3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519

Analysis

user interaction
yes
max time kernel
433s
max time network
430s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FastColoredTextBox.dll
Size 333KB
Sample260723-d2r6ysdm21
SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
MD5 b746707265772b362c0ba18d8d630061
SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
TLSH
T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
403	4524	chrome.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad.lnk	svchost.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
4256	7z2602-x64.exe
4248	7zG.exe
1824	XWorm V7.2.exe
4820	XWorm V7.2.exe
4720	XWorm V7.2.exe
752	XWorm V7.2.exe
2520	XWorm V7.2.exe
3512	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
4248	7zG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	svchost.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	svchost.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2602-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2602-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2602-x64.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	svchost.exe
File created	C:\Windows\assembly\Desktop.ini	svchost.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1448	cmd.exe
2948	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4524	chrome.exe
4656	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292512806264708"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\xwormv7.2.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
1824	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe
4820	XWorm V7.2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1732	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	firefox.exe
Token: SeDebugPrivilege	3432	firefox.exe
Token: SeDebugPrivilege	3432	firefox.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe
Token: SeCreatePagefilePrivilege	3752	chrome.exe
Token: SeShutdownPrivilege	3752	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3752	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
3432	firefox.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe
1732	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 3432	556	firefox.exe	87
PID 556 wrote to memory of 3432	556	firefox.exe	87
PID 3432 wrote to memory of 3672	3432	firefox.exe	88
PID 3432 wrote to memory of 3672	3432	firefox.exe	88
PID 3432 wrote to memory of 3672	3432	firefox.exe	88
PID 3432 wrote to memory of 1792	3432	firefox.exe	89
PID 3432 wrote to memory of 1792	3432	firefox.exe	89
PID 3432 wrote to memory of 1792	3432	firefox.exe	89
PID 3432 wrote to memory of 1792	3432	firefox.exe	89
PID 3432 wrote to memory of 368	3432	firefox.exe	90
PID 3432 wrote to memory of 368	3432	firefox.exe	90
PID 3432 wrote to memory of 368	3432	firefox.exe	90
PID 3432 wrote to memory of 368	3432	firefox.exe	90
PID 3432 wrote to memory of 220	3432	firefox.exe	91
PID 3432 wrote to memory of 220	3432	firefox.exe	91
PID 3432 wrote to memory of 220	3432	firefox.exe	91
PID 3432 wrote to memory of 2944	3432	firefox.exe	92
PID 3432 wrote to memory of 2944	3432	firefox.exe	92
PID 3432 wrote to memory of 2944	3432	firefox.exe	92
PID 3432 wrote to memory of 2944	3432	firefox.exe	92
PID 3432 wrote to memory of 4460	3432	firefox.exe	93
PID 3432 wrote to memory of 4460	3432	firefox.exe	93
PID 3432 wrote to memory of 4460	3432	firefox.exe	93
PID 3432 wrote to memory of 4460	3432	firefox.exe	93
PID 3432 wrote to memory of 4072	3432	firefox.exe	94
PID 3432 wrote to memory of 4072	3432	firefox.exe	94
PID 3432 wrote to memory of 4072	3432	firefox.exe	94
PID 3432 wrote to memory of 4072	3432	firefox.exe	94
PID 3432 wrote to memory of 2548	3432	firefox.exe	95
PID 3432 wrote to memory of 2548	3432	firefox.exe	95
PID 3432 wrote to memory of 2548	3432	firefox.exe	95
PID 3432 wrote to memory of 2548	3432	firefox.exe	95
PID 3432 wrote to memory of 4100	3432	firefox.exe	96
PID 3432 wrote to memory of 4100	3432	firefox.exe	96
PID 3432 wrote to memory of 4100	3432	firefox.exe	96
PID 3432 wrote to memory of 4100	3432	firefox.exe	96
PID 3432 wrote to memory of 4448	3432	firefox.exe	106
PID 3432 wrote to memory of 4448	3432	firefox.exe	106
PID 3432 wrote to memory of 4448	3432	firefox.exe	106
PID 3432 wrote to memory of 4448	3432	firefox.exe	106
PID 3432 wrote to memory of 3244	3432	firefox.exe	107
PID 3432 wrote to memory of 3244	3432	firefox.exe	107
PID 3432 wrote to memory of 3244	3432	firefox.exe	107
PID 3432 wrote to memory of 3244	3432	firefox.exe	107
PID 3432 wrote to memory of 1548	3432	firefox.exe	108
PID 3432 wrote to memory of 1548	3432	firefox.exe	108
PID 3432 wrote to memory of 1548	3432	firefox.exe	108
PID 3432 wrote to memory of 1548	3432	firefox.exe	108
PID 3432 wrote to memory of 4528	3432	firefox.exe	109
PID 3432 wrote to memory of 4528	3432	firefox.exe	109
PID 3432 wrote to memory of 4528	3432	firefox.exe	109
PID 3432 wrote to memory of 4528	3432	firefox.exe	109
PID 3432 wrote to memory of 4164	3432	firefox.exe	110
PID 3432 wrote to memory of 4164	3432	firefox.exe	110
PID 3432 wrote to memory of 4164	3432	firefox.exe	110
PID 3432 wrote to memory of 4164	3432	firefox.exe	110
PID 3432 wrote to memory of 4928	3432	firefox.exe	111
PID 3432 wrote to memory of 4928	3432	firefox.exe	111
PID 3432 wrote to memory of 4928	3432	firefox.exe	111
PID 3432 wrote to memory of 4928	3432	firefox.exe	111
PID 3432 wrote to memory of 1556	3432	firefox.exe	112
PID 3432 wrote to memory of 1556	3432	firefox.exe	112
PID 3432 wrote to memory of 1556	3432	firefox.exe	112
PID 3432 wrote to memory of 1556	3432	firefox.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FastColoredTextBox.dll,#1
1⤵
PID:1676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {2c29217b-024a-4b79-b77b-fc17f85179af} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {366de326-28aa-41d2-83ca-1b025cab4533} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 27276 -prefMapHandle 3724 -prefMapSize 270279 -jsInitHandle 3728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3736 -initialChannelId {69e7ba5d-2030-4bc8-b386-a7d4c0673570} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27276 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 3940 -initialChannelId {66218360-ec93-47eb-a632-cf5f117efdc8} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3184 -prefsLen 34775 -prefMapHandle 2496 -prefMapSize 270279 -jsInitHandle 2596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3232 -initialChannelId {c916adf9-a645-4a98-8d8b-fb3c853d494f} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4796 -prefsLen 34824 -prefMapHandle 4800 -prefMapSize 270279 -ipcHandle 2868 -initialChannelId {26cf4bda-d145-41b2-84e1-e821490df02c} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5056 -prefsLen 32845 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5096 -initialChannelId {2d0bb74f-7668-42f4-9ae9-aa52109bcd9b} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5160 -prefsLen 32845 -prefMapHandle 5164 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {052472f8-d0de-42b6-a38c-9fc4124d4430} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32845 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {a73fbc04-826b-436c-9150-e56a55fd2343} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2884 -prefsLen 36718 -prefMapHandle 3024 -prefMapSize 270279 -jsInitHandle 4996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4720 -initialChannelId {9b89ecb8-7c11-47c6-9948-2628d687f32b} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6440 -prefsLen 36718 -prefMapHandle 6448 -prefMapSize 270279 -jsInitHandle 6452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6396 -initialChannelId {3f825ceb-7c51-4523-b751-b410b0014d20} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2908 -prefsLen 36718 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {0d2a59ab-1df5-44db-9187-b778533a5cd6} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:1548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 36718 -prefMapHandle 5748 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {2f0535bb-9961-4741-b236-779410498eaf} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6336 -prefsLen 36718 -prefMapHandle 6340 -prefMapSize 270279 -jsInitHandle 6324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6312 -initialChannelId {3741b269-3c1d-4ebf-b7e6-e022e7242d14} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 36718 -prefMapHandle 5336 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3064 -initialChannelId {c61d031c-cddf-4027-b746-41e78fcd6b21} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:4928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 36718 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 6476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6556 -initialChannelId {6c67af5d-df1d-42e9-b520-ad3af4040c7e} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:1556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6292 -prefsLen 36718 -prefMapHandle 6276 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6592 -initialChannelId {840f4d37-b9ea-4680-b24e-04b86036c030} -parentPid 3432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:1840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc1a86c728,0x7ffc1a86c734,0x7ffc1a86c740
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,7717702643758967600,6536839269226584920,262144 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1668,i,8713564278273106049,3692614981699994023,524288 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,11912058218321695380,17186861160698696598,524288 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,5247732985067106417,3315436120736645652,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,1868946346013176474,14654967294383293330,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,3153487871897317205,1871305456612257464,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:2
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,7582924653668861437,9914043977634314351,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,16715782512129031086,6166225846177818849,524288 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3956,i,144932434561201663,18035039135057193934,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3156,i,1251204577835653812,8475507080715194255,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5868,i,16293380736598253794,1054998043125829292,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3428,i,9577313688628807215,383969287217287368,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,10406409728365794191,4771348295203190261,524288 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4000,i,1803462618823098713,11321745097215247857,524288 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,9687266028048560167,12500102281444359275,524288 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3444,i,1384555999460989785,5902089396358919696,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3544,i,9957893580993614656,8488581486493122353,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5976,i,18170088076954641763,6608519876539311006,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3256,i,3347988664218412580,3006920751172231655,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5532,i,17391632322382600272,7745576852501550445,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=1292,i,16578428100197362612,3897663708855786566,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3468,i,14821689976509102431,5834786387309225533,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5936,i,12562332487565705501,11785178410285163499,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3500,i,18127652010343193012,10847232270499503476,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6184,i,5637864325994489173,11257647496963468105,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5832,i,6205533256526019860,16433430367811848647,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5528,i,11902092198268343711,17061505172108857699,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6380,i,10580442999587407569,3746124265386699983,2097152 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6672,i,743686817753985559,5122462973301769184,524288 --field-trial-handle=2036,i,12594002203274918908,7291360077796503613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:1516
- C:\Users\Admin\Downloads\7z2602-x64.exe
  "C:\Users\Admin\Downloads\7z2602-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  PID:4256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:208

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\xwormv7.2\" -spe -an -ai#7zMap18319:76:7zEvent31398
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\Fixer V7.bat"
1⤵
- Executes a command shell one-liner
PID:1448
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:1608

C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\XWorm V7.2.exe
"C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\XWorm V7.2.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\XWorm V7.2.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_44e08e1cbc3f43769d255f1c7d759944.cs"
  2⤵
  PID:1436
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6672.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7AC5DBE0B4BD45C09AFC312B645CA7F0.TMP"
    3⤵
    PID:1004
- C:\Users\Admin\AppData\Local\Temp\XWorm V7.2.exe
  "C:\Users\Admin\AppData\Local\Temp\XWorm V7.2.exe" 1824
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4820

