1e059ebf9a56b3f38cccfa1160fc666892789249742bc7119632142eb3d04722

Analysis

user interaction
yes
max time kernel
1800s
max time network
1780s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamLuaTools-TEST-V4.0.exe
Size 48.4MB
Sample260804-e6hnravzc1
SHA256 1e059ebf9a56b3f38cccfa1160fc666892789249742bc7119632142eb3d04722
MD5 50027f4a7bbb55952720812e72049eda
SHA1 2454dc53db881f2e41fe4d61abeba851be69917c
SHA512 9961f1fbddc95f783e23bfdf6b22bf71fc8a27f5a47ec08eb3168129f1f53a82c52640b0dab4647e9cd5e11c8b91353aec09a2a0e22a4202a4bd8282b312d85b
SSDEEP 1572864:bVD0jpX+uMUfnqlcZhqhC7BMjk13+2k8nWJobGgeKA9:BD01uuMUfnTVWj6kBopeK2
TLSH
T128B73380F1E48BEDF1B235B9A495995772A7383A8322DC67336981817E375F07B3924C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Loads dropped DLL 52 IoCs

pid	Process
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2660	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1644	chrome.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302918756536547"	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4940	SteamLuaTools-TEST-V4.0.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
2968	chrome.exe
2968	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	SteamLuaTools-TEST-V4.0.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe
Token: SeCreatePagefilePrivilege	3904	chrome.exe
Token: SeShutdownPrivilege	3904	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
4940	SteamLuaTools-TEST-V4.0.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe
3904	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe
6052	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 4940	3456	SteamLuaTools-TEST-V4.0.exe	89
PID 4940 wrote to memory of 2660	4940	SteamLuaTools-TEST-V4.0.exe	90
PID 3904 wrote to memory of 4396	3904	chrome.exe	95
PID 3904 wrote to memory of 780	3904	chrome.exe	96
PID 3904 wrote to memory of 780	3904	chrome.exe	96
PID 3904 wrote to memory of 1644	3904	chrome.exe	97
PID 3904 wrote to memory of 4368	3904	chrome.exe	99
PID 3904 wrote to memory of 4368	3904	chrome.exe	99
PID 3904 wrote to memory of 4332	3904	chrome.exe	101
PID 3904 wrote to memory of 4876	3904	chrome.exe	100
PID 3904 wrote to memory of 4332	3904	chrome.exe	101
PID 3904 wrote to memory of 4876	3904	chrome.exe	100
PID 3904 wrote to memory of 2972	3904	chrome.exe	102
PID 3904 wrote to memory of 2972	3904	chrome.exe	102
PID 3904 wrote to memory of 1444	3904	chrome.exe	103
PID 3904 wrote to memory of 1444	3904	chrome.exe	103
PID 3904 wrote to memory of 3932	3904	chrome.exe	105
PID 3904 wrote to memory of 4648	3904	chrome.exe	106
PID 3904 wrote to memory of 936	3904	chrome.exe	107
PID 3904 wrote to memory of 936	3904	chrome.exe	107
PID 3904 wrote to memory of 4648	3904	chrome.exe	106
PID 3904 wrote to memory of 3440	3904	chrome.exe	109
PID 3904 wrote to memory of 3440	3904	chrome.exe	109
PID 3904 wrote to memory of 6088	3904	chrome.exe	110
PID 3904 wrote to memory of 6088	3904	chrome.exe	110
PID 3904 wrote to memory of 1760	3904	chrome.exe	111
PID 3904 wrote to memory of 1760	3904	chrome.exe	111
PID 3904 wrote to memory of 4888	3904	chrome.exe	112
PID 3904 wrote to memory of 4888	3904	chrome.exe	112
PID 3904 wrote to memory of 996	3904	chrome.exe	116
PID 3904 wrote to memory of 3408	3904	chrome.exe	115
PID 3904 wrote to memory of 996	3904	chrome.exe	116
PID 3904 wrote to memory of 3276	3904	chrome.exe	117
PID 3904 wrote to memory of 3408	3904	chrome.exe	115
PID 3904 wrote to memory of 3276	3904	chrome.exe	117
PID 3904 wrote to memory of 1764	3904	chrome.exe	118
PID 3904 wrote to memory of 1764	3904	chrome.exe	118
PID 3904 wrote to memory of 5492	3904	chrome.exe	119
PID 3904 wrote to memory of 5492	3904	chrome.exe	119
PID 3904 wrote to memory of 2932	3904	chrome.exe	120
PID 3904 wrote to memory of 2932	3904	chrome.exe	120
PID 3904 wrote to memory of 4428	3904	chrome.exe	121
PID 3904 wrote to memory of 4428	3904	chrome.exe	121
PID 3904 wrote to memory of 4524	3904	chrome.exe	122
PID 3904 wrote to memory of 4524	3904	chrome.exe	122
PID 3904 wrote to memory of 4112	3904	chrome.exe	123
PID 3904 wrote to memory of 4228	3904	chrome.exe	124
PID 3904 wrote to memory of 4804	3904	chrome.exe	125
PID 3904 wrote to memory of 1120	3904	chrome.exe	126
PID 3904 wrote to memory of 1120	3904	chrome.exe	126
PID 3904 wrote to memory of 2700	3904	chrome.exe	127
PID 3904 wrote to memory of 2700	3904	chrome.exe	127
PID 3904 wrote to memory of 4984	3904	chrome.exe	128
PID 3904 wrote to memory of 4984	3904	chrome.exe	128
PID 3904 wrote to memory of 2968	3904	chrome.exe	129
PID 252 wrote to memory of 6052	252	firefox.exe	131
