3af977becda7a915c7d11ef4d01a0df8a3c824c9d589ca7cf633d03c713fe026

Analysis

user interaction
yes
max time kernel
94s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
R1 Store Decrypter.exe
Size 168.1MB
Sample260724-eg46fssarf
SHA256 3af977becda7a915c7d11ef4d01a0df8a3c824c9d589ca7cf633d03c713fe026
MD5 7d988c5cd0b143c2095f489dd22a53cc
SHA1 a1d81ac811dacac7b04791f6a97d732fe567a60d
SHA512 5a63f233b36668b58a6f652d47752ce93bd8945fb9df28afa8f18617e415bcd80259f4c34f82d2839bc1c163a180db19d1169414a328b07fa0f8054dcb7de9af
SSDEEP 1572864:55fqXTiy4rKWJSQBy5kA28mkiVZzVxUndk7GnxE+pywt0oAaxdvFAEQA3C58UJzM:SXj5AXkoa4lRzu
TLSH
T1DB888B03E29640D9F05DD1B18B9B9637EA72B8464738B6DF2A5407162F77EE02B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2344	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1976	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5156	mspaint.exe
5156	mspaint.exe
3924	mspaint.exe
3924	mspaint.exe
1188	chrome.exe
1188	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeDebugPrivilege	3896	firefox.exe
Token: SeDebugPrivilege	3896	firefox.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
3896	firefox.exe
3896	firefox.exe
3896	firefox.exe
3896	firefox.exe
3896	firefox.exe
3896	firefox.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
1976	EXCEL.EXE
4548	ShellHost.exe
5156	mspaint.exe
5156	mspaint.exe
5156	mspaint.exe
5156	mspaint.exe
3924	mspaint.exe
3924	mspaint.exe
3924	mspaint.exe
3924	mspaint.exe
3896	firefox.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2156	1188	chrome.exe	112
PID 1188 wrote to memory of 2344	1188	chrome.exe	113
PID 1188 wrote to memory of 3384	1188	chrome.exe	114
PID 1188 wrote to memory of 3384	1188	chrome.exe	114
PID 1188 wrote to memory of 4692	1188	chrome.exe	116
PID 1188 wrote to memory of 4692	1188	chrome.exe	116
PID 1188 wrote to memory of 2656	1188	chrome.exe	117
PID 1188 wrote to memory of 2656	1188	chrome.exe	117
PID 1188 wrote to memory of 3056	1188	chrome.exe	118
PID 1188 wrote to memory of 3056	1188	chrome.exe	118
PID 1188 wrote to memory of 1992	1188	chrome.exe	119
PID 1188 wrote to memory of 1992	1188	chrome.exe	119
PID 1188 wrote to memory of 3448	1188	chrome.exe	120
PID 1188 wrote to memory of 3448	1188	chrome.exe	120
PID 2808 wrote to memory of 3896	2808	firefox.exe	122
PID 2808 wrote to memory of 3896	2808	firefox.exe	122
PID 3896 wrote to memory of 6116	3896	firefox.exe	123
PID 3896 wrote to memory of 6116	3896	firefox.exe	123
PID 3896 wrote to memory of 6116	3896	firefox.exe	123
PID 3896 wrote to memory of 6064	3896	firefox.exe	124
PID 3896 wrote to memory of 6064	3896	firefox.exe	124
PID 3896 wrote to memory of 6064	3896	firefox.exe	124
PID 3896 wrote to memory of 6064	3896	firefox.exe	124
PID 3896 wrote to memory of 2980	3896	firefox.exe	125
PID 3896 wrote to memory of 2980	3896	firefox.exe	125
PID 3896 wrote to memory of 2980	3896	firefox.exe	125
PID 3896 wrote to memory of 2980	3896	firefox.exe	125
PID 3896 wrote to memory of 4480	3896	firefox.exe	126
PID 3896 wrote to memory of 4480	3896	firefox.exe	126
PID 3896 wrote to memory of 4480	3896	firefox.exe	126
PID 3896 wrote to memory of 3924	3896	firefox.exe	127
PID 3896 wrote to memory of 3924	3896	firefox.exe	127
PID 3896 wrote to memory of 3924	3896	firefox.exe	127
PID 3896 wrote to memory of 3924	3896	firefox.exe	127
PID 3896 wrote to memory of 6628	3896	firefox.exe	128
PID 3896 wrote to memory of 6628	3896	firefox.exe	128
PID 3896 wrote to memory of 6628	3896	firefox.exe	128
PID 3896 wrote to memory of 6628	3896	firefox.exe	128
PID 3896 wrote to memory of 6812	3896	firefox.exe	129
PID 3896 wrote to memory of 6812	3896	firefox.exe	129
PID 3896 wrote to memory of 6812	3896	firefox.exe	129
PID 3896 wrote to memory of 6812	3896	firefox.exe	129
PID 3896 wrote to memory of 6820	3896	firefox.exe	130
PID 3896 wrote to memory of 6820	3896	firefox.exe	130
PID 3896 wrote to memory of 6820	3896	firefox.exe	130
PID 3896 wrote to memory of 6820	3896	firefox.exe	130
PID 3896 wrote to memory of 6828	3896	firefox.exe	131
PID 3896 wrote to memory of 6828	3896	firefox.exe	131
PID 3896 wrote to memory of 6828	3896	firefox.exe	131
PID 3896 wrote to memory of 6828	3896	firefox.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\R1 Store Decrypter.exe
"C:\Users\Admin\AppData\Local\Temp\R1 Store Decrypter.exe"
1⤵
PID:5904