C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\XWorm V7.2.exe
"C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\XWorm V7.2.exe"
1⤵
- Executes dropped EXE
PID:4720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\XWorm V7.2.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_022501d670e6436890753c006c416292.cs"
  2⤵
  PID:1968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C1B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC009678534274218A373A3CFB04977BF.TMP"
    3⤵
    PID:4704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\Fixer V7.bat"
1⤵
- Executes a command shell one-liner
PID:2948
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:4912

C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\XWorm V7.2.exe
"C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\XWorm V7.2.exe"
1⤵
- Executes dropped EXE
PID:752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\XWorm V7.2.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_9198936fed4b47ecb4af8ec6b4a71e41.cs"
  2⤵
  PID:2516
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3BE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF9C4AD3FC2C451C969726B8B5574F2.TMP"
    3⤵
    PID:4284
- C:\Users\Admin\AppData\Local\Temp\XWorm V7.2.exe
  "C:\Users\Admin\AppData\Local\Temp\XWorm V7.2.exe" 752
  2⤵
  - Executes dropped EXE
  PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1a86c728,0x7ffc1a86c734,0x7ffc1a86c740
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,9418036792048122888,4269502788718654548,262144 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,753218673425590923,10050574607248184613,524288 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,9021712728302031622,1562560338789399642,524288 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,875990125542238277,3272666796484978128,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,17004558774316984926,17483121106671107575,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,6898892738275476669,939946617349868792,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,11098654803062266717,11611552058781968763,524288 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5648,i,1703945304184476343,14396906399147449960,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3276,i,7752527030008328762,9531928085318919851,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3440,i,4189524316571201507,13480681397130248904,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5760,i,1346678221781011439,11505100421222946060,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,16682492651353777817,9655790062248705161,524288 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,3932730917475108331,6747082127598323080,524288 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,15616907788650454030,16049517264756229625,524288 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5628,i,17495907315664271184,8596497062468698317,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6004,i,6772881577011874767,13920027204829670270,2097152 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,3161193244778851869,250075656590296820,524288 --field-trial-handle=1972,i,6025323761465443780,15222882371428550804,262144 --variations-seed-version=20260722-170053.904000-production --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:1108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4856

C:\Users\Admin\Downloads\svchost.exe\svchost.exe
"C:\Users\Admin\Downloads\svchost.exe\svchost.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Windows directory
PID:4236