PID 252 wrote to memory of 6052	252	firefox.exe	131
PID 6052 wrote to memory of 3344	6052	firefox.exe	132
PID 6052 wrote to memory of 3344	6052	firefox.exe	132
PID 6052 wrote to memory of 3344	6052	firefox.exe	132
PID 6052 wrote to memory of 4780	6052	firefox.exe	133
PID 6052 wrote to memory of 4780	6052	firefox.exe	133
PID 6052 wrote to memory of 4780	6052	firefox.exe	133
PID 6052 wrote to memory of 4780	6052	firefox.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SteamLuaTools-TEST-V4.0.exe
"C:\Users\Admin\AppData\Local\Temp\SteamLuaTools-TEST-V4.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\SteamLuaTools-TEST-V4.0.exe
  "C:\Users\Admin\AppData\Local\Temp\SteamLuaTools-TEST-V4.0.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:2660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffd57ffc728,0x7ffd57ffc734,0x7ffd57ffc740
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,10682072552330814524,8373114229638671366,262144 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1548,i,12460343317690101477,5472491484327826929,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,17235593801150234437,4677256257559377965,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,920059456295049612,3207037680748152682,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3344,i,6365361187968045118,16440391282031327203,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4640,i,18177931108519868404,311910248182887217,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,11181213975853381119,11878617338152641299,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,14271157997278386664,3541202946229413281,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,18351503884224368938,8126939894278769135,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,2133503195965201720,3138415310644100011,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5464,i,17076686374263001801,15159519515065833694,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6012,i,9630093360822793116,5747816780988460543,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5808,i,9355098310787845970,12968879604557175711,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6000,i,1612319483882103945,1646717054399989458,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6396,i,8707072926511806814,13614539556827899193,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,11748074568505285831,16469302538796723899,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6244,i,8417264916442677182,13742429595283658362,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,1950896193592497398,11769310829977698261,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,11435316363581192196,4519333863927815545,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6008,i,11337854022146460018,17291447358666089307,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:9
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6232,i,13980922972589886542,284180737833107287,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5900,i,4629623497277877495,6723765086861512197,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,3269333738658269658,17309566273739029502,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,14419265200925506056,17808791789076812480,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,13677505778079195472,869577470635645246,524288 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5704,i,15461403616685579384,14180698289728310456,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5984,i,7279778291120095476,12616750611034852658,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6272,i,17975382079168524840,14537619296836757787,2097152 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5576,i,9379267969798785908,1844750014554449043,262144 --field-trial-handle=1908,i,505262583783459366,8963126091698426670,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4920

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {6b1d341b-b970-4e57-9c5a-d336841e39e5} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2388 -prefsLen 27133 -prefMapHandle 2392 -prefMapSize 270279 -ipcHandle 2400 -initialChannelId {1eab471f-65ae-4fca-92b0-107f42567d26} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3664 -prefsLen 27274 -prefMapHandle 3668 -prefMapSize 270279 -jsInitHandle 3672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3680 -initialChannelId {ccd5160b-e706-43a0-badf-848911cdbe56} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3832 -prefsLen 27274 -prefMapHandle 3836 -prefMapSize 270279 -ipcHandle 3920 -initialChannelId {80c95f4c-5920-4099-9b26-48f64d595f35} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4440 -prefsLen 34773 -prefMapHandle 4444 -prefMapSize 270279 -jsInitHandle 4448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2764 -initialChannelId {c90676bb-68a7-4d3e-bd77-f87ff01d90eb} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1616 -prefsLen 35010 -prefMapHandle 4584 -prefMapSize 270279 -ipcHandle 3092 -initialChannelId {c486755c-5b9e-4fef-98b2-3cc9ea0bcd28} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {5759f83e-2a1a-48e0-a033-5ae70bdbe630} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {4a7896a4-59dd-463e-ba56-8567eb5f3370} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {41117cb1-0347-4c8d-ac96-f641d81955d3} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6316 -prefsLen 33071 -prefMapHandle 6460 -prefMapSize 270279 -jsInitHandle 6472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6344 -initialChannelId {d0b09df3-b308-4b11-aa8e-2e7cb253a7ac} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4592

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 37412aa1189c4e93228cdb7fa4a29c356a4c23fc61ad60741a615001d8ab9a40
MD5 ac2eba035053ae28c37d234c04679a43
SHA1 e011e1215751c39885d9359c5229ed0dbfaa1bd0
SHA512 b069f3f00958649c01b75939fe5c74e472f1c47f841043b13d6728e3bb239987ba64ccb2166433bab3b89257d1c1d26f50430f2f679d702bf47c17ffb20e613c
TLSH
T1D5C0121879800C59D35CCAB301AFC44162E43EA28A8F9BF7C2D041CF8C277BC0023541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 fe3029e544761c3f87ede7550026e7234fb27d648f1809287aae15f81d7ebb12
MD5 5a09f6eaea1d458412a4af7fe4502ae6
SHA1 2e53666a8b8b26ecf0c21a193c85d7d158dc3041
SHA512 0901507e3911e691e5ac153d3d77182aab42ad307fe706ad015b288133f11a813759ea9c7c6febf40831026b26b97106bc797c47cc74ef70289c0eec8b420852
TLSH
T1F4C02B5869C0057CC7A4C1B301778C28118C7D14410B83838198414754036BC0002000
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 35018e6a83bf780bc74a28d57068f1303a777cfd2c09904b9fa6e9bac35b9bcb
MD5 3a4bcd097a2def704498183ae3fefb99
SHA1 6b72c131571bbad80e5f03e45dc1f2a39370ed8e
SHA512 ad61610557ae994130cdbad6b72966299cdcae306554f1068582b9de55715a3dd0c8bef4862c2a5f1ad8a701f763f98706a6753f10fc0241d57d31268c1f89dc
TLSH
T187319CF7C3D4997D890456F8AB157F1ACE290E18531C3C26C9D8AE1F57E6872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a17afdebbb4392b14c40874c930e1211e24f9878c9256b5b203a142ec8bebe0e
MD5 ceb42b996e5b05096dfe1f5e517bcfb7
SHA1 64bfa517ca6e166978e8eab1f6020e76ee85b343
SHA512 2c95b3945ed1765350ace27ca1d4ad855903e29f2ff30064cd5c3b0aceb45a050e3d0091b02d3310da94728481a4809941e6ced3ce6bea85a690660029cee017
SSDEEP 48:YALlqmvqmOhXDJqBdhYfhFnhBRJhBVCsJJXLsJLfoKsdTRsd8+sdifsdAosdEKs4:DryfWkjPvgqBqLeWwHmAE
TLSH
T10A91ACF3C7D9C66DC85556F4DB25BE1BCD2D0A2842283C26C8D8AE4B93E2472D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4f722d9a698480010255902b51a8c8ab75363935161f79a3431ec2f687e3a572
MD5 b79f74693831661f35139507f234fe2c
SHA1 a4ff4cee143c0342f4eb3962f1c028e31ed8387a
SHA512 57afbd003059c693cdb80d766747fc597f65d4d805e95d0ba65017c9e2e5468e339bf491285e73e2c34350c1ec625f07a1e761f8420c13b0d42611233e6e53d3
TLSH
T1C4819EF7C7D8C66D881556F4EB217E1BCD2D0A28422C3C66C8D8AE5B93E2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 df973f3c75f64489bdd4cbf925761566418f98982dc526f0d071772164e2bfdd
MD5 94863deec71e8bfc9c7087a4127439ac
SHA1 166d5dfb900f4eafae49830662a458ac5d8283ab
SHA512 9ba061173ece814b20fd974af3ca7d79d12ed3a107232a3b23000ddc5a7d12de1d7e454067f1bf1e9ef417ebc67701bafd68d8fcaa21119a10a9e96438f22f70
TLSH
T13D319CF7C3D4997D890456F8A7157F1ACE290E18531C3C26C9D8AE1F57E6872D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 03c31b5860250e31e94f56e65fa0071ff0c7de237d274edc682b72425017ad64
MD5 969ed88dc90f2f4c3d4ba164e4595b23
SHA1 3302943ecc9f29fbc1ff6a8d2cde40f48811d58f
SHA512 4ea41c80de57ee1e58af0778635ad1c88816ff7e656f6ae7b104f9780f97c459963f34adccdf4487a34d9163a2fe01f0b636c7b9f9e23526cdec7d3d40043da6
SSDEEP 48:YALlqmvqmOhXDJqBdhYfhFnhBRJhBVCsJJXLsJLfoKsdTRsd8+sdjqsdifsdAos6:DryfWkjPvgqBbeLeWwHmE
TLSH
T14A919AF3C7D9C62DC85556F49B25BE1BCD2D0A2842283C26C8D8AE4B93E2972D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 5cc6e689def541e20d5311ef3ae806c50c1a2c8b419d04907be7dd0097c4a987
MD5 59050c7abe8274440bd1f18e45653e8b
SHA1 b3d1770e39cd75118e344183fb274f209a122c75
SHA512 054d6b3d4ce8e2d8e688740c3441a7c49026a98d306c75fc34dd03d0c1f5c649e5b61fd77ee7976678a515531b2f2f11d066eca589319f2a50c3d3831819359d
TLSH
T126F059A7AB2FB96710B9866E1D05B90568BAB43205506AF8CF5A462DE0865F70B12813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f6b8a5c6ddcef5b58732498dbe93921b7a183f21794bac3e166643f29c1aac32