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RevokeStart.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F4
1⤵
PID:5812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:3152

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4548

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ResolveSkip.bmp"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:1240

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\GrantEnable.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf8c1c728,0x7ffcf8c1c734,0x7ffcf8c1c740
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,5023067456421798646,9252736189533401337,524288 --field-trial-handle=1984,i,10780643394502342080,13138667522373551588,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,1538802590755293089,6902509297248313873,262144 --field-trial-handle=1984,i,10780643394502342080,13138667522373551588,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,6586015355824055512,11228351481042641730,524288 --field-trial-handle=1984,i,10780643394502342080,13138667522373551588,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,17309008992071517342,1681409776659216594,2097152 --field-trial-handle=1984,i,10780643394502342080,13138667522373551588,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,3675173494344741695,13162674554026679842,2097152 --field-trial-handle=1984,i,10780643394502342080,13138667522373551588,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4732,i,10240736681965282189,13431638877988405014,2097152 --field-trial-handle=1984,i,10780643394502342080,13138667522373551588,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,458210622408908101,17026167609471905675,524288 --field-trial-handle=1984,i,10780643394502342080,13138667522373551588,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:3448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {109b5f53-312e-4e6e-ab11-f111cb8b8ae4} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {f292654d-b2e9-4e0d-ba56-506b9806f461} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:6064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27274 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {2e788a31-1c1f-419a-b665-e8a6a1f7a00d} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3988 -prefsLen 27274 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {d0547a61-db19-4f41-aafe-38167986d987} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3124 -prefsLen 34773 -prefMapHandle 3132 -prefMapSize 270279 -jsInitHandle 3136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3148 -initialChannelId {bfa5a4c2-33e4-4d3e-8500-789460c26b41} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5172 -prefsLen 35010 -prefMapHandle 5176 -prefMapSize 270279 -ipcHandle 3236 -initialChannelId {840952d1-a59c-4b42-bd4f-9cf2c38a9208} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {2074da06-5e45-4248-8528-e09f63003985} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {78255f24-9704-4962-a1b5-35f63d06c17d} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5904 -prefsLen 32952 -prefMapHandle 5908 -prefMapSize 270279 -jsInitHandle 5912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4368 -initialChannelId {5f5d3815-072e-4f90-9744-80781246b534} -parentPid 3896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