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Program Files\7-Zip\7z.dll
Size 1.8MB
SHA256 69fd4df057985c40e510e2fac182881c7f85e90aa13ec703f763a8fdb2ce61f8
MD5 58c9628787bce8db529dd668e1825630
SHA1 f59f722a9a0064fdc2c762100383d7babb0a57b6
SHA512 da68b7bc3281bb0f7dc1ed7dcd234dddbbb1f5992bb156f6a844f8c8bea42fecee93f953d6f4a1c7d324b456e2fe56246601f334b13badc3c21e307958117327
SSDEEP 24576:h8yTPwShrEtNwWdhpmBi/33fR8x4cWNFhzNXuzrMnM:hzTPwZ/wUhwucOrbn
TLSH
T14E954C1BF6748270D0B6C075C5E2AB9AEE7134869B30A6C712859B3D2F17EF5863D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 706KB
SHA256 307a306fd3c2e1beab674d0b60fc8b6a74f0d0d7cf9db02201f03328bf1a25f0
MD5 c8d0d6ba5a081676e091e0aee0bc1f1d
SHA1 ee542ada94412fb58dc61968efb7cc866383fece
SHA512 7cc24312b023c37a20a3ff09f769ee1000be6dcb367e8d648c19a5e83a8d9e284c6dc87cf46316d1270af08b221cd895fcbcea46de27ab908273f5ade39f46bd
SSDEEP 12288:YtWiROD0RFpHlziZZqevq6U4KxaHm/0bu6oGMxxE65Be+Z:kBID6FDchG/0a/GMD5ZZ
TLSH
T138F40966F5748331D073C0BAC5D3AA9AEE7234425B308ACB5245D76C2E27BE68736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 77bcdb2c3160a7fd4141144587938963255d18e2280ca048bae35e2b889daae1
MD5 f444c4b91d48467daad7fc304bf0b2b7
SHA1 0a54e0644c006f7b684b802915a76b0b9e907f2e
SHA512 954788cc6221a65dba3cd53452e7ffe912bdce7b20bd8cf2525ecbc1a2e6c0ba3448dfbcc8997d4347508beecb9ddb77704805450cb4090f76ac02aea569ca9f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0f19e92a91812c9e2b8d172ea68f026a44ae1d45dd330b6274a3a0107ee90159
MD5 c835ab6d04cd2946719d33e154f4e7fb
SHA1 d3de7dd59320897028e9005311db33aace87949d
SHA512 e464381817af646346e4e13ae0d3c7524ad46edcb1302578ea525d96175d3dcc58fc7107c14e4c6f9c406e191a981a491eec4717c339af82e5bc68c19940fda7
TLSH
T100E0AB9ACC72AC3719FD0B0810914745FA1503472A90891F3A7CC30C4FB072A4196C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 7e8560528f39e67b748521c72f88e1f13ec5742bce0849590c89b4f4a5b8693a
MD5 34224a31fb8dfa2a28a76b9efc0d0bc3
SHA1 cec2d3129af8f807713732c5add5c32a3ff4d774
SHA512 23448e66979df9167c0de7df716f60f500f9e5824321bc2554789ed3249d0a4b2a28078fe1d3d775b7ba6913086432b75339a7909a8ea011dbef014d792d9fc8
TLSH
T17EF026FB608A6072CFBA103060A1DEA7707ACD630181073D40F9129B93032BCB2184A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0df30a6c1e2b7638389fcd24a8e2d9f9b094eb50adaf903358edddadda3effd4
MD5 151e0b7e4e6f6210b765a65512462ced
SHA1 3c42f9a5f16cbbed34761982aa22c547b24d4cc3
SHA512 93c3841192bee2d3422124f283780f845679deadea9568cc6cbd85d64659b7aaec44623f6a74d90c6eaa6f3f15bbe346a8d50a2f8ae5a159fcdc1d6a6a44e363
SSDEEP 96:npSZSFyPueec3O2HqQseSxSXjXNeOD0M4pu:pFtyDnsTwXzN9D0MYu
TLSH
T183915DA750179163D72063FC10E6B8C53DB34BBB23475FB91CE618BDE8A2BD59690438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 e97c19914ddec80913c7d618d8de3a7a7a4d572c388a833b3234ee05143fd130
MD5 ae4923e80f56dacb43c674b6e87be855
SHA1 b3da215c33ca385b302d19f317290c7e1ecab78c
SHA512 6d8e7e97be2c111738e971d6f670c645eff7dc67a3fe5f59d3774e8fe1cc7551173677c0774bf5a678ec44252abb32e3190208445164c1877ada546687eae226
TLSH
T12411C0B566B4606BCF7734F530A0F8A33FF5866F2980373D10D55547627E1F86245419
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 17655815a8ab34a198742b2900e2eeda70d0d1f47e889dd7a11263b058fac2c4
MD5 5bf8e0a0809fc4e7ca71a1c0924510b3
SHA1 3c0f44475c316c3d7795b4b8511d6dfbc77e3c33
SHA512 b9634b90f21ed9502299f6dc5f7563092f36fd6e9035016381fb6c658dd6c63d50dc2061724f89c16fbc169c3579e24fa063629429914cdf245c68445485cfe2
TLSH
T1DB8152B754176153D77123FC20D678C53DB74ABB174B1FBA1CE61CBAD8A63D51680408
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 55f4dbce2f49893537df14693344b25e274ed1722817f0ec948ceceb5a574561
MD5 760ecc695ed728a32509426d00184a8b
SHA1 639546e63d45af7237bab9c82aa928532c2fb78f
SHA512 892c29394291367de102201f2a2dcfac4d3df2a8e4c2f2bb5d389aac45ab44db7909c3a7c7a73c86b1576d98ae57a152846c088dd39ee531e7ac86d821585902
SSDEEP 3:MsEllllkEthXllkl2zE/lQcwlt:/M/xT02zQwX
TLSH
T1A54402456B860486C5001130409193A02770D4110A129743286144275C856404C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 4740108f524a0597532fbd74298973b42c4d7668123a854b171cfa5f1633b447
MD5 2f955e3f526ea745422cc45b3ffb9d8c
SHA1 a7257f12ef940363db4a0733dd21e5b3c4bb659f
SHA512 3c64ad51541d4c75f416ebd5ca266a241630856143688159e4f8eb0e87488d691ea95f25cb88a035090a589d669489d4c551b5d69474e17952a72fb47489170b
SSDEEP 192:DQ0pYfwaJB0JExsQlN2aI8W/VncL+hODRMIjNPIaPtvrefPgalGDr71/5Nmtj:DQ0pYfwaJB0JExsQlN2aI8W/VncL+hOk
TLSH
T1F312CFF7C3E8962D881126F4AB256F1FCE1E0A14432D3C66C8D9BE4B93F2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 dc917707013090e16c0a486a74071340c41bd8f7f5979de8d4c2703d461e1593
MD5 c21b25bb7079353b88b8fecd0ed24e92
SHA1 f298e1bb461e6488fde1416b71220ff00351a754
SHA512 722347a4a41a3181a81ea31cb2fc41bcfe456230153b9fb6743f184d181adfb07421badeaff387d0461735e820c44fd5109a297db3a8932402878bfef0f86889
SSDEEP 192:DQ0pYfwaJB0RaI8W/VnULRCsE1CaPtvzfPKvNPlE:DQ0pYfwaJB0RaI8W/VnULRCsE1CaVrfd
TLSH
T1C7D190F7C3E8A52D881566F497256F1FCE2E0A14032D3C67C8D8BE1B93E2872D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 75eb5163f4e1e4520654414850997397169d9e146828dfaa29b937c0c0c6af3b
MD5 e48aa42a9ebd79fba737ab2000084356
SHA1 307f5f530a20816dfb1791383489c7e41e27ba1e
SHA512 74eb9ecbf3dcea92866dcf59f570accfea62788b96a111228b55402b040c4ff378405c7431363baeaa00c2fefc63f17cb103a263b78f9199d993197e8d0395c6
SSDEEP 192:DXBEJsX4JnyJBitlQuemXmTkaI8WBlI6WfDr71/KRIQjRuCyaPKVvofPXNPOmmtb:DXBEJsX4JnyJBitlQuemXmTkaI8WBlIl
TLSH
T1D632CEF7C3E8962D891166F49B15AF1FCE1D0624432C3C6688E8BE4B93E2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 4223a3ef3a4f52e39eefe53c187d927316da4c6a47db2624ed4ba55fa0c8c357
MD5 4509de5a7969a4cac49bdd164a53a161
SHA1 5e3e6a69b2486ed10ecacd1f00f0887f623f1943
SHA512 3ee1e318c11d767d7b6d357537c9ed3f012ebba1f5b208eb5ab1793439dd8de5ababb210994d4b956cc780e0cf439d0395e8dbda47526684032726b10348e519
SSDEEP 192:DXBEJsX4JnyJBitlQuemXmnaI8WBM2I6WfDr71/KRIQjRuCyaPKVvofPXNPOmmtn:DXBEJsX4JnyJBitlQuemXmnaI8WBM2IF
TLSH
T1DA32CFF7C3E4952D890166F4AB15AF1FCE1D0624432C3C66C8E4BE4B93E2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 94c5edeacb09c68eceef729c14b864b2741528e72b999879cea1c779b43ca918
MD5 6e95fcc2cde38103059630fb73c403b9
SHA1 725bce7d3754ab0a344d3a90246693362d4ad01c
SHA512 1b9410dbb23881ae5150e4811aa20313cb9615756c3a53e3ccd1a811c6d25cd16633bfc4a02400daa7db512e7f1497ddb351cae9fbe1e53e714c22c37836d508
TLSH
T1F1419D9796BEB41F607D597B1D057C0529BBB83502A1B8F0DFAA902CF0C6CF70B12816
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 a0d0cab695907cd31daad49fe8c000ffaf3b1555940a5e4f4e9ac9d05cb0935c
MD5 4001d3ee4518cc0fb465d4f99f6f945e
SHA1 0a0f87cd8ff7cbd0296314e6c7e25920e9ba2e08
SHA512 a33585ce015fd3e487ccf6f197961538f866f3f3305d9ecd86b9ea9365cc0bb76aa76c3e4d068d73b50058446dbfac18dc78f83fa083cfbc1f47cb96aa51e138
TLSH
T18211C297833E742B507E5E7B0E45780928B7B8350291A8F4DE5B517CE0C29F31B12456
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6baf3c87995394faacb499dbd9dcfa09fb248425101322ae2606f3593bd31cc4
MD5 dbf80ec2a354c39dcef16a5b9cfdcd0b
SHA1 2356fe61a4d736a31173f6e2dc2b777f04ec2851
SHA512 a7b3cb2c604116f9639f956766692c08d307374f6a628d682a597339b363600f7fa24bf9159079c84465859e1af0ebbc03b4a65989d7a65c14dc8d66d9aacfc8
SSDEEP 192:HRbcBziLyTiPcK2v7hhAPRp2H47sr95Hsb+WN3nL/5140S2fkkBbUxh81+VyIsnH:HRbmzceKC98XErrw3HC2skBd128
TLSH
T1EA52E72EB910397B5CCBC229F8227757D7F6106266A41EC8EAFC8D1C05EB9CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9d798ed9244f37cabdcf4c0f4f807791eda87b928e0e54fa6253f912973ffdd6
MD5 23713f6c502714019fc047a587b65f42
SHA1 736b7c6c8546f3211a428651bfaeffed6dde088b
SHA512 9fb405462c14410b14f2723c7c62b1800109ddbf8e47bc1e1cf115114a36e36039804482be37d4236b60927532fb24d64f18ed90a07563207fe2a4dfe271b901
SSDEEP 192:HRbcBziLyTiPcBtv7hhAPRp2H4fH95Hsb+WNvj31L/5140STKU2/kkBbUxhO1+VK:HRbmzceBN98XTrwLFHCj2MkBb12e
TLSH
T1C852C66EB910397B5CDBC229F8227757D3F62062A5A41EC8EAFC8A1C15E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b42dbde854c70f13d1c86d6dc531852216bb1b66a4ae8f00c21a072d9c44257c
MD5 c7012812bcc00f60fa24e52e6f3391ae
SHA1 8880d06d21bc4f68395bb73a37f8d9faa010e374
SHA512 9c9db84560a8bab53c573365b3de9e48746658293475a8fb15d53b598a1fe968219bac6a87c33aa5bd152e13ff057c44fa5f08b7f7600bf62a985076bd4781b9
SSDEEP 192:HRbcBzeLyTiPcptv7hhuPRpZHXNHN95Hsb+WN6mlou/514ggzKU2okkBbUxhk1+M:HRbmzIepN9KXJrwLikID2RkBX12e
TLSH
T15762F86FB810397B5CDBD229F8267B57D3F62062A5A41DC4EAFC8A1C06E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 919eedf38264e6fe5fd9fa1c4f9a329a30688bb38869548f6f1514d5db890f5a
MD5 478dca27d88c4470fb15745ff9c412bc
SHA1 6d0c7f3e1af601213711f27045fb22d04126de19
SHA512 9473e75cbec846d9aba269a0865b12a39fb7f921d1920561fe528177a4b4624e6df9bb17f9a1350be7b263fe3d22d53d63e45a215d99367de8faafff8aa4d989
SSDEEP 192:HRbcBziLyTiPcptv7hhuPRpZHGHN95Hsb+WNvj6ou/514ggzKU2okkBbUxhk1+VK:HRbmzcepN9KXerwLtkID2RkBX12e
TLSH
T18262E86FB910397B5CDBD229F8267B57D3F62022A5A41DC4EAFC8A1C06E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 6bd60c16b1d632a70cc26b5996ad208ff9cef233a812b7770353e7b157d5647d
MD5 22a85dccddc61148e92609b15437f69f
SHA1 e80743a5399f2a2c727f6c4fe4517a73ecd63a8f
SHA512 666f6749dea406e613716ad52216a1b2c609e7a8f0e715d4c16c7903a5d25b7d0e18d590e26e9896a89acf3d9df8b353955319bab7be14852387eb606bb1a5cc
SSDEEP 192:xRbcBzeLyTiPbwv7hIuPRpZH11roN95Hsb+WN2N2BouowBCCtKU26kkBbUxhk1eM:xRbmzIFs9nXurw4pu1x2TkBX1We
TLSH