MD5 7cd2b58ac7fd8a2ad9b5f8e92c7d7cf9
SHA1 3fb9dfb3e65eb757b937f34545407f5448a28cea
SHA512 3f5d6f3f26f2750449d5369cf8cf055afbdeafdaa0d726bb0feeb90e9032479767a8ce858f8834fb4fb3a0c8751f94ef2906c0858148cdc4a5d719805957814e
SSDEEP 192:kRR7b4VSv7DvAPRp2X964Hsb+WNnpm0htwMEkwtX3OjcG+VyIsnAUge:kRR/a+H6XUbwk07E5+AG2e
TLSH
T10932A63EBD64697BACCBC21AF9617B53E7F6102220942E84E7FC992C11E76CC6217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1dd44e941e6120ad64d913459eb127e3ed2528288d2f1037e1951931a743bbc6
MD5 fe32c1eb5e8eb73865a4a54dc72d9156
SHA1 b2b854985055c4512d3c0f82089dad221dbeacc3
SHA512 6b7482939d038503535aad079b63b0f692ece530febd9622bd5741624ce75b256e27e9a1a64b166b0df91d0b5b13c6b1575d67829b04608b7a746f060ae3ea87
SSDEEP 192:TRR7b4VSv7DvaPRpOLG964Hsb+WNBOzAWzIeytwMEkwtX3OjCG+VyIsnAUgE:TRR/a+HkXvbwnRe2E5+OG2E
TLSH
T14042B63EB964297BADCBC22AF9217B53E7F5102221942E84E7FC992C11E76CC7217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ced8fa74090db64b9f0e15155f20dd90d15cea04f395e6eaa06b418ba857ed11
MD5 f8e0d49f1154f03cd518f24eb4983500
SHA1 a153691f34bccc584d36bd760f3d0c67bfb8253d
SHA512 51ec30819f04826464eb9d160f019fe4f76669b2a0447cef065b523a2dbeb46b06420c624a0df8e42d580574b5c18b2292feeda9c85a027423b754391f751d3e
SSDEEP 192:TRR7b4Vxv7DvaPRpOLG964Hsb+WN8yQuzAWAQqytwMEkwtX3OjCGEPyIsnAUgE:TRR/ahHkXvbwChmq2E5+OGWE
TLSH
T1EC42952EBD64297B6CCAC21EF9617B53E7F5102221942E84E7FC992C11E7ACC7217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bfc01b02e5db7751596ad6603c50e77035b720effdb14335ad29c7e12dc87902
MD5 dbb8711aa3861600575d268624f7ca87
SHA1 d180dd6f6c38f0a69983fe51de14abd1a8d0246f
SHA512 74f7317274ed16a9d3cb068f6809146d169dfba26e7f471c45bb4e2c04cee66c82dd0c468bb3e99df498beaefe59c954d0689a5d075f0a48bfce31856a8e54c7
SSDEEP 192:kRR7b4VSv7DvaPRpOt5964Hsb+WNnqxrGVgntwMEkwtX3OjCG+VyIsnAUgE:kRR/a+HkXabwcwgBE5+OG2E
TLSH
T15C42C63EB964297BACCAC21EF9657B53E7F5102221902E84F7FC9A2C11E76CC6217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7f80b339f3440c7b40786cad2008788b522d36f2badb8b69371557e243853ead
MD5 ef998554de1aeb349bdfacedf6449244
SHA1 97a733db497361af5b7c0e2e528435357c40d472
SHA512 f6c681607b57093dbd6be6164c79bb2b7cfd302805af0beadd61fb33a734e0a264ee038d906e6d2b43d97199cf6436a5008093b668555e2c252d942dc75d107c
TLSH
T199A0021091C54415EE20467073B60D452BA15F153D954717589145849C9F1C58597114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a6c22e043f3879a96512897844bbd92a8d08e02d86d35ef731733beabbf34578
MD5 7c216647ba199ac53218c964ec21267b
SHA1 8cd08c8f4cb38b54c40ee6efa7073a99cf53622f
SHA512 995b922c64f7df5c3212f7296eafe1e65b17d60aea00fd633a65fe2e0f46c66d803971c318656abd4adab5a78d73bc51acd821f18f01df005a557df5f500dd38
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5bd09b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5bd09b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

fcb46b99-05bb-4ac2-b241-2f84e0c23e09.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fcb46b99-05bb-4ac2-b241-2f84e0c23e09.tmp
Size 13KB
SHA256 4406bdffc193207f8adff21792b5cbd571a409379a34bafd4ea43d2fa1b37ff6
MD5 5b914da2adac8ca197cd73d29b63b5ee
SHA1 e98c1c12d9a985b2409277a1879283ca22fdb50c
SHA512 8e2fe80a9a9d6f42cf345a8ff8af7e6ca7dc6dccef280477b22a682a04c364fc876982edaaff5526906ab711500fa81aee9e3c6f86cfd780bfd14f1519951e63
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU3OaHBj7RqK2:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAONs
TLSH
T1F1520967648D9A3F0FC8DA8CDC277F4FADF502576168092496FA9C0803E57CA125A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 fbd720b49b1e19f8b5f0cd9a86786825dd8d66bd3161ab7a02bec88578742ebd
MD5 0727ac4cc2d91cf7a3020a632bf878ec
SHA1 5068409c9bf330dd2a9bdd878587c2ba447486f4
SHA512 4a0c6d15c6ec9f057be18fa0b98b7ab572e7e9d1c4985a65dfeba800b56afa460b76c0a1b7d9226dcd836bbdc00e6655ce4e4e7d9ae646cedc56869d4b008eb0
SSDEEP 3072:qllIT4Kf9fBiFdE0Pvwo1NDoRzUxuQmdex44EQk0aB:iDKf9E9dD6zEYdO44ErB
TLSH
T1ECC312711CF41EF31EF740A1FAB7704B6D40EECB960A666C85D19B846842DAE3853C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 2942758e032b494f3a9153862861e9a10e3276188cd8e028a242286ff42d3073
MD5 0055b9232191af960a411a6b9febf3a0
SHA1 6f785e0bab8853d40c0e2514156ea25ea2fd76eb
SHA512 b8c0779599d5449aa4583666443df14db554c25a7087114261446e087fc22a30f6b60aa12bf1225c818bc5483d8c84aa92c7e7e6df14406b008117326bcba328
SSDEEP 3072:allIT4Kf9fBiFdE0Pvwo1NDoRzUxuQmdex44EQk0aB:yDKf9E9dD6zEYdO44ErB
TLSH
T15CC312711CF41EF31EF740A2B9B7708BAD40EECB960E666C85D19B846842DAE3853C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 1d5de7d2820592755bd18b77bb9be949cc1d58fefd21a71f7d3afa54b0aebefb
MD5 a2adb71cad976618f504649fd997a82d