7cae9752-f783-4140-abfe-3fd1b8c65146.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7cae9752-f783-4140-abfe-3fd1b8c65146.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9014cb34f67b514be015bd5cd4c06dc5c643e2c80e60bd317fdb1822ee68acf9
MD5 02f06340ff06cd6bf154ef832b7c621d
SHA1 06ef11433a1ddb65f0f61d361d28cdcd205c0921
SHA512 5cc8aeffb12762b603a504de852d3f70391a50d52223606cd525812abcc12998afe787e0aa6c4fa49865698f96c780ae3b920747f110d96eed2c2b04b4932f16
TLSH
T1A8319AF3C3D8997D890156F8EB156F1ACE290E18522C3D66C8D4AE1F67E2876D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4b72679e7e338c5f7e99d7ac69d075bcd26116b4933c5302ee831c35962140e7
MD5 a3288550853e421ca7069e7b737beba5
SHA1 5489228a414787120370e5876c93b32231dc13be
SHA512 3e52de9e23e6e9845140e24a1595d46a4089873da25e12c4e1958ac8440113b31a5dbb6f3a845f97dafd0fa50e421973f657c173a47308891c25cf061d003f07
TLSH
T160F0C0A7AA6E712310BF91AE5E08B8056871E439060068F8CF9B436CE0C24E70B03883
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 adcd83f5cc89c3008f0845734f8e06013efcddf0b4bbe1a3405275ad4c59500e
MD5 f628f8ae40607c66de2573245c38d572
SHA1 600454541acafc79db1f332a62c5a43633e8f616
SHA512 92b4d5a5489ab1b3bb4c96bc65a48c9d4854a81841a3d970c3971f646ae9c49ff319210218f74f0c6df1c07e0650b77b4c5e3e33d07708e19a43558cffab527c
SSDEEP 192:FRLYa7Fv7pAPRp2o9XxHsb+WNnU10gOPyIsnAUgR:FRLY61AXjfwE0VR
TLSH
T15522852EBD14657B6DCBD229FA627793E3F6102225D42E44E6FC8B2C11DB5CC622340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2e8a9731e6dea7a65076318c202bac71a635d985d7c06a60ff63760d4df9e58c
MD5 c33e52b417b5794455655e02cb2d4e0a
SHA1 21f4f83efb9e1ef7325ac2aedd4446137c9f697c
SHA512 bf75e26f40878b8ce0b9deb6a583457f746078387e112b8c67c215e7d8f051b4da11a0b90ea96bad629f26c4739814d460004723fbc0a25000d8262e9d3e87e3
SSDEEP 96:xC6Ped+r2io+TJ/E0f6m934PMLSl8h4otok5cGDaB6BGyvn0SvQxwzQxQhj+9/al:xCzITo+TQ0IOiUD3KhPSIx6hj+9/aUUt
TLSH
T14DC13B36E42C1CB741B7E446F1273A5BCEB4306BDA51AFA4EAE60F1D01E74EC1352526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a88a178f98e7194f6d4485faa1bd4e3a018f4c8ede2ce1765741fbb43c1dbe9d
MD5 773364ee8c8413227a534316b3413547
SHA1 5654ad3f831cc1eb9eb53722757998af7d90260f
SHA512 f7ec26a0079923310223371fc1d95228ff89038ec9961477a45db46d25ddf8aa3953a33f7ede286b4142537f05bed4c9369f641d434ac4dfdb982664b379400c
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5cmDaB6nGyvn0b4T8mybJv4a:xC0ITo+TQ0InDUDLKPPb4T8mybl
TLSH
T1C7A10836E0284DB74476D44AF1626A43CEB9706BE9B2AF94EAD90F0D14F74EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 350B
SHA256 d159719c4b40352c45c0da2b659249828fe087f45cbb111b6ef719a2761312a5
MD5 c38912618d7551e6658d7399901bac6f
SHA1 64800f510cc6d779103abe8dfeb4f98aa6f9a4b1
SHA512 ef86ae3fc50430c1e99630c1a412527b564d4fe7896fbdb38b67f43f6d4caed037d890f028e4378b19fe24dd0d6fa2752b6ca4c9662d1fddd931c643176f03ed
TLSH
T18AE0B6972368EBF4B77E42B1793D9DE44BF38C5CC72A042A04DC2DC90D6068352AB19A
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 117145cee0a27ad71b3719657aacc9d2a0f5053dea100cc7fda36d31aea7c4ac
MD5 deea1b99608870a189d15e667a51bef9
SHA1 ed4dd7262977d2850272f6587e264e89871c89b2
SHA512 5130cfc7fc89f28083374fdcf2a99e513acb288353a768b79fa20e44a09ae49625423fe3b83ebeea69c18a28dd8d719b9322d582c6ade92c917cff30efb0fc3e
SSDEEP 192:gOv5zbo7UZJnyjLd/H61d66JoztdzgCl6mc0dz:LboIZJnyjKd66Joz/zgC1jd
TLSH
T1ABE1FDA4E629863BC404037BCCA61B414F39398B984E3F2535DC651C2D5B2DE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e949c04321479118b8f4e9a0b0fa51c6a8df80ae1694cbae39d95c5f27b2d904
MD5 3702651b4a569db3961caea11ede7270
SHA1 606447b220a0a61fc36db3707469c476f929d485
SHA512 aeb707a4b08e1f03a35b83e20789a24f24d4715351dc045f7942793d9f621f5e3619d7d5d23cb6607a187565dc9cecbf001f21d8acec773e3e05cd658834936f
TLSH
T167216A5C3EB84D3A98CBE6EC745C128E53654E4A14976C470D62FF8CCE81ED9326E438
MD5 SHA1 SHA512 TLSH