T17962C76FB510297B5CDBD225F8227B57D3F62033A6901E84EAFC8A1C06E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 4da19bb66bf9713c54ca8bbb1634376921bb5b946939740813dbe24b2e6715b8
MD5 193e2d4314f2f053ed0aa183f2a10b93
SHA1 7ad66fa1e06df8c4398aa19795f3af547d0757e6
SHA512 b22d8228d1cd8eae1f3f569c0110cc6365156c4ff333ae8d29dc485241ac865205f99b6b674477a3bbc90b9e27f7c6f99a8db98314c41f978385d7c91d48fd92
SSDEEP 192:xRbcBz9LyTiPbwv7hIuPRpZti011Fw7k95Hsb+WNhw2N7louow92G+qKtKU2ekkj:xRbmz1Fs9nXC0rw3mu5ax23kBX1We
TLSH
T1F272B66FA410297B9DDBD225F826B75BD3F62472A5D01EC4AAFC8A1C06D7ACC2307417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 135919100f34b4bc643ad7f51c1643f75bc8f4c1b4d30a4a97f428d2dba64864
MD5 34b1fc7e11f1f4ad62f24c974943d6ac
SHA1 771a0f75f002a561ba56c2604b6f7c5c38727abc
SHA512 174d3322102e9e75ba2a0cdf589f18aa7ff7b92d30b251f01ee48cc13b4d71bee5bffa5aab373ee98d772d40beab5922bb1edfdc669f3b2d9fa8863e5e3d3a47
SSDEEP 192:HRbcBziLyTiPcKqv7hhAPRp2H47M95Hsb+WN3nL/5140STKU2/kkBbUxhO1+VyI6:HRbmzceKm98X0rw3HCj2MkBb12e
TLSH
T11C52E82EB910397B5CCBC229F8227757D7F6106266A41EC8EAFC8E1C15EB9CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c35e42c3292334de1ffde7816a4d2658b47abb7b93d2eab66d44a826740519c1
MD5 dc1503549d03f5764a47d72f696e1234
SHA1 2eb01fce855e32d4b3e20abb669cd2e55d7cc9d6
SHA512 2acc0faecea8f73091a2dd166ccfe20238afd3f6a8ecf4c0f9a46da1fb23199b0528c6174a3b8c91fd1cee1a8da1ee6d69c085255f8d2839099aa9f69e561286
TLSH
T155B01280C0419601C01702F4114254C87114AF39970A170143E4AA66C8255518118050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ae139.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ae139.TMP
Size 96B
SHA256 781739b78d0fa1cce63dfbe341eaa72b826bd996a699e69e5a32911d402fd80e
MD5 058cc8381ac77cefb4e80c6553e3cdbb
SHA1 1ebf5c8474529e646c523395c7645d988c4636cd
SHA512 08d9ebf583dd4a59a862b8a8b009a5e7033bcb3ff9b5c0b110fa9d720c889b6619e570ff382cb4d3215ef8584142a9fe222a97aedbd8af75de468f3146227e9d
TLSH
T1FAB02282C0022302C00223B02E80ACE83030CF3BC2030333C2E00ABACCA022000200A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9b443c15857adafbf57f55302a86a135138194168c6eef6ea0a9deba2494aabe
MD5 2013d2d47b626820956f6f05f3011372
SHA1 3941109611485f7a43f066d8ccb42c85602c9f21
SHA512 01daee3f8013579c053a4821167360ab7920e282e0dbebc0edbd107d24f65c21cc7ac3139d273db4190d52895561dd0b676eb838dac38b6d1e4f0b0dee31ab59
TLSH
T1D0B0023058D35052D81A13B965C2C9EA7BA85C2A4B935322C4D40D59F81B391595BC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 e692c34b6337c7ca3d83a0edc66397c67a37795c301b2e6930e542e5c7686d9c
MD5 9ddd38d1be263440ca3a1f643da7912d
SHA1 077629444fc1dc3ae21459e1e8e6030197868dab
SHA512 1a8bb865b9d84ebb2bc649fc2c1ed0d1bd722da1d5ee4e3110cdc2d3ddf673fcf178b8100d3ee1a1a6818740c930120deb01dc6e555905a6bbc50729af833f44
TLSH
T19DC04CD71611455B4730DAD93039725ED91BC25C4CE4CDE8948450061178A674903E68
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5bd425.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5bd425.TMP
Size 157B
SHA256 3effbce13587e4fed0a3fccb385f0f67dc10ee4f7ce15a34eb2543a32e2bf9d8
MD5 757f2e2fe059fe54b52e0d1ffa78e326
SHA1 126f7bbd9a513f1f4b4a84eee112ba532fe9ce98
SHA512 f647c263eb872eb7fea19887e481b0e8362b2b5e85c2cdf42982cbb1be1931c3ff027b3280eee9b0df22a4cd63c0c2102691006729495fc2741b3091adeb3c35
TLSH
T1BFC08CD3062004470730D4C93038328EC82BCE5C4CD0CCE8844570022138A234202E28
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 5fe08ab169279cd41096c3753b8834a9aeb8d82193bf288e0b2b9847a77010cd
MD5 dabf3bbd0dd57e943df9cd03815a89ae
SHA1 4d53f6497fea9601bcb6b1e0d97e290870f24068
SHA512 ceb6ff70c9b34a47f417d9bf32089951a01481a71221969925ce350e2ac76b90f67b0c84afaabce233fabfa8da74bd1f4d6862d987af7b271c2ba6c8d9cf6bd7
SSDEEP 6144:vElzg8JWg8lpU1ToakZQ2CZom7IlqZ/ZLW3ExX:c2MW1OMakZQ2CZom7IlqZ/piQX
TLSH
T130341336EF412E278E96CB50B5111F4F1FF65C8FE4B4830A9AA82AD73C86853598356C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 2de63fc8997e8731450a3861fb25559662486c59ed2a26c8354ed4edd6084bd8
MD5 b3ef3911ac7d923bbf105dbf55122ec4
SHA1 5f6dd68e4e12ce4aacf1e4c0f84636a074bf28a1
SHA512 ae586a8cdac614d08edb9e94a99b397072138b7f130384ce8a85507d70f9645f5cccda47b54727d23fb6025ddc76d369656db8dfcb2990408e9fdba89cd6c7b9
SSDEEP 6144:mlzg8JWg8lpU1ToakZQ2CZom7IlqZ/ZLW3ExX:m2MW1OMakZQ2CZom7IlqZ/piQX
TLSH
T121341336EF452E2B8E86C750B5121F8F17B65C4BE4B4C30797AC2AE77D82893158356C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 163KB
SHA256 ca02ff253f081001db942b946161107edce71eecb848ebd431fa5cf8e3233061
MD5 ba6ab9717bcaab009f9a56cdd9799287
SHA1 2bcd22e740407d5c026551d1a2c2ef24779e4a96
SHA512 e778a6736d9bd588ca9bd179943731b435e7e62c40f3cb9f8ecf74d8ddbe276db0c7b821e4d1a0bd3da24f58229ddeae8e004f562f0033639e87c6fde6b5fb68
SSDEEP 3072:fs+THPIILwjb7LBZJ/3ONGl4seGWg8C28gLxU1Q867IDoxZc59MCZom7I0:fhbPhkjlzg8JWg8lpU1ToakZQ2CZom75
TLSH
T128F31234AC552C6E99DDC786B1162F0F0AB07C8FE8F98A7B89944AD435C54F70B8362C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f837f9a9aba8a93f5db0bc0215d519ac667f66ea954b7b505259fb2ffa7791f5
MD5 112123fdc32d39a82cbb181002054713
SHA1 8f3c529331fc9341f895e516d136277300625add
SHA512 d62637afbccd7442985d0bc8453abdcbcfed6205962349a819c36ea6ee49d842852b722e5f2e3140e46cfc84a7a599293bfa1ee9981aece29f98a52739f8be2c
SSDEEP 1536:6UyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Tqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1F4C30237EBC25F339D82CB64BA534FDA57B644A99030D301AABD3BFB6C9345164424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 0ece731bdc9d89c79bb31360109a9f42c7c443935221655f8ff7605acfafd9e6
MD5 9146d885be22787ab9c81dddbb8e7afb
SHA1 1305e2e17fa29b07552a8d40d167b6c08ea68180
SHA512 5a70439dfa7b110ae9681bae96b2ae539ab17599b87e075b0b6756b8fbe41d693ef4bd90229b8c08e92fd131dc7682dfde96a2ea2159d2d58ac10620e60b5436
SSDEEP 6144:xlzg8JWg8lpU1ToakZQ2CZom7IlqZ/ZLW3ExX:x2MW1OMakZQ2CZom7IlqZ/piQX
TLSH
T15D341336EF452E2B8E86C750B5121F8F17B65C4BE4B4C30697AC2AEB7982893158356C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 e800358069863b2e9cf95edb25e779a08be9d15ed5af34862dc4f06e49b59e87
MD5 d228f20f93a476970a1fb860e4ac00d8
SHA1 b5547591ed09db106c6358c722468fce1b9105bb
SHA512 52e1c41a7c227f582a4af2418350a202c68d57f70f9c4841705a1cd56eafc66b342e2ecda27c4ccb13d7d6ce1bb0337e5638442bc6fdee7d13ae1da02904f1ff
SSDEEP 6144:cHlzg8JWg8lpU1ToakZQ2CZom7IlqZ/ZLW3ExX:k2MW1OMakZQ2CZom7IlqZ/piQX
TLSH
T13D341336EF412E278E96CB50B5121F4F1FF65C8FD4B4830A9AA82BD73C86853598356C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 2f1c6bb1bf09e4c03613da4f85e3ccb779e241dcc6044dc0b0b98aaab5bf2a62
MD5 027d2874151ec4803ad413ef2c0d0e26
SHA1 1a1711f349244de8674f2eb07ace4ff8010bd7a6
SHA512 c30d470fac5ef3d647612788b3e8d13b8a9c780b4c8f2d0a20aba6fde4e1b9805afd6f9f14d0725d5d41097bd5f0b76d6714d81e55461899176afa19a300c9e1
SSDEEP 3072:a5b7LBZJ/3ONGl4seGWg8C28gLxU1Q867IDoxZc59MCZom7I0:aBlzg8JWg8lpU1ToakZQ2CZom7I0
TLSH
T142C31235ED143D8F8A6AC785F1053F0F0EA5BC8FEEF54A6E85D44E8425898A7178362C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWorm V7.2.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm V7.2.exe.log
Size 226B
SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
MD5 28d7fcc2b910da5e67ebb99451a5f598
SHA1 a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA512 2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6
TLSH
T1C5D023603795D1C549577F54181D2A4881FF0255B1109D14749572DEDD345671F311E7
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 105c7741dde8e4d9e4296355061ab47175d57c31b5cdf1c5f35094987e521528
MD5 93972db81e7dfff8318b5a2e28884d45
SHA1 41fe2bb664533009e81c90753f7e6b8cc4de9a24
SHA512 7ceb0e448aaa2db43c9d4d2be859ca7403265680701aa772a0589d05fd0052349ad0b9cccb810a8834218a89d66310463d6790a6e71555e9c6ccafc8c5ce0b5f
SSDEEP 384:HwCe7iO024Y9dcs3hk2nhfdDE2Ba/rIVy8e89X+I9X+V:QqZY9dv3hk2nhfS2sDIVy8p+w+V
TLSH
T1F8729EBBCF416C5D1927D585C9A99369DC04FDABCFF690B608243449C784326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d6f7ab5397d805083fefa42b181305d.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\thumbnails\9d6f7ab5397d805083fefa42b181305d.png
Size 6KB
SHA256 22d1bb1b7dd892e55d930f316fe8448a2324e297b741de69048a3ef3c4f2b38e
MD5 140e96b619d085dd5d9940c334e74897
SHA1 42f22c5b5a72845fe4b86b2248f4be7d5562a7cd
SHA512 7f6f557864f7479741bf0830b16cb7dd838bcdc50cdc3ba8c3a625020ac25d576ef44cbc3736db4b3da51c8a05c7e80f25ac50bf260d134d4b56d31933c4d63f
SSDEEP 96:N8IgTRp4jtg8pGzRf3I23ECP1zS4cW2aIdEHxok0qpF6666xbpaXLx7Jx:N8Iu4S8EYA1Wtkra7nx
TLSH
T153C17D3CF7C7408325FCA4F50DCD0A426634FA8EAD21A74DD7AB2157995F5CA3499011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6672.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6672.tmp
Size 1KB
SHA256 6fe3eefa7f8cad9bcb8dca53ac11df251c762c15e6940bf090ed10a648c3bae3
MD5 0b38f367ee2f19a18db4718a7c76eb45
SHA1 bf64a1aa39db1020c64e847433e2dd5157baa61f
SHA512 3e0ae6a72928f717da6fabff22f0c8b63a64c1734bdd44525d427100b1f63728b6532ad1dd2ec0ae62480e47bbc1fafaf6920467585d0f3b9d4fd26799fd5137
TLSH
T17541530583EC472EF173433128F7572AE278BE45AEAA535EB084123E1F02640DDD36B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES8C1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8C1B.tmp
Size 1KB
SHA256 b803b1ca53867af4e0cb00a5217795061d59d7478218ba389f45b42349a4e754
MD5 edf2fa5122c975657bd7db484c44182b
SHA1 e42f875ad4202844d5613f32c0dcbde9487fb364
SHA512 f30896b649b5fa7bc9269a1384c00cc66ada38056cb6cb1a1afabfaa911ddcd29413fd23dea518ba4519eab28c2f2ec8cbf72203b9c5e43046aa35641f8ef270
TLSH
T1B941114583EC471EF172473128F75729A274BE859EAA575EB1C4172E1F42640CD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