SHA1 bd12fff321d458cc209bfb84e9fe2412caba03bf
SHA512 27cd4e0d4c0d32fede4d9c6efe8796adb17ba1e8090d80de89aaed418372c9c8f4d0555cdfe6bcaa738de206c64cbbce4d1792843e9916958374ecba79970b93
SSDEEP 3072:gllIT4Kf9fBiFdE0Pvwo1NDoRzUxuQmdex44EQk0aB:cDKf9E9dD6zEYdO44ErB
TLSH
T19AC312701CF41FF31AE74162FABB704FBA10AE87910F56AC86D186946882DAD3953C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c0f9d1b343df9c42d117271edb33a3ba2d001c7651f8b4af31c372e255f9fcf6
MD5 152afe5100c4c82ea57d188fb1236755
SHA1 5a05f824114a3130eee1a222a54dc6d67d54afce
SHA512 1918f8fb537a9213483775d9ca931abaeedb07e52e1745fc28a4c7d85def005399a6fe1f14d87936cd6497e3cf033aec2dfc0f75e5840a4363293f75a2ef1e51
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5RCDqB6/dGyv95SFhbb2Jv4a:gC0LA/TE57cDUD+6UweSFhbKl
TLSH
T160A10971B4A95EB75DB9C585F4827E83CF68A127A9226F80D8DD1F0C10E71EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 160KB
SHA256 0509fdfdf1fe7a1d7ec9256bc54b082e5f5710df6567b6cdc14d35f0f230739c
MD5 abfa7171a8beb4e03997b53846039f07
SHA1 4286ff793922365a4c2c34b509f20119b9e3dc57
SHA512 a0e437c1dfb0545fd38bced609a4eefe24c02cd62f70a4141d4eca93ef5eaa97a446dbeb2bea1b96dbcb28cd22579fa0d549ff4d92b99062842b113c14c400e4
SSDEEP 3072:2H4DWBciVDsKnllIT4Kf9fBiFdE0Pvwo1NDoRzUxuQmdex44EQk0aB:2HDBNDblDKf9E9dD6zEYdO44ErB
TLSH
T1C9F323325CF50FF31DF702A6B1B7B4CBBD00AAC3926BB6AC89D1EB544482D5D3816812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E66BD1D4CFC6F2E2C0A4B8E80F91B39A3A380AE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\0E66BD1D4CFC6F2E2C0A4B8E80F91B39A3A380AE
Size 50KB
SHA256 b0d87cfd04daca080af977badfd043a3b309f49cf1d3f60ed4271e18af9fb838
MD5 e18ddc31d5d08078b10b6c189c38d6db
SHA1 534b82e5e24e58f005a4790800d03a9c918818bc
SHA512 e773223dfc0420689760c8eea82f844d658d81621d86895c21237d8cb94f9fe8d71ef17ff1846873e207cf8f41c0c0158d7ebfeb381e6c53a65888ed0916c944
SSDEEP 1536:BN/qZdqVxwI7EZh4/FfYUFI2WX6+k2FpK3t1W2w28:mZdq3eydgUTWXVlFpK3tRw
TLSH
T17C33F1377C40F2441B87FAE286623A5836F5F72339D1DC68A41426684FE8AF3C8E1795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

386D22EAB36C3C5C3713F931E60D7F8CA78D773F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\386D22EAB36C3C5C3713F931E60D7F8CA78D773F
Size 48KB
SHA256 2340e36d74d6e14e7a4cd9e4a311ef9913f3ed80b193059d3eede40b3c06450e
MD5 b83ea1be12059437fac37c6b3b454c1f
SHA1 831ea328534225b9d9b42f4d18c03978fc644f33
SHA512 9770547a107177ca5a0439d7676e8595536e5bb60d027444058bea333c0f1d088af227286f2f0df25018dffcbb7abf0feab50368e3266981f8e07dbecaad10bf
SSDEEP 1536:VcI/iEEEtXdFJj+0GPwHbP+w5rQ1W2w2N:VZ/2wLt+0GY72wxQRB
TLSH
T14723F23B0F24A7054912B6F06540FBC87D543F138FEDA4BD86189B5D1D98BE164AB0DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 b37772d7b2ed99979b5f915f30e1b40daa348bf268761c47f011e21cec8d1041
MD5 a066666ef7af597539cdcb773bec8e97
SHA1 b026ac23ce63a6b5e8f5e2b39a67ea485174b1b9
SHA512 eefc9da3f90b1e8e81d5749e1bf0b8fa430bd550aebcbd8f98e2d2719876aa526c5299ba0ea647bfe0da27ee3c44867ae783f1c1ced30b3e9e7c0b7c19cc5963
SSDEEP 384:HwCe7iO024YVDL84KKDL849B7SOEAd9KVRaAcP+AWRMAkdtE4:QqZYVDL8lKDL8CB7S/AmVAf+hRMtdtE4
TLSH
T107729D3E9F413CAC19A7C0E8C4F8539A4C1877A7DFE6806D21683D0DCA98969B1F544F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenSteamTools.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\OpenSteamTools.zip
Size 3.1MB
SHA256 e6c6c843c4a751a8fc3e9800f340589f411931051263719db4bc830beecfdedb
MD5 2b310571a2130589727131d3578a774e
SHA1 20e30549ad3446807c1e91fa73ce7e1578492c26
SHA512 16c297215cbb0f9437dff89489f7561e5022359a20b340b9c86a3e99b09df189b0cfcd5a726c961270cee46b3229efcb8ab7202555a5b8f7cba0ad7612f218f1
SSDEEP 98304:Nji2tLyYSlu7RGEPOAgxXo/sqFcqlfNB1jT+HaDPF7ijHDkmDA/d:NXtIY7R5a2FcqdNz+uPFYBe
TLSH
T1ACE533769F7499B012B6D23F636C3317E939F089C8A709517AA25422FC61C48ED98E7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\VCRUNTIME140_1.dll
Size 36KB
SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
MD5 135359d350f72ad4bf716b764d39e749
SHA1 2e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA512 cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba
SSDEEP 384:5hnvMCmWEKhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+Xf0+uncS7IO5WrCKWU/tQ0g:YCm5KhUcwrHY/ntTxT6ov07b4SwY1zl
TLSH
T113F24B9463788492E46B95B0C4A35F2BFB38F9625750938F0BA4815D2F637D0F63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\_asyncio.pyd
Size 63KB
SHA256 a9a99a2b847e46c0efce7fcfefd27f4bce58baf9207277c17bffd09ef4d274e5
MD5 33d0b6de555ddbbbd5ca229bfa91c329
SHA1 03034826675ac93267ce0bf0eaec9c8499e3fe17
SHA512 dbbd1ddfa445e22a0170a628387fcf3cb95e6f8b09465d76595555c4a67da4274974ba7b348c4c81fe71c68d735c13aacb8063d3a964a8a0556fb000d68686b7