Submit Download

05aab382-c053-41ff-9832-a6693f2463f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\05aab382-c053-41ff-9832-a6693f2463f6
Size 886B
SHA256 fd627b341084dfa52e92b7f866994f30674c0014197abee13b7e14d4c667871d
MD5 069891de9068d5eb678f8a106d103c2b
SHA1 a2a68dba82b2f88f0180502030b43288eb93d436
SHA512 5968531b948c315a95a07cd299fa9c5e157266a771df64e62a714cd37be91a34cc2b0b047e2d699e519ac0d4fbfa4c92e80cd3541e8601fa8a0c1ac880c76a93
TLSH
T16F112780C731B571CC68D34BC5E17785CFE4B52380CA09143D945B184DBA25F97B720B
MD5 SHA1 SHA512 TLSH

Submit Download

154ebf99-17b8-47ab-8e6a-8d5e29a5a828

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\154ebf99-17b8-47ab-8e6a-8d5e29a5a828
Size 235B
SHA256 1253d6ed756403632bb3c0b9f3907ad6a718670f2afe8185f32c2f7dde25d749
MD5 75db1ee5adeafa3538cfdf668768a685
SHA1 d09b435a2b4255a0249adcdc3d7167ea461b9bd0
SHA512 45d891ee5d772d05e6cda77f4afa6631cf992e29b6cfc9b109b40c2b009ad203832bc143a8ebb275fe816d1560b263971b559e9ebd84966f76dc020195fd9943
TLSH
T171D0978428C8276C88244F03B0E02CC231888C3720B09810D6AA48BC9EFCEC84121847
MD5 SHA1 SHA512 TLSH

Submit Download

63750684-c557-4fdd-adbf-1037b6a4ed61

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\63750684-c557-4fdd-adbf-1037b6a4ed61
Size 2KB
SHA256 cf753ef6534c87bffe7754aef1f5993d0e07c809ffc0bdb951b10c1cdbf5a7c3
MD5 3410e1a054879e4240c5642703792439
SHA1 50963e3f9b99ec6bd1c87ea815ff67e7f2baa697
SHA512 67264cd10ea264836e8c66de9d501e26f5401bbcdaecc2c91a743d2807b735605b854f986e7de860b14ffc8ee58ff02e7dc7a0895deb8969054acf683d04d10a
TLSH
T16641745836789D775C8AF64CD482328E97A49A03149218432D81DF0CCEA63DE736B42B
MD5 SHA1 SHA512 TLSH

Submit Download

b3d9efda-c38e-4e6d-82a6-bb09a21d9bcf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\b3d9efda-c38e-4e6d-82a6-bb09a21d9bcf
Size 883B
SHA256 6af9ae7f1169664cb90ff1ba6757ab2c26c5483ccac2209bf05ff5e426dc0b1c
MD5 b6bc826634807575a78abed07bfe170e
SHA1 7bb62ffdb86c74c60821a6a5f69eb8d5acb8d287
SHA512 766ef6bf4ac2e312568ae353a6403e7ba895554da21f69140ee455bc458d6ffc6811f5ada25c8001836d9fdfccd676f26aacc0395bac1bc45d3c70a48c07424a
TLSH
T114110080D631B962CC28834BC9AA7756DFE8751380C655143DE18B180F7E65FA3AB247
MD5 SHA1 SHA512 TLSH