XWorm V7.2.exe

Path C:\Users\Admin\AppData\Local\Temp\XWorm V7.2.exe
Size 5KB
SHA256 6da266f08524c38b1137ce09dc4349abf194a109447bf18e958c4478d55b92c5
MD5 dcca3d0ca674b7be4aad0836de26b521
SHA1 56e1751c0386b44dd7fda3eb5300cb44bf1f474a
SHA512 1e0047aa85076e19c96a17c82f253d495a5d6b85d942133bbbb3d8c90dafd85c6863a41c9bb39e8db60c6f0f6336236372f1af6052e73dc39a72245b75b660a9
SSDEEP 96:Zdew7V9yCHqYeSs1c8BynqgHlNxG+E27aotQnOzNt:ZvdaioyqgHja27kI
TLSH
T119C1C54B979C4366E0B3077168B303523774E8129B7BAB6F25E4537A6EB534008937F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
Size 10KB
SHA256 02af662e1301b1f03e7fdc0c7081840ba54671a9813d80ae291a639e1a672793
MD5 3100f8eecc64ad95f7b4e9e89f6129d8
SHA1 3596c44f60b0e42a026bc7c9b86953f119702383
SHA512 0c82291ef279d4ce447953f59a0864a9c27ed092687c3415e1b5dc900bc20b7c89ba1856998c0089ce2ea90f47a8e5d933bff3c4b2210d18dd206d2abc6323ee
SSDEEP 12:mmQphMQSQq5DOpjlzOpKpyF/nc33mclc3X/yG9qnc33GfG9qG9qjc3X/0Pnc332m:juhMZfV+lzY9PcYqPez6PTvNS3tKq+v
TLSH
T1A92287FB23725013E0E1AFF0C0567988DC770349667DDD848A89A89A12D27A5D06EF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
Size 21KB
SHA256 1328243c606c3e84fbcd1c2487af49e9502d115c36adf165f01a5ab868bbcb91
MD5 76ba45b7ea0751de31e8d29002f6413c
SHA1 642564f78d8b517742e1738430d8bca58f888b33
SHA512 c1a0e866c32ffa1f00a53e907ceb2dd1eb865de69145a696f0f8c863c18878b0ad378a8265be6cb9dfeced9131efebb7066791969a2e015f462f1a83b2c6647b
SSDEEP 96:T4LRzqG9GjGu2GhGbGKMlMZB0bqbJkbItrbuy:lOFkktr
TLSH
T195A2A6EB63726013F0E2AFF080AA7588DC7307165A7DCA84CA45949613D27E1946FFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
Size 22KB
SHA256 102f36429a5da5ad8173a813a7b8333d13910225df2252e5e51ba732d27341c0
MD5 f456b17bb154aadfeb9d7d27156fd0cf
SHA1 b0c0cf516ec0059cb580fe7a9d79222df48172a8
SHA512 c096024bdea723c5b080f2ebe9ec73e057222f7bae375209ce73502433433643a14b1551bf21d219bd031b4b9b3f357530355d2f10800202797e60531debb2ed
SSDEEP 96:T4DRzmGFVzUGhGbGVMlMZB0bqbJkbItrbuyN5:BkVwOFkktr
TLSH
T1C8A209FB23726012F0A26FF480AA7488CC73432659ADCA84DB14919643D7BD1A07FF9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 b399469b3abf3c60b5e5aebb91d7da3af99abc8415b052004a29b148f5ce6bd7
MD5 63522bf01e0f0be679469c7738ffff61
SHA1 d257019e0994c1deb0099747f1260e88f0f002d4
SHA512 928c8b83e892f84756528401e50f2958271d486e65a07a8d99b648939575cde6ed0ea9470c9695f1c9af5dd4941ef075e5dfdf68cc4bda8f45ceb13c7579f09a
SSDEEP 768:QDg2GHUArGcmhuesyKhhaJTDym31aubGbMbYbRbZbkbcb7bmPE140AcTJ6Ubf7EL:QDg2GHUay1PE140AcTJ6Ubf0
TLSH
T1FC030144FB1A953FD45812BBDCA60B002F78F88959192F573A4CA4786C872DC3D9E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 44f71d0af91c49c7d4e25f076f7830042e0f79c58a3d0ab70094adc40c04526d
MD5 b8fbbc653ace7f2292779bd65b261f4e
SHA1 600f8f183f99056fb4867bb17ca5eeb0d84ec19f
SHA512 8fa2866d2414cd74a49bd94c5af2787ec40f27c8cc4edd2a8ef38b20442fede115ff4a07bfa065bf4feb68943e654ddeda71f1d93126bf357d498a535b88e762
SSDEEP 192:Jb1d66JozGzgCl6mc0d4Ov5zbowZRgcyj5:JZd66JozGzgC1jJbowZOcyj
TLSH
T1C3D1DB68F629863FC419423BCCA61B400E76389A984E7F25319CA4182D572CEBACD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 58d0671c7eb59e3df42d52adff22ebee84919da9d8710a66ac5d96f690b0a740
MD5 d3cce1ee9d3ba4d466df087bbc00901e
SHA1 e65d6d1b3903a3d4776c1a7d490acdb0325d5f02
SHA512 da87511463d6e48e39aa20e94a5c447e2274a3caf937cb0378c5614109d1b674f83b391621f4222c1cbe2bd66f5b8282e9baa71fa5ea9d78e5f9018af630eb81
TLSH
T19961C858F22A863FE045413ACC921B412F747456D8AF7F2A35ACA04C1E4B2CE76CD57E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bb104bcf15404cd9ef841161f5d4f5a40a7d48904c866b571108ed40f082aa10
MD5 e857f712ac4b2aad55f3967870ee2d1e
SHA1 fc09eda6bdeb5778b81c5146644f7d3f1fe76aa5
SHA512 ad50e344de3ac7ff70e6955ee7dbb82ef861e4eb7b7b72c96d5891ef84bf55d1e38cba22d3b355d0f612f3b34716a8d1d2e3cce3d291762319daaba494901ed3
TLSH
T193216A9C39B94D2A98CAF39C7442218E57964E07099B1D530D22FF8DCED1EDA326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

1d36e17c-2367-429e-a44e-a44b47fd39bb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\1d36e17c-2367-429e-a44e-a44b47fd39bb
Size 2KB
SHA256 4c90fa3671b3c14b9394a569ed14a9117601714a75a7a9cafe355d20e747233a
MD5 c12c9ff22ec58761df8a90eebe274926
SHA1 046efe9fa80b4db6037516db7fdf0e9ba7a6f15c
SHA512 1d2909d9bbd6e54b40b03d11d8f7a23d9b18db6e431e049adfd9a96259429c462957da3f99059bd23cf8dd3a42fe3b461d4bad08fe0273eda4068d4fffb0c9e9
TLSH
T19341345836BC5C775C9BF59DD441334E57B85B0340C258432EA1DE0C8C9A6AE73AA43B
MD5 SHA1 SHA512 TLSH

Submit Download

2881197d-fded-4fc7-b00b-c5ca07091523

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\2881197d-fded-4fc7-b00b-c5ca07091523
Size 235B
SHA256 d26069936532972f906261e52f269646851eeeae04915580ffbb903524dd88d5
MD5 6d6985b1b5aeca3b03a376a6b02d2bdb
SHA1 9ea2a493831f28d9d92d49344a6f2218913ab25d
SHA512 f32139204d191bdc2ba5192842d7f45d6b850f2cf398fe9a76cd344782dc0cee88b6c073ce18e59b3a5e6a3e5d2087bba759b564d57b366905a69e0b61a779e0
TLSH
T171D0978464982FAC08101F1AF0B03AC630998C3360746860C99288B8CAFEEC48132816
MD5 SHA1 SHA512 TLSH

Submit Download

672ec2f1-7011-4761-abfe-7e04aa2147d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\672ec2f1-7011-4761-abfe-7e04aa2147d3
Size 15KB
SHA256 63669e52b8bc450883c6b6eb8cfcc1305add8eaa6e85c3754c85dc1d027d9dd8
MD5 91d57c61325661a66b00323f29dc0493
SHA1 7601608889f5c6510643fda132397ba21ed60ca3
SHA512 7c9ef9f73f0040684d2c23f09f3008c30999d97b0db883f7d0cd3abb03ebb583903b05831ef3d4679b25f0bb79ebe1d0fa4adfc17e9c1f34a244a622ef98c810
SSDEEP 192:DA88p0BJ0g19mPceu8IlIUzTPJPmIjmbDSIzxR9HbKpgOmXFlC6pvqDeC9Bm743G:DADp0jYRunxzTwIkDSIlR9HbT
TLSH
T1BA72D9566830457A8291E36894ECBFC3E5F538CB4C419FCA9BE4BD086DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92485352-d3ac-4c55-a077-831fc865d0a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\92485352-d3ac-4c55-a077-831fc865d0a6
Size 886B
SHA256 f85924d557f196cae2fcd0fde4b7d392343719322e4e830cc405fe244da3114d
MD5 9d04305f5f8b7215ca48346c9ffad779
SHA1 bcc27520d388c27ab4057f5c45ee355c4edb959d
SHA512 c7e1502be455278055000ba6a420c5538b6bb7d668a6c2653e0bf2a4fb9efbb75ba0e73113df7f021dbb2557a73d5b3e1113f61456ef23ff1467322d63d1f404
TLSH
T102110090AA79B4A28C39D64B95A17B428BD07433C0C55A087E908A180DEB51FA3A670F
MD5 SHA1 SHA512 TLSH

Submit Download

9d07fab2-4f1e-480d-ac03-e17e3e96d1b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\9d07fab2-4f1e-480d-ac03-e17e3e96d1b8
Size 883B
SHA256 ed285a4f566cc21c9422cf81e552f9ef1e0f5f5584f2bd3b16c2bc56d15e2aee
MD5 7e0c34fb498d602cd867c33fa2db8ca4
SHA1 05d7377286f5e92533afaac4dacd82ce8cfe55af
SHA512 95db47dfa1b3ae2e10cd062ef31b2a34bc2d5ce6e04d165e426fc83d1363d3e4259430b9d5b30b4ef4420602dae5c49d567ac720d6b7fcda7a42a4fe5253a7f3
TLSH
T1B211C090B739B8A2CC78D24B89553B028FE47623C0C9D5143D90DD180D7E52EE7AA64F
MD5 SHA1 SHA512 TLSH

Submit Download

e9fdbe82-405a-4eb2-b778-ff2b5ba08407

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\e9fdbe82-405a-4eb2-b778-ff2b5ba08407
Size 235B
SHA256 2f31feced22d318fe98a97e35f52750b4d113aa2424990425588095e1c1444c2
MD5 bd2b7b07b6c980cc851270605db976dd
SHA1 5e6bfd39ce780446f1b937f03d15aca37fbec919
SHA512 9f4d94dff674a469462a1bf4687475eda44de990876e8fffbc24be25166d9d6b31b1fe6e54743a737f924ecf711834a5d4ed9b932b78f16ec4f978e599f1bfe7
TLSH
T163D09780189873AC0C044F07F0A06AE634E88C3714B86810EA6801349ABDFC40152A07
MD5 SHA1 SHA512 TLSH

