc5f4d
SHA512 35cea939cbd4ac31169faf903ebd09bdb61166c09ecfaf601616cafbea7609e49164e4aa0cc1b9a8c564449f3016a918b7fde9853286fa27479a1c159ca6d8b6
TLSH
T16DD097D0649CAB5D48209F43B0F039C230884C331C799820859080B89AFE9C8429180B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 67bef5edbf037f5b54fe07cdc429b0c09ec0f93dce83cf9bfc61ad5e515c163f
MD5 ec6025557e7860081f004b33ec3da434
SHA1 09ce2b312855c086e0d530b05b90bf00a23eafbe
SHA512 edcf17717c3cc7e5c018d594e0c1d854016152fa0e9279a9a8f68cfebd252292a815100ea849ac045ab23db3d26e098dd0d2769a1389c7469a042d536556da99
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4HZG4hT1:7I4eRfiXi+4Z6C424l4c4J4w4z
TLSH
T1D472531545048EB8294FA79AAA367E02C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 8KB
SHA256 282eac6ad6737d026bba430909d8feb7c95b8a74f80dc80800535d8cf678db9b
MD5 85735e89068674e733cc6ea285a051c1
SHA1 2386bd59c01f8ef5eff02b719f2270d7d4f9fd26
SHA512 45c49fb2d5861370259bd13866a0ddc44985253c730f8f19b435231010ce6673367a778f1e9d05c2cbe510953b9282885fa0a97426409e86b289cfc68fea976c
SSDEEP 96:xHTGxTUEqGqSvfqeWSObzS/SSltdv9j/CnNWRrem9uBw88ua8L4cn5VYB:oGRYfqdSlSSrRRfwBw88sy
TLSH
T170020F785504CF7F75B677ACAC6849705AB2023BBBBF68C610BA5485010CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 21ddc802ab77482fbb2b10c3e4049058b7fec1513448d89664939d8c4a28744a
MD5 8a6e12ec28c686169b4e108a0d18a424
SHA1 4064f0e35d4f695afb797e8d9af0b2e19eab4912
SHA512 290b23bf783e34261fe6b0fa0ad78102419a2e5b3b86055880e49d6b3917d451cf6cf58ffb7c7862c0d7945718ed3c6d92235c8877db3953ce31fe86d3662421
SSDEEP 96:xHTGUTUEqGqSvfklN1zSpSSlvdv9jAnNHKm9fBw88u8L4cn5VPB:oHRYfklNoSSo35Bw88vT
TLSH
T1DFE1107855088B7F75B677ACAC688C316AB2413B7BBF28C754BA5485010CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 1bf3e3cc8a10e67bfb63b639d71e97c5e6781ff63111e98aa060fb1ff347ee7b
MD5 79237a1a3f03a2759e87e7884ab9442e
SHA1 800be30c86640296dbcc5df3442abf20d1ee0471
SHA512 f29e4d63348d0133f68a361861f130bca846f2622fefe05639b6f48ba4e500b8df80cfd30c3cde4b62fba4e6cb674a664f9120c5b3c62f2ecb5be1b779a27c27
SSDEEP 96:xHTGUTUEqGqSvfkeWS1zS/SSltdv9j/CnNHKm9fBw88u8L4cn5VPB:oHRYfkdSWSSr035Bw88vT
TLSH
T12FE121785508CB7F74B677ACAC6888315AB2413B7BBF68C610B65485014CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 eb3f7bb057ba35cf195fa53f4e441e7c93c6d9a0ef454cf25ebfd12d1b361c64
MD5 2b6a16b38728ad1a7826524c11421e3a
SHA1 6abf82de8dbda13950ad6a3104acfd70659c937f
SHA512 13cb1401efa2c355a4e9ddf3e50e8b118592dcc48cdd7f2fd7eb8d5a48181b6cea30f4a5744fdaaa48d14945d347741c228d0bb5da24be76286870d6ebde9d2e
SSDEEP 96:xHTGUTUEqGqSvfkeWSObzS/SSltdv9j/CnNHKm9fBw88u8L4cn5VPB:oHRYfkdSlSSr035Bw88vT
TLSH
T156E1207855088B7F75B6776CAC6888315AB2413B7BBF68C610B654C5014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 c90d176823a66d28f24e9ccffea192bdbcb64e9ec0f70bdd99a19df63bcd2ffe
MD5 ddc2b44a376f7e5b4658d70d850d4f6e
SHA1 852357516181f8ee3ea51ce3253a9aaff9d353c8
SHA512 63497181edf9a9f7264e536dcee817bcb86cf2d1c8404601c3225d3f14f76380c6aab69db2ff373a4ce5a65179bcb3280132629afd51d1a85eeb22df03da7ad4
SSDEEP 49152:K8ZvOXPV8WpNYoP4t1E31Wv0kReQqIr5:VdQ331sFReQqIr5
TLSH
T1D7362AF820D1A257F3814033664593EF21EFD00C6037DA085BA956E9A578CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download