Submit Download

da2a383a-6092-4208-8966-6db6101c1137

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\da2a383a-6092-4208-8966-6db6101c1137
Size 16KB
SHA256 e5cf394f5d46c09c60a824d58dfdbb2427631f3aef2e9a3035871d559cdbde3e
MD5 13f3d5023db3126679389428a9b01e64
SHA1 185512b5e9d38188f73670f5d1bd12a722f0fc66
SHA512 797f372574d5f8be6e9b3d42d692de72a38c160abbb861e3f0bceb0c372c493573ce76b25a97f331019d79c4b17d46bf752e766c95535f22938307f42f365810
SSDEEP 192:KtJS9CcKEQUQ5JE5bKzxRUQtGI41pYN1EuDBUnwbOpZkaoxMc4KBmytzXgLJC:CS9tKEQUQ5IbKlRREICYDEwGwgw
TLSH
T12872EA56686056BA8551E3A9D4FC7FC3E2F528CF4C019FCA9BE0BD085DDA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef673fb6-5613-4881-abb1-6005022969b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\ef673fb6-5613-4881-abb1-6005022969b1
Size 235B
SHA256 1ad75449fd097fbaf0ce380cd3150c58ff2540fa503508b0f3db237ac53ede5e
MD5 4fd250d08e94764e9ac738538a180b50
SHA1 d573f3a55765d580162e1fe2586f390f4ba0098a
SHA512 94e79ba27c3c314f80b143aa8b8ce8a9f14254ccd8bc7bbdbd76038e7455e89151e3f76c4fc1c95f829f198dc3cdd5110d7bfb41740268b508347b79c113533d
TLSH
T109D0979038A837AC48280F02F1B02AC630888C3B1CA4E820D69080B89AFDAC8421191B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 5cf2916571225fda702ace42bd8347fd977f2fa33cfd8412f462a532191f7936
MD5 d990983c1cc2a61519bfad91bd6c5ae7
SHA1 9ce66623181d691baf25fbee257eb9f759cd0f05
SHA512 ee0540a64c4a05b77db4c1fb2ef4f6ca9d366a245791217c6a6bb2bbe15de516544e5b2d97d95437834ca941d27445083bd63ed37b0b05772d7dc2c53c9c8f63
SSDEEP 96:xHpUTUWqGqPf2BJU1zSHF3SSlvdv9jHn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BJU43SSXj7/Bw88qU
TLSH
T198E1217895488F7F64B677BCAC688831AAB2013B77BF28C350B95484014CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 f421bf9a6d0de726bfc10c56d8141f304d6ea65ad5502db50b73f9e81ee3f2fd
MD5 fdf6527426e4714a15f24422c1c83b6c
SHA1 b77faa7a689446e81c228f0faa8ea7e2573d1ae8
SHA512 44495b4393326d8b850e221c57b6edb30aef647baafe2642301d3004244c07d60736de0b0b836d806e5ed725f14fa29355ba9e2d3e33f35615bc9c16cf252398
SSDEEP 96:xHpUTUWqGqPf2BRE1zS/SSlvdv9jMn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BREWSS4j7/Bw88qU
TLSH
T1FEE1217890088F7F64B6777CAC688831AAB2413B7BBF68C750B95484015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 63a8dc3fba99b9e9ad77048164fee6c6daed3d14f03feba472b80bf5d2a5caf4
MD5 580384fc807850cba0229b0c3ded8c4b
SHA1 0d58d10a9c2c339b1269ce45c87054197fd24ab6
SHA512 61f242389633b913200d089555d7d22f76a769634926beb2d32b6222b80817ce2b664f2de545c2b92079956176178373ebbf533458fde35ad5d690b37559db9f
TLSH
T18D61B080C4912E4BD7ABB10AC68610D917DFA6D559E21031CB3FFD99606A378CEE7C87
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1976-4-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-0-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-39-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-1-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-41-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-42-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-40-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-3-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-2-0x00007FFCCE6E0000-0x00007FFCCE6F0000-memory.dmp

Download

memory/1976-5-0x00007FFCCBA30000-0x00007FFCCBA40000-memory.dmp

Download

memory/1976-6-0x00007FFCCBA30000-0x00007FFCCBA40000-memory.dmp

Download