Submit Download

ec6ae380-959d-409a-82de-7d5a63623a54

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\ec6ae380-959d-409a-82de-7d5a63623a54
Size 15KB
SHA256 972b2817b4dfe88ccdc5027d813935a498fb748d5006ce3248201828ec6611af
MD5 67bd200e8edaa72c30b4d8c65dbb53db
SHA1 73d9a52dfa82e705d7fcef809e3c0200bec27071
SHA512 455a69c33ea3a3deee944a69080726c4b6452aec9f01277b65094e5d054255f0686a07c843f7f64f7a57e67371366c81b2eae1d10e6c7b93df65e2712a9d27b0
SSDEEP 96:qvVN7wUm4ClgEwVVXI7XKDnoeHvECbnzPWK8qhKykwE8DREDrx/rG/YDYaL5CgPg:qv3+7Mqz0fVfSlePX+SE29jI96D/
TLSH
T18172ACFDCE12014B3D65E51AF6E9EDAB2057193209CCC79E6AEC483A27C6D7B0563324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
Size 16KB
SHA256 d14ec61a8cafb9b2610a2a9e8b653cb34141ed943c3bbe7087eb16a3c249eee4
MD5 9f4a6f7a5156cd4324bdfa40473ed406
SHA1 4186c24d1fccee0fca2418ff90c59758e84de543
SHA512 09108fbe1e87748c3b920c34c6e25884b942e7a7ed21d5fcc8c6f92af5631efc90748a9625d506062956d0bf510df95ba67b3c40995f483307c7c7331b746da5
SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4H0IG4hV:PI4LRfJXF4F6Z4y4U4f424I47
TLSH
T12472521545049EB8294EA79BAA36BE01C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 8KB
SHA256 f06714980e45167832c90462887b33378ceba0c74683efc01d68febd7ce0242b
MD5 289f6f3555adf41d425ba8b5ae0e7582
SHA1 27c4d8b44da718463dee074a3045c58c27476a78
SHA512 6cfbf3ee1525a60ba19544eb752c4abdbfca40e2725aa540f9d61be8e20d3b2e432580a54ec90d6e6c8de6d93a438ca96750af25d3a2ac0d07e8f86d1f7ac595
SSDEEP 96:xHi1TUMqGq/ff/SObzShSSlmdv9j5nytWRK5AsO7Hjv4Bw88TbjR8L4cn23U1jGS:UCR/ff/SHSSz4R1sIHz4Bw88D0
TLSH
T1D3021D386014CF6F64B6777CAC28897159A2023BB7BF6CD610B994C4059CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 11KB
SHA256 4949d3f045b2df2508ca31f81a86689fa9f4d846d4d2e475c3a97b0295551a87
MD5 f571059b20378d26607c7cd6aaf67784
SHA1 763f19f2e13e79221461d7b3f5848cd141e58bd1
SHA512 d2c5921dcc92ae82253fd2639482a11cad3d2a7dc408e62deb33210c6bfcdafa6900b2addefe4e55477968d7ede7dcaa4fa04a5865ca7177755f4238380fea34
SSDEEP 192:UCCR/ff/SHSSzrLR1sIHzMOBw8O8lE1qzh:+GR15weZ9
TLSH
T1A142DF3C50508F3F20B6327DAC695DB059A6023777BFBCD205F8A891089CFA541E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 21ddd67bf7ab0f33ff54fe144a594c9e6e5cf6a3b588405f5dc88a19ac5d2a0e
MD5 2d29f7bce478262f10f322ea1d5ae079
SHA1 f47bbedba58521ba85993d657540f9dea7603397
SHA512 bc61a1810a018b4847917f8990b1d26cea94d255b9d3b779550f9134a530a972cf1fd3b7f72ce5c5bd6552b50f10332c431f5c1cf661043e06e0e0594f70e11f
SSDEEP 96:xHiUTUMqGq/fS/S1zShSSlmdv9j5nytHlAsO7HjvsBw88n8L4cn23U1jGS:U/R/fS/SsSSzxisIHzsBw88C
TLSH
T1ECE12F789048CF6F64B677ACAC6888716AB2013BB7BF68D350B594C4015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 854976989981136ea51309961d655e48907c460a642ed4812e9e754891e2c8f3
MD5 ec3841a27a1e2c384b1ab3ae54aab9ee
SHA1 ebd8ef6ad0fd0119fd0f2cc3ffc7c3e672a31f6d
SHA512 286282d07dbf03bdd43d0972971967e9ca03a9fa5a63595901a9514d6c3c3d62cd7fa36c626c7a9536a7d1c402a2fe03b620a71abd8c4a7efa5f2ea77097a0aa
SSDEEP 96:xHiUTUMqGq/fSrO1zSrJKSSlmdv9jp0gnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOwJKSSHxisIHzsBw88J
TLSH
T1A0E130389008CF6F64B676ACAC288C316AB2013BB7BF28C210B594C4005CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 cf0773736642ad254fa82317daa9736003fa007f8534ce61a3c4fb5c43ec36a9
MD5 8269e501eb8495c2be0c2638499b1b7d
SHA1 c5435bdcee5b14e41ff902eb4ddc02779d04a83d
SHA512 9aeafc28b1b81b4785c8cf28f601f86e8949a8b945b310bdb628460d7ac683f109e9c2bbb74533243edf919d55deb3c72fd377e9427a89f15e98078df1da9a64
SSDEEP 96:xHiUTUMqGq/fSrO1zS+KSSlmdv9jp0gnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOnKSSHxisIHzsBw88J
TLSH
T108E130789008CF6F64B677ACAC688C316AB2013BB7BF28D650B594C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 309bc0d0538e7ec61eff298e355602be7e1c2dd849d2556d3d8f36d21d8ac5fd
MD5 c719411c29a7ddb6945b112596e94ab0
SHA1 ba0690b6b6692a0fc0a6442426e1d3ecbde8c4d4
SHA512 394bee6635f61c136a2e197dafac8ff747a62868a12ec162f863a051ce072d3b134941a9b2481c1e9c3624b1f9eb70210a2a1b1894c5487aa26bb00dfca41dfb
TLSH
T17331C8C52E1924B30B54D25754C40A98D1F1759742FEDCD0E21C1F124A5C90BAA9E247
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 30386482cc4c54eee12fe9eebbd41ecb01c8f898e5426d18068fef8f70bef6b1
MD5 acede391abe3d13ed1a2743ccfbce5dd
SHA1 1ced74922806d251e41092cef6ff9de894bad8f0
SHA512 8056dacb0e8645c04ecb927c9625b61a5a7516618cef16a37e2dd4e1b33cc02257287222afa1bad4af0bf68a8f203391297fd6cd57fa5898f7faf34e4c62a502
TLSH
T1FF21E787FE1F3CF31744929AD1C92FDCE696102242BCF9E0D95496021AD8A2B37DC755
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 56bf611386bb6d27b345b1dc43388eb8a7fee6ec31e2408be449504a8976b648
MD5 a41a7322f86f8c4c9e57b050e705b0ab
SHA1 d00362b0cc71d9dcd6b26d46caebf31c75e5d440
SHA512 135b698b50cc45f50fb65deed1812b7fe669ef73e182439da6302df43e77031009492517cc886ebae1a992c8027b19880c8ea0ed473ca29757234ca916c75487
TLSH
T1D7614B882E1F66B64630D2C28CC9591AC2F238EBC6BED964F11C0E42E65CF5168DD943
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e7ff5c46f32e2e2ef059b98ad36fab3aee2932a60b7ae73718d77a3739481206
MD5 fc8d0e02983fa717c0f765073fc7395c
SHA1 6e03749e8a4cba0f7a8a4562a4b45dedd1f1833b
SHA512 18e1159e907a78f0b89a4941041407e0d2540624213493c8554e959744d9f5e6f2b3049716447175947922cff95b0ba504e27a3f8d985a3a9824cee54c0ab1b2
TLSH
T142210603A82B2EF13E65A362D0448FE9D749383281BD94F0C4A88A0206ED08E728A618
MD5 SHA1 SHA512 TLSH

Submit Download

Fixer V7.bat

Path C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\Fixer V7.bat
Size 122B
SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
MD5 2dabc46ce85aaff29f22cd74ec074f86
SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
TLSH
T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
MD5 SHA1 SHA512 TLSH

Submit Download

Guna.UI2.dll

Path C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\Guna.UI2.dll
Size 1.9MB
SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
MD5 bcc0fe2b28edd2da651388f84599059b
SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
TLSH
T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

O.ico

Path C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\Icons\O.ico
Size 361KB
SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
MD5 e3143e8c70427a56dac73a808cba0c79
SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
TLSH
T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MySql.Data.dll

Path C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\MySql.Data.dll
Size 1.1MB
SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
MD5 94e00465e44f5782938e27df2dc7362e
SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
TLSH
T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWorm V7.2.exe

Path C:\Users\Admin\Desktop\xwormv7.2\XWorm V7.2\XWorm V7.2.exe
Size 22.0MB
SHA256 aaf576ad4fef9e2e6171a44d38500ff2d159ce9bf8b062d17d77aa0215a5ed91
MD5 07e59ddea5e89f528a32af2fa7d1df5d
SHA1 1c9b98b480a58323736d5b2dc8a248b22d24dab4
SHA512 f69105f5088a1f17027e9db597bb1139bd932f645103637b77d56d54b9401223d7dee5abbb7c8b81b70a54b848ec526b15a8784aa467c1ed54c5571d3b501bcf
SSDEEP 393216:wcT2YTJvKkCXxcQctoMhm3uIv96+bjaLUjeuzD0yGgc+xuTFXEd:hThTJvKkCXxcQctocoXvEWDjV1Ggj8ZQ
TLSH
T17C37E03E1342A51CC25C0E7A96C68E3DD399486DE692FF3702DC903C45CE39AA676CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 135481.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 135481.crdownload
Size 1.6MB
SHA256 6745fa76dc2ea031596d8678f6f6b99c3c1b435b4164a63485adbbc7b8d82ef0
MD5 0617e5373e5e311fcb4bee506e046359
SHA1 b563e139acab81cc7ddf358bec6cee1e6b8b2b17
SHA512 85389eaef377aa9fef3155d2e3375c1fff77fc10e39d9312cab229f202f3aff78f6e807460cf6b04bc2a32f72f7853afbf475cf0dce6232a40c0a6f8ddcbe4da
SSDEEP 49152:L6Cx0Yr+pwKQtSzhTnSwIC4xQlMIUoks8KkE3XB1:L6ChSwbm4wIvxQlPkN76XB1
TLSH
T10D753302D1A0817DCDCBC871D6EC9E23E132B10DDB605E6BD266CCCEBA21A119EDDD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe.zip.crdownload