SSDEEP 1536:owmuopcJpmVwR40axzEfRILOnMv7SySmPxe:owmu4/mR40axzEfRILOnw3xe
TLSH
T1C1536B87E2904095D967A178D8B34F46E771F5504A0043CE6168C29E3FB33525BFFBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\_bz2.pyd
Size 81KB
SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
MD5 86d1b2a9070cd7d52124126a357ff067
SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
SSDEEP 1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
TLSH
T160838D92B3A458B5F05BA27955B10357E371F90D03A0D3EFB758826B2F03B826D6432E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\_ctypes.pyd
Size 120KB
SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
MD5 1635a0c5a72df5ae64072cbb0065aebe
SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99
SSDEEP 3072:0OEESRiaiH6lU1vxqfrId0sx3gVILLPykxA:hj+I1vAfrIRx3gN
TLSH
T10BC36C0B2358109AEB674078C5B35E47DB71B859171087CF0264C69E2F63BA36E7F716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\_decimal.pyd
Size 248KB
SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
MD5 20c77203ddf9ff2ff96d6d11dea2edcf
SHA1 0d660b8d1161e72c993c6e2ab0292a409f6379a5
SHA512 2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca
SSDEEP 6144:3LT2sto29vTlN5cdIKdo4/3VaV8FlBa9qWMa3pLW1A/T8O51j4iab9M:H2s/9vTlPcdk4vVtFU98iIu
TLSH
T10B446C66A2490CA4DE77807498974B57F7B278944320D3CF43A4CAA73F576A323BD748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\ada92cb5d92a588d1b93__mypyc.cp310-win_amd64.pyd
Size 218KB
SHA256 df449f6b7397e3a83f84d08ff38efac2c45527944221d1d6f6e78228a05c8ce7
MD5 14b9c9770f379cf015e6cd6111dd2c57
SHA1 6d5ce83ad1aad5718f272ca33cc611a5d39d1f67
SHA512 4a55e8ae5be9a60f043f2a29cbae22643c11be8c3b4bf8ef127f6c3ac4d9df7cd7ebaa370c028211aab4b7da08c592a0adcaeb3aaf5db5cdb43f9f05e7fe247e
SSDEEP 6144:xDGl2V+9r+I27dYTsxkP8VXaVlaz8fnt4HtFmiGJVMI0cwZKMY:xDGUV+9GdCJd
TLSH
T189242A3A62480025ED774279CC639123EAB3B152073156CF09D0CA756F57BEABBBDB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 27954e62e12d115bb1540db4bb9de6e2c852d914aea61cba3c203595138537b2
MD5 5cca64ee98121c203b415d577f6568d7
SHA1 9631e26d8ee54e41f7898b50088fce857eceb48b
SHA512 6386f4c4dd650d7885353419f2eaad6382b166c85006aca5be80d167b3e69d30d33fe3c06e7c5467fc39737db65d9c8f248377d3304d213a1d880c0d3c225d5c
SSDEEP 192:DROPW2hWxca8LxydkeR+1WOqxANmTsX01k9z3AJOWv1j3TLo0/:DREW2hWxcaGAYF0oR9zwPvLoU
TLSH
T1E5A23A875EB8A143FA9F9E700298E6437C3CABCB5850E4653595F20C18D77DADB0472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 6f22ff5bf9d53b7f2c3fcd553d9b8664ef5401912194b8e599e4dbd8f3105405
MD5 11ad1c350e57420b840ced2afda9a05e
SHA1 91056d502d3168ba4e51ac7893cab3868b3a4cc4
SHA512 8df296ce0362431707b02592d75f1c003b33fafec9ebe7e7af1fdb368c7be848f8450626e564818938b2b9e71baae2a4290991c1c6ef87f9df246c748b9b1755
SSDEEP 192:QW2hWNca8LxydkeR+G4ztLVQcNpcspKLX01k9z3A8l:QW2hWNcaGA7sCscmeR9zXl
TLSH
T1D9A23A874B78D002FEDAAEB052A4DA437D3CA7DB2990942625D5F1041CA77C9EB2472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 c5dc0df2fcc456c2b08392ea7d539d43549d04d14ed83d69cd46f79b9e34902a
MD5 b513fd176ee9a5fa4ed96bfa8681ec4e
SHA1 f115d1bb2948e47c51fb883a0ad2cec786c35643
SHA512 b9fdbcd1325dfe393bf2812bfea88f544a99ecc1a66a01656767938f0d8bc82f4d5ac3e806b5d29a705d9a583ea4343b63eb986bd2a62bdce198111ec3a431fc
SSDEEP 192:TW2hWTBca8LxydkeR+stnZNpA1wki+X01k9z3A1Wh:TW2hWdcaGAd9ki+R9zEo
TLSH
T157A24BC297B8E043EE9B9E7042E4DA537C3CA7CB5D90C9661684F1182C977DDAB1063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 9ff8300ecf0ebd4c8130800b5b8857b6ddf21902264af42fb1ac15c794115864
MD5 6a33a9f3dff3f81f6ac8b199e46b9737
SHA1 1346164f9b8b7dec4f3027c27a3b408d025b055b
SHA512 d11e950d80f71ed1534993142975990bf1d62ce6c8829a5b477815dc1f20bb98f445c409bf255495278d7fc75f5bd796119e20a95e4a28e1d9f371c79622bce3
SSDEEP 192:ZqDmxD3XBW2hWs39ca8LxydkeR+awlPg9dxP3NGmVX01k9z3As80L4:4D8BW2hWs39caGAfwqNP3U0R9zj804
TLSH
T118A239C74778A083FDAFAE7052A8EA437D3CA7C60A90955515D4E6542CE33C5EB2073D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 39174763da266b4b955e27eecaef15d8283bb77f9eca94fe925d4928f37a4fa1
MD5 59ddd4d171303a61def209d886cc08fb
SHA1 38ebaa2c8f1fc2e6e31f04d583b7427474fbe3a8
SHA512 087a38ddbdad302e4e2e3e932e8338626dc3cc08a4cd58e84ddd87b666f6407beb569d1cc056c3b3349851edc1ac6fda435065bfc67c4df08ccbbd2ddb053005
SSDEEP 192:br5W2hWjca8LxydkeR+oaUPcqW8xYqD0cSX01k9z3AJL8Fg5W:br5W2hWjcaGA9alCvDyR9zELr5W
TLSH
T175A249C65B785042FDDBAD7052A8EA933C3DB7C70D90D9560694F5481CA37C9EB20A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 a9660f0e3ab6032bba0b75e1d02ce0bc57c9043bca423477843a7a3af1b1c200
MD5 b11d7274ec876b8799104a070fc31e75
SHA1 b959c2e380b95c183e3dc26e63868493e2911e05