Path C:\Users\Admin\Downloads\svchost.exe.zip.crdownload
Size 490KB
SHA256 23d77f283ddd9ac6c4e515c0f32aea04c4ef981e48cde6a4e7e57d6bf4fddf38
MD5 9a6ccfbebe64d9ccaf6222b231d5fd34
SHA1 757db94e99aeff9820a6aea619043f49b36a002e
SHA512 fc84acb74d9534c79c04937d840d8c04196abf2eeab2368ae4aaef707effbbb875054a7be3e23fec03da1eafc52df28effc9ab3fa2ba662779e016be325588c2
SSDEEP 12288:MB+AWBsmW7kDMyB5XajpYSCuCOkvxGBWb/lA5I:MB+AWBsVgDXXGdKeI
TLSH
T1D3B423FEA7A4076B401147A7B951CF1423608831BFF55A9771DF069A260AC677E03CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 44KB
SHA256 004818827ecc581f75674919f4605d28eed27e3f2229ae051d6849129eef40e9
MD5 bc3d1639f16cb93350a76b95cd59108b
SHA1 47f1067b694967d71af236d5e33d31cb99741f4c
SHA512 fe44f3dbd009d932491af26c3615e616bc0042741dc3815ffb4d2b8d201efd8ab89f7cdd747406609393f005a596a6e9ea8e3f231bc150dc406c2adb8f806249
SSDEEP 384:5Kb+jONlkgBTFy1w2I8CIqrzJtHvSzB6prHVfFi1/l4:5Kb+j2tTFyuhttGBKz
TLSH
T167230E2007DA162DF2F3AF38AEB45185AD96FDA7BD32E81D2250118D0472A51DD78B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 47KB
SHA256 701a06fe6f778769163a103493bcca29bed41ed9935d430a89404a9a9e9dddcf
MD5 31a5fcb3c593f1a47bb386dd50b4ee7f
SHA1 d6c3b21a030104c62c44e329a0f7f0c0544c5727
SHA512 86ac70a4085e0b197f295131034c38b9bf64ce826cca4346a08a7ce1fc5ab0d64826055cddaf66f75e397b17ccfc68d48ec0a2d9da28fbf9dc103955192a022a
SSDEEP 384:W2w0gdgEbiGoLxGtGsoqXT8YwiwHGDlRrrrgkqhffYp7eYim9YB8jqTuYm6faACb:jLLxU1GSWnWRQ4
TLSH
T14A2365145AF95706F2F3BF38A5F955159E3ABD52AC3AC42C0260124E0DB6F80DD78B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 43KB
SHA256 a7b3a2b6c67e98cf2b13684c8774113c4ed4f60cd6fc673d4c9dcb360c60ce42
MD5 8b4b53cf469919a32481ce37bcce203a
SHA1 58ee96630adf29e79771bfc39a400a486b4efbb0
SHA512 62217e68c9e4c7b077e127040318c603e2f2cbcc5517ce0cfc6189e43023f8d8a05b8e694b2a35d4b409241136a1067749b7b6e2049d6910246d8c0fa6e9e575
SSDEEP 384:U7jDZ3S5w/cf6JaTnWv76CJssfg6RqG6NOiMSJtNMLzpbyf6HLb7D7OY136plP/l:SISzZ6p19LRGwVB
TLSH
T122135694A7E90206F2F3BF78A5FE15059E6ABC57AD32C41C0251018E5CB2F91D9B873B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 42KB
SHA256 e88439ae381e57e207ce09bbf369859c34b239b08124339534dcc935a89ac927
MD5 bea0a3b9b4dc8d06303d3d2f65f78b82
SHA1 361df606ee1c66a0b394716ba7253d9785a87024
SHA512 341132d443cd41acf0a7eaee0d6883c40d8a4db8c59e056211e898c817c2847377f0208ed3a40e0fd6f73f0196ffcc680c55754e160edafd97036739861a6c88
SSDEEP 768:0hCx4l7JXlrCEEeANv8YjT1Ibd1mL3kLVGLTAr1mL3kLVGbroY:0Axo7JXqPzt
TLSH
T17C13BDA597FC0609F2F7AF38A9B856165E3BBE666C35D02C0191115E0532E91ECB833F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc011.dat

Path C:\Windows\System32\perfc011.dat
Size 32KB
SHA256 33295c7ee1b56a41e809432bc25dd745ba55b2dc91bfa97aa1f55156880cd71a
MD5 50681b748a019d0096b5df4ebe1eab74
SHA1 0fa741b445f16f05a1984813c7b07cc66097e180
SHA512 568439b3547dcbcce28499d45663fdd0e2222f6c5c90053769ce2585f65721f679c071393328bde72c9a3f03da4c17abb84b8303897688b59598887ceb31438e
SSDEEP 384:Urm2HB084SY+2lmg/YFgfJhFeS9+7Gx9QVmNYDkHrJBQl6wmT:BwwR1fQRPl6f
TLSH
T179E2F2A44BF90005F2F7BF7CA9F59002AE6ABD266D71C41E01A1110F4972F61EDB972E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 320KB
SHA256 1b25a6879c667258cdb900683004ef007c6b3a1a933d823b124d9a6acf9de608
MD5 b9a5000ea316ac348cf77beb0e5bc379
SHA1 4e666af14169eb10a0a08ac2f5ed5ecf4764df46
SHA512 9fd911586a0aebec11c48e9f78de3b3f6e41c98a2770f5ac10d0a3947b4b3f326a8c5028c478c8634fb84a071186606e69a7aff83b1cf972d4728e3923503118
SSDEEP 3072:MhpwBxTEsmVdx1wN8EBNjcbg+hSILPDtzcSx2A8q1JuqaB32rSrSQYCxly/2dj9u:6
TLSH
T1E364A96153EA862CF2F77F646EB86254AE62BCE6BD79E94D1340209D0C71B40C974B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 297KB
SHA256 9a60acb9d0cb67b40154feb3ff45119f122301ee059798c87a02cc0c23e2ffce
MD5 50362589add3f92e63c918a06d664416
SHA1 e1f96e10fb0f9d3bec9ea89f07f97811ccc78182
SHA512 e21404bc7a5708ab1f4bd1df5baff4302bc31ac894d0940a38b8967b40aac46c2b3e51566d6410e66c4e867e1d8a88489adccf8bdcaec682e9ddabc0dac64468
SSDEEP 1536:72wFDIX+/USH2GVOp2UGYZuQ9oqXoh14j0rWuIxN6l5pfKsddRRZn5nETMuH9w3a:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHk
TLSH
T1DC54155163FD4608F2F73F64A8B816A45E7ABCA6FD79D25C1250105E4AB2E90CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 347KB
SHA256 089f30c1e60f038627531d486659fab66a8b927d65e4eca18f104d6ae4c7f641
MD5 49032045f6bcb9f676c7437df76c7ffa
SHA1 f1bf3ba149cd1e581fe12fb06e93d512fe3a241b
SHA512 55b459b7787e6efacdcc17adb830dc3172a316ff8dd3b14a51bf4496a9479f513ae279a839674b472c1424170ee4aa63a5d45fc7fbd38a533a885282858c74f1
SSDEEP 1536:ouaqaq+aMs7F17Fetjvt5D71tT3Jw4SKqVw1vI86nRGegLBndcmrm8gzkdPwwQ:o2xx7F17Fetjvtx1tT3JCF86nceg1n8
TLSH
T1C8740250A7FE5246F6F77F1AA9B91A654E7B7D92AC39C01C0210115E0EB1F84CE78B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 350KB
SHA256 9a139a16fe741593e50fa5e1e2a0c706c0eba7f4d1e1a7a91035428185fde125
MD5 518020fbecea70e8fecaa0afe298a79e
SHA1 c16d691c479a05958958bd19d1cb449769602976
SHA512 ff910efee092c2b4a3fa1114f745feb7d01a38b55b0345e0118cdc601a056f79035bd92c76b49559480b515da4cd66d2fbe789baacdde67485cab989ff009b2e
SSDEEP 3072:8seo6JpGytgViPIny4auTsQy2XQDIefsnnSRfERwpZRVDNtflhzh:gTGA
TLSH
T173740D60A7EA5206F7F67FA1A8BD15168E6B3D97DC35C11C0610109E1DB2F94CEB8B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 353KB
SHA256 494db162e2ccd95e69404a34170b6e59847f444881834f3c175c6bc70d783087
MD5 a5389200f9bbc7be1276d74ccd2939b4
SHA1 8d6f17c7d36f686e727b6e7b3a62812297228943
SHA512 fc1d1e81362d186410b4af3d6add3c8b32fdd75ea79b7e868cc16615358264af04f47170229d32dffcbf7e1ba2b841ccd2d4f27b0f8d82a0685806c22d3d0a92
SSDEEP 3072:g+8gxXowjkUXx5E8d8tj/v9GLcr+cu8ov+pmPxbU5:rYj/v9GLBy
TLSH
T126741162A7FD5208F2F77F54A93C26654E7BBE96AD39D11D025010AE0971FA48CB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 158KB
SHA256 eca01d5405d7e8af92ea60f888f891415ea2e1e6484caff15cbaf5a645700db2
MD5 41f2dbe6f02b3bb9802d60f10b4ef7a2
SHA1 f1b03d28e5be3db3341f3a399d1cc887fe8da794
SHA512 1c7b85e12050d670d48121e7670e1dab787e0a0b134e0ab314dc571c3969d0f9652ff76666bb433aac5886ca532404963a3041a1d4b4352e3051c838965fd3b1
SSDEEP 1536:ZZ+Vd3STe+unk43EnGRIHOodBMSK2cVmRJe1yTIIrBtcP15:ZZg3ID5H7gVmRw4T015
TLSH
T170F3974C719C454DE3F6D5B1A0B970F03B5EFD28A9A788AC2E41908B0150C9EA79E77F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc007.dat

Path C:\Windows\system32\perfc007.dat
Size 39KB
SHA256 987d276742eba82260ac1509adc8678651d30103162b44d4e62fbde1b2f28559
MD5 c6a00700213a4cdfac7b02faabc2fa10
SHA1 d1fab1803050a67c59dfce442c1f1dacb166d0dc
SHA512 e3c879502f91b7e4ccbd300372108ffe0cfd2e49070c54f1b27fb83d3c0a7344ea7393b619f1fd6b21314915e32c50fb93f5a1511a383098107c57f1a14faf1d
SSDEEP 384:5Kb+jONlkgBTFy1w2I8CIqrzJtHvSzB6T:5Kb+j2tTFyuhttGBE
TLSH
T15703DE5407EA062DF2F3AF386EB19085A966FDA7BD33E81D2250118D0472A51DD78B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc009.dat

Path C:\Windows\system32\perfc009.dat
Size 122KB
SHA256 69012c5b50e669fca5ad692dc405017da474a5a4ec876de70d9748a4f30c046c
MD5 243bb32f23a8a2fa8113e879d73bfdf7
SHA1 2f9d0154d65d0b8979a1aeb95b6cf43384114f70
SHA512 34f7663ef59412a12ce950eb5ab947b2fb6bb811d5cfd92d05b6a884bcb2fc31fdc880b8e152a383055ca0efee707eb23bbfe181ace8c1ca112262f2a75bf0a8
SSDEEP 768:BwwR1fQRvl6/lAkYXC2CMIwY6QW0Q7cUYiZ+4BphAAvErwVLTSxVUV20H4qV6ZNY:X1ieYXC9MIwYbiZ3VLTSxVUV2GIpFg
TLSH
T1EBC3C2955BF81009F2FBBF3CAAF940529E6ABD67AE31C81E41A0114F0572E11EC7573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\system32\perfc00A.dat
Size 142KB
SHA256 018b8f05912e9caeaff136227834ff2b6515aed2eb662741154230ce1d04b3d7
MD5 bf9f94add28d5e54272b9ec709011d4d
SHA1 7a4070535d0863aa55b59e7c874b47c18657ec50
SHA512 3ebc69f34b9c6effbeffe5681b0555cd6b3a73ffc1ef30916525d7a89c7cb9dbf6b8bf5b24054d2c74a966c47b41e676ac46949224bb551da2797fa63f7989ca
SSDEEP 768:jLLxU1GSWnWRQjlAWm1/8Iwc6QW0Q7cUE3ezsy/PfuczXoOhyic3QJ9iAphAAvEU:jLLxUhWnXIwcHicjVgSi2xI5Fx
TLSH
T1D8E37A555BF81206F2F7BF3CAAF945158E7ABD56AE36C82D01A0124E09B2F10DC78727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\system32\perfc00C.dat
Size 137KB
SHA256 4abbd4c74fa008754210062d9b25a31c7b27ae04c698d493b7a55fd671ae1447
MD5 9c5082e51f9169b23796382010d5e69a
SHA1 46b0d3c2a8b3829bd61f3e313f3268a9bb0e1a40
SHA512 957d58c45dc10e74ef78e68df4153a40c7cef08ace2ddc210dbdeaaac363957d4af0bbe3645f393d812b2ab8097b52bedcafebaa1aa5d015d8933aa34e33a615
SSDEEP 768:SISzZ6p19LRGwVBlAJBd6ltyIwt6QW0Q7cUPFKHXvvRnu7PB0hvLiUqW4INwnPD9:SkD4fIwtHiByV0nlM2PINF4
TLSH
T115D38E956BF90106F2F7BF38AAF911119E6BBD6BAD32C81D0191018E0872E51DCB9737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\system32\perfc010.dat
Size 134KB
SHA256 dd841a219b2524a5403be0ad43271ff711147182487269726b60212139516fc1
MD5 579c88201673ae4d679c6da369fc768c
SHA1 46c67eb656a170c0e2f9193dd3a5cdeb6f99aed9
SHA512 fc4370bda6e57d9060209ef2b66fa0aff30081a8391ad7a6cd2d35d7271f5d377db08508e46beae8cb7c9b3541673204de903154d8c76340788120c210acaa95
SSDEEP 768:0hCx4l7JXlrCEEeANv8YjT1Ibd1mL3kLVGLTAr1mL3kLVGbroqlA2nHHmVc1IwbB:0Axo7JXqPz3B1Iwbni+yVvmhv2/ITFr
TLSH
T160D3CF956BF81009F2F7BF3CAAB951164E3ABE66AE31C81D0191118F0572E11ECB573B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc011.dat

Path C:\Windows\system32\perfc011.dat
Size 122KB
SHA256 a8228c74b4dc81c755c56beaa5e91515d09c24e80f820713b3095816c4e552db
MD5 451fd3eea8608134ff91280fb0ff7e4b
SHA1 e81546c72260060eb757195f3702014533b527dd
SHA512 7bf51087ea8b8a0d2ea7b2a0e3b1cff8e44e3549735b1ae757622ca7157c9391132f7d68711a91fbee7f681927759ca552cf885f5aeca4a6a005d8a27fd5f8fb
SSDEEP 768:BwwR1fQRPl6/lAkYXC2CMIwY6QW0Q7cUYiZ+ABphAAvErwVTTSxVUV20H4qV6ZNX:X1i+YXC9MIwYbiZPVTTSxVUV2GIpFv
TLSH
T151C3D2955BF81009F2FBBF3CAAF940529E6ABE67AE31C81E4190114F0572E11EC7573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\system32\perfh007.dat
Size 298KB
SHA256 1a2fd21891c4055b2ee03ee06665f1a09a6503f7a4b57acba67820ec561d12e4
MD5 eadd51b4e0a81aa0a1ec7392a1ce681a
SHA1 f384c3bc0f16ccb5049ebbf7df776e684da84706
SHA512 de74112ed8f81f4723241102e9e493921419f836e7f095000a0ae34616db1886c22dff6ab4dfd5bd1ebbc9840498c3606ac0e5791f7fadac1b52c18043571ae4
SSDEEP 3072:MhpwBxTEsmVdx1wN8EBNjcbg+hSILPDtzcSx2A8q1JuqaB32rSrSQYCxly/2dj9K:+
TLSH
T143549B6153EA872CF2F77F646EB86254AE62BCE6BD79E94D1340209D0C71B40C974B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\system32\perfh009.dat
Size 639KB
SHA256 f8dba82e1659fcf93bba70fdac36be459cd60a6cc9217af125f5bd0b3dc7d6da
MD5 0e06730950deaeb094dc76f0e012b827
SHA1 2b4fb47055a364f34c0b4f3cb9cc95376346910f
SHA512 2ee6d6cce846ccee1bcad666466a829160a9abaedbcb997ab4daa3ec9af18246d29195eeee4126b9efb399e169d15f92383ac82b5949e56e17ef78c08d63326f
SSDEEP 3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHE2bmVH3ocmBC6Ml6bvS71R72o4ex+ytUhf:78M6d0nOA
TLSH
T1D6D47B9167FD4608F2FB3F64A9B815A45E7ABCA6FD79C25C1150009E4AB2E50CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\system32\perfh00A.dat
Size 706KB
SHA256 553b18d6d6666ddd0325af89a6e0e6eb5a5e9d6780c71f595d7e2884b57d8822
MD5 3ced0ee756099c860ec2ddda26b0ad3e
SHA1 3cb71d0bd58d57dd1b1b4cce9604546480523bc5
SHA512 84f8c2b3d817fdf1252f6bc6bf14119e45ea098b6401e52c61014ffd7c4ecc69a2ce27886f64b6a132dfe88d400ecd2e24a8a0f87d208fe1412604aa41462086
SSDEEP 3072:o2xx7F17Fetjvtx1tT3JCF86nceg1nscrVH3pbBPfOWD36bO/LtU6j3aXCXBDTge:+tjvtx1tT5SnyntcWDp
TLSH
T183F41F5167F95209F6F77F29A9B91A654E7ABD92EC39C61C0220009E0EB1F84CD74B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\system32\perfh00C.dat
Size 710KB
SHA256 b090fba956652c7bd1e48b6ddb64b443236dc828de37b1ddf777e0feac276976
MD5 23270ed87d184d7992983cd5941360b0
SHA1 600a3e067a2490f1c204b5280cfc475be4f50959
SHA512 0ab0511f853220779b2a2cac3d93db9d084d0c4cd1153e1820350e9fca0bf24a03abd108a2a52309786caa16793c301aadddcf398c7d05b3b1f05e1b39720eb3
SSDEEP 3072:8seo6JpGytgViPIny4auTsQy2XQDIefsnnSRfERwpZRVDNtflhzRqMIGEG9a5/nd:gTGU6
TLSH
T196F42E50A7FA5209F6F77F64A9B915654E6BBD96EC39C21C0250009E1DB2F80CDB8B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\system32\perfh010.dat
Size 697KB
SHA256 16d1f5b0334a0bd79023e598a94b80e7ec84e0b7583030c0ea6acc46a4d6f8cf
MD5 97566ede26c69e0c3f452c491bc725b3
SHA1 c20ea4cf93a33378b9389be36d3dc919e84238a6
SHA512 097c12024bb746803b29499ec68af33f98ff8d6d3c039e704a2f8344fd5d9b4d4c6ed63dd46735cc147305cf00cd84db3b2870bb9dabad0d96e1208d17285bc0
SSDEEP 3072:g+8gxXowjkUXx5E8d8tj/v9GLcr+cu8ov+pmPxbUbGRVH3qBILp0eXMw6bs07pPX:rYj/v9GLBR0eXMVpLL
TLSH
T1EEE44662A7FD5608F6F77F64A97816654E7BBE96AD39C21C0260009E0972F54CCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\system32\perfh011.dat
Size 446KB
SHA256 51ae507017508db59eb8cd168a2219467ed9f9e434c78216c552619ff37601e1
MD5 e5966c4fef65e8fc0f66895f4776f1ca
SHA1 2819d993e64bf032fc2a4e71d0c40f349f9639d6
SHA512 3e08fb643b8a7040ff5985d666b07d852f995da282e7ee388dae5785bb0ca543f18c34815077f23e277eb44454703fc0ac369b4ceccc04f20c2be861a8b61034
SSDEEP 3072:ZZg3ID5H7gVmRw4T012uqa7VRgtw1fuFVH3gBlKIi6bjW5HQcotUfLowBeY3PUL+:Tg33mRwZXWaw
TLSH
T10DA4878527EC460DF2F77F64A5B820A02E6EFD65AD7AC66C1550408F0971E48CEB4B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC7AC5DBE0B4BD45C09AFC312B645CA7F0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC7AC5DBE0B4BD45C09AFC312B645CA7F0.TMP
Size 1KB
SHA256 fcbaff7ac6f68cbe08870b375b78d6f65db0490a2f3fa37763222b4bdc26b57e
MD5 c3ba2766ff24aebeb2ae66aa3134685b
SHA1 5e96f2c44cb83e03cfcd92460e4349b92f2a95e5
SHA512 27216fcd1927afa0de6a4a07d7889c5baaed8edf85b55240952210c2cd8585ca11a50b5cdeec0189507e6827dce06d22bb09b69e698927dcc6838bdfc7983e5d
TLSH
T19B21C989A3E8421AF2F3873079F28362A168BE569D7A43EC34C8171F1F255008483AB1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_44e08e1cbc3f43769d255f1c7d759944.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_44e08e1cbc3f43769d255f1c7d759944.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-4826-0x00000192EA2C0000-0x00000192EA2E6000-memory.dmp

Download

memory/1824-3339-0x000002536F240000-0x000002536F434000-memory.dmp

Download

memory/1824-3341-0x0000025371B10000-0x0000025371C36000-memory.dmp

Download

memory/1824-3325-0x000002536D9B0000-0x000002536ECDA000-memory.dmp

Download

memory/1824-3324-0x0000025369E40000-0x000002536B43A000-memory.dmp

Download

memory/1824-3342-0x0000025371A20000-0x0000025371A5A000-memory.dmp

Download

memory/1824-3343-0x00000253719E0000-0x0000025371A06000-memory.dmp

Download

memory/2520-4825-0x0000000000960000-0x0000000000968000-memory.dmp

Download

memory/4236-5464-0x000000001BE10000-0x000000001BE72000-memory.dmp

Download

memory/4236-5466-0x000000001DE60000-0x000000001DEB2000-memory.dmp

Download

memory/4236-5463-0x000000001BCF0000-0x000000001BD8C000-memory.dmp

Download

memory/4236-5462-0x000000001D4D0000-0x000000001D99E000-memory.dmp

Download

memory/4236-5465-0x0000000002DF0000-0x0000000002DF8000-memory.dmp

Download

memory/4380-5476-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5475-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5477-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5487-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5486-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5485-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5484-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5483-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5482-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4380-5481-0x000001F673A50000-0x000001F673A51000-memory.dmp

Download

memory/4820-3337-0x00000000006F0000-0x00000000006F8000-memory.dmp

Download