SHA512 0113701b9556eade925cabbd51869113e9dad92da96c0b65ecaeaeb6b6c69a35f505a1c3e0c9c1f135a6e50f7e545a34d290ce006e8f57aa644f68589f3b2756
SSDEEP 192:+nwhDPvVr8rFTswW2hWmZca8Lxyf7LRroihrSw/FiGz5j4HsX01k9z3Ac/O0v:+wJPvVreW2hWucaGAf7pofw/nR9zPn
TLSH
T131C21787C6B4F64AF98E9E3151A6C903A83853C7082085961BD4D79D3CF738AE3D85A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 445a2c24c8565834e1e41e4c617d2f9cf5def8e4a477e55e2f18583845b24c1d
MD5 fdb151f9c2a99ff9843ff1cf07b0e648
SHA1 9ab5c2b252ab12a9250620bfa792cacdac7537bf
SHA512 0baa933c74e8794a12c949e42d5242107da5c34ba9a9c960e90d61d44e096c609da95290fecdb19c380eca20b491cd4d1b67c7913ca7e090b96a9b2a9f4b591d
SSDEEP 192:hVeBW2hWfca8LxydkeR+w2LqwdhTsX01k9z3AJOWTxzC57:h0BW2hWfcaGAsL/dhoR9zwtxW
TLSH
T1FFA24AC257789083FA9B6E7012E8D6937C3CA3CB1D90986615D4F1581CA37CAEA1477E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 94f7611fa4568f4577deba250c1254a3c83ffc7b4fd2f00243f3bfac5a993fd8
MD5 25edbbc33347a1425ee23a1d7a6cb4ec
SHA1 2ecc8b7f21b6c2d426db5496466f140b0b10ba82
SHA512 230423af863037a6e5c14f3814472ea3faa56647217c8ea7dc5f1e1c279209a09296ffaa2869037ef61d7995fa89aa07057e56d3f16a4c23159260c696d3db7f
SSDEEP 192:+sW2hWY6Oca8LxydkeR+qnz5j4HsX01k9z3Ac/9T2Gu:+sW2hWYHcaGAD3R9zPNo
TLSH
T169A24AC2C7789442FAAA5E704398E6637C3CB7CB2990C45616D4E2481CE77C9DB14B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 d655a217f4c17982b4c5ecb406290885c74afba361dd840c4245c0b28e07c192
MD5 ac8333e8b1294df2187e41bc3473f6cf
SHA1 497770450fd6e0e07d94ffb5aaf31602acc3cd07
SHA512 fe5894bbec307fefc020e6044f319e98715340f82cce435027912a0a3abd47e23821294274ca174190d694f72562eee9866c77575773a84ab8c46621320462ca
SSDEEP 384:hoxlFW2hWwcaGAf7pofGkFec5ap9R9zYhlP:qPbdezA/9zE
TLSH
T14EA25BCA8778A003F9AB6EB042E5EA673C3CA7D71950955618D4F10C2C937C5EB29B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 69b0f1e099dac7ffbbf1260eb4818abeacd2b9cf105b742b16e6bd5dda3bf035
MD5 4f3772ed964e993f0dbbef152621d6e7
SHA1 ca2249909fc4e38076991a5d4753cbd14dcd457e
SHA512 8fada2323034374e15d2ffde5f4a05e8df418eaca6ed295b5efc2b7348682d7df1875db0e9a47e9f0ffaa01935b831136fba8d5793cf352f02d167e36d43e095
SSDEEP 192:FzKW2hWNca8LxydkeR+/3F846IfgtUX01k9z3AW9KT3TYwg:9KW2hWNcaGAw3FR1tR9z3o8l
TLSH
T147A23AC29B7CA403FAEE6EB01298DA437C3CA7CB1D51C42616C5E15828977C9EB2473D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 87622d07bb5c9fa5ccd9f74ac70a1e2ae0cdf54462f90f365178a15a814bf3c4
MD5 3312ee2d0f34b7603be92e62a9237b98
SHA1 ce5ddfdbd501f255b3e2240fdd18ba9412173b68
SHA512 873b096d02f862c126a7d6eee06d40bfc079a98368f4e4ad0cc446a62a9becc28e595f55af828ec6f6e922507c7484ba2f20d9092ff6fc278abb1362e72a6ae0
SSDEEP 384:ETvuBL3B9W2hW0bcaGA8yUE3Sl8BR9z96cR:FBL3BrN1bjJ3B9zkO
TLSH
T1DDA23AC29B7CA042F9EB9E705264D6437C3D63CB5950E87A06E8F25818E33C5EB1467D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 79ec668286cb900c66e1caf8a47309d986c9dc4d37a5d2dcedb2ff2a973896d9
MD5 bfdce1f7bd47a57c0e87582b56feb2d0
SHA1 b5ac9ed5d734cafc6c9d0a3466ccc2844960dc61
SHA512 18b331c18911ba1106ea64df88b1fe0139daeed7407a18be5f9cebed0b635f49b35c8efe634be13db71253476249f366c7f67421d1656a6fea20c8546a198312
SSDEEP 384:0naOMw3zdp3bwjGzue9/0jCRrndbNW2hWKcaGAf7pofyPGTYAsR9zCW2U8N:FOMwBprwjGzue9/0jCRrndbb1bdejMj4
TLSH
T1E6A24B96D3A4E307F94DD9707057D9427C3867860862E98603E1EB1C68F378AEBA536C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-memory-l1-1-0.dll
Size 22KB
SHA256 7f12e6eb9a992ea199bcfc755eea488a8889cd2642dba00e49fb06a14bec8408
MD5 e6df7387562b7da98bbb304d6adb1024
SHA1 dd6366a5e364dae03ab1d7ee71a8c3a188cdfebd
SHA512 5220dcf985b6d2501a48ad7febfc3b664a0155b86a1ad1c6da55fc0c15a7060f1a04bde22729e464bdad950fb9a2fb07a72ccfcd32c294c9688e0b4686dd82de
SSDEEP 192:9TfW2hW1ca8Lxyf7LRroihrSC2RzlgnKug8X01k9z3AAF8m0/:ZfW2hW1caGAf7pofCsl8BR9z9dA
TLSH
T1E9A24B9687789803F9EB9D708295DB537C3EA7C71890A56612E4F1042CE73C5EB2473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-namedpipe-l1-1-0.dll
Size 22KB
SHA256 daf13af507230a92191c348611e8b31bc384055ea5b9a6d18057646d93bfe4f7
MD5 6a04ee1c0b09011993a3add2900388b1
SHA1 646b6ba762f772db813d568fc513ab3dc9f217cb
SHA512 4c438b34464508c718f78b39f9f0ad48475f8b86141a3467b71fc771c57c9a4e8b8af9b2b5bab60fcab25ea3a5f72f75efc04070375dbac98caff97a2d6525a5
SSDEEP 192:TW2hWmeca8Lxyf7LRroihrSwViQcNpcspKLX01k9z3A8MG:TW2hWhcaGAf7pofwrscmeR9zX1
TLSH
T1B8A24BD68768D002FA9F6EB042E5C9133C3C97CB2D50D915A6D4F4582CA77C8E73466D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-processenvironment-l1-1-0.dll
Size 22KB
SHA256 74d809270a418e4bc1d3b94348094f00463635cedfbadd97d29686a6d037d2da
MD5 8557ced01b57f200a0f30cfaa9c4af0e
SHA1 507db54f21066f5bb6aa672f2f74d5b792cc6d72
SHA512 edfbc37e203e648483194f2c714054612e66fc48b64a207708dc4d25bf069153a0398fc30d784ebe2249cc2493b13adb3d6b31f37d1c666c77acdcd0cf643abf
SSDEEP 192:/YF6EW2hWSca8LxydkeR+Y3eTREiTMAAUYX01k9z3ALfWXfwDL7ZF:AFxW2hWScaGAH38MgYR9zSfyfwTZF
TLSH
T1CCA24BC6A6BCA002FECA6D705299E5673C3CA7E71DA0C46152D4E2182CE7395E744B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-processthreads-l1-1-0.dll
Size 22KB
SHA256 6620a7962adb6a25a51e13add907189763b76d0816a356465d135eeeed1065a0
MD5 9edaf9f95bb1ddad23ef7c5bb00de810
SHA1 1f73ce1815910dfb6d0d7d24d296ee8cdf960e90
SHA512 e6766b8336ef9ba4e66df1fba1efb867291ffb178ed6b22e2d4416e1bacae2a5f41d71d37311afedb64fdaf04d0441fe8f9b38c98ecac9317131dc208aaba56b
SSDEEP 384:ick1JzNcKSIPW2hWrcaGA8pvifX7R9zUX8fp/uQ:kcKSEKbA6F9zUMf9F
TLSH
T1E6A23BD186BCE183F88EAD706285E6237D7D93860C65857105D4F2983DFB3CAD62463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-processthreads-l1-1-1.dll
Size 22KB
SHA256 82850eb2e7d100938ebd419440e4575750999bc9e349cd074019e413673d02c8
MD5 b3c4eca47635796a499354af78e569de
SHA1 a7fb2ffb3561086f70dc0e7a76c9e37213d9eac0
SHA512 b34ac057f9dafa1c32f1725af7305a66d76397986d3d2be7235e26365efafefa92ae4b4be09c8ef9135bd67adbff6a677f6b0946452508fea0fddfd155c0b853
SSDEEP 384:n4DfIeqW2hWEcaGAn04sowGOrjR9zcX4d:3eSTbjjwGOrF9zq4d
TLSH
T147A218818B7C9042FAEB5EB06294EA933C3DA7C75960C96215D0F25C1CE7396EB1423D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-profile-l1-1-0.dll
Size 22KB
SHA256 b43119bdfc7c562bf07c26e01b7b862aa8dc9d5e795798fe93969111244ed2da
MD5 9f8f59ccf126fe7752b45593862b77d4
SHA1 dc211a3c925655cf7dc2b798312fe22f26d3e7ca
SHA512 74d580a21ac9d96c379262a780c992ceaf2c3fe2c19fdbb4a634bea9b23578c888f1e903ed149a35098269aa082a8bd92dd7f0d5a07c24af10a8de15f8b11260
SSDEEP 192:BW2hWsFca8LxydkeR+BbBMHCE/Sv6dlX01k9z3A47ZchWB6:BW2hWsFcaGAMdE/S+R9zn7qG6
TLSH
T137A23BC2973C9043FA9BAE7052E4DA537C3DA7C76DA0856605D4F2582CA33C9BB1463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 22KB
SHA256 bd0cff402e3f64baaf2bfb17d86b2c4c7d03584ea2601ca5c55de147a769a32a
MD5 0fe0355a5e36cd3dee10353249eb0a46
SHA1 9b6c958e32cfcdb7dad1519bd13fdede63b16045
SHA512 7ccd4f6fb6127d30988f25c81ccb7891a6a94362a9c9e6917958e5d9063685f3c5244157dd4669ed7ea31f270cd56f870071060ac94be08018441f8f79d3d664
SSDEEP 384:mGeVnW2hW3caGAf7pofaKWMgYR9zSfym1:mGeVpibde/tgE9z21
TLSH
T191A24BDA97689002FDDA2EB01299DE673C3DABC31DA09A6205E5F1481CD73D4EB1462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-string-l1-1-0.dll
Size 22KB
SHA256 1985000499475faf541b17c8acbce788bcdba6dddd3b8910b6730238f1c18862
MD5 7bab8cd1fa214d6de752165580b92557
SHA1 2ef6ed7dd5413a424f46358b3a500739f93ac6a6
SHA512 0aa4acac3c77d8a0bd6319f3342d1bf3ee9b8584d3c488d0a639352f7921cc2359827b3a56cc37c1d37b0b2a7ee18c7cb0700bb01f9b086aac808d255960f96d
SSDEEP 192:9GyMvr3W2hWjca8LxydkeR+e0B8kgg6bV46X01k9z3A7EAzOzD:9GyMvbW2hWjcaGAL0BhgtFR9zeEACzD
TLSH
T1AAA23A839B789006FE8A5E701299EA43BC3CA7C71DA0D5A522D4F1481CE33D9DB14B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-synch-l1-1-0.dll
Size 22KB
SHA256 055544d562ca50d49443926bca396de985735f7451806ff2565486e406809d25
MD5 80c461242a59eb50085619922e7cbb25
SHA1 204abe872b53d800a4ec710d7ac2603fd5f18a3e
SHA512 5c86b363c0447230183c0beb660d67c294ea2fc268c2fb792719df714ec0e2d11e511f55ec15ea898bd0fedb2c79d35cce131c3f8de1511bed1faee0200c3279
SSDEEP 384:Miwidv3V0dfpkXc0vVaGFW2hWvcaGACe7kcDR9zM6xTox:VHdv3VqpkXc0vVaw6bR7B9zMPx
TLSH
T18BA22887E3E4B143F99FED7082C6D9537C3857C64960C87626D4E6282CA37C9EB1462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-synch-l1-2-0.dll
Size 22KB
SHA256 0d8f2f7d031f143110c9bf5bdd4f75b24e8b41319fa2e20f78068c084e0d7603
MD5 74cb67262d1d6305ad88ca194da3d53f
SHA1 77f2d609f47d50ddf191e7d1411a89accf63543b
SHA512 a005e8a807aa448b62c9b89f01edafc9d5257a21625410c3cdabc78ad244c439255171ea09f346dc5a4066d83e3b2c605749b1c03a822999f1288db1f69bc370
SSDEEP 384:ZtZ3GW2hWgcaGAf7pof7NPGTYAsR9zCCd:sLbdecMj9zdd
TLSH
T151A25BDA87686103FA9BAD7083D6DA533C3C6BC71D60651316E9E1091CF33D5EA14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-sysinfo-l1-1-0.dll
Size 22KB
SHA256 8010d006df2d62839c933d3b5998abc7a7830ffe32ca68b17c76f3292f5e56ec
MD5 7bc2a31f376cf3b2cbf9be760905de0e
SHA1 8291cdefffd1072c99f10467ee5ce5668a7330a1
SHA512 638e3c9f90fc1192c5e000b5cac9aa0ab0d2ee7c8a0c2eaa1dd14e616e3ca58123a862a7d1acdce408a109fde60827f5a6e2865c2e1ad31d3ec06829600f86db
SSDEEP 192:agdKIMF3mavW2hWXca8LxydkeR+CAFSA0+HTeQZNiBX01k9z3AIsPr/c4vx5:vu7vW2hWXcaGArAFaQq/R9zZCr/TT
TLSH
T12FA21982A7B8A102F99A6E70A1D5E6437C38ABC72C51C45906D4E3185DF33C9AB2463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-timezone-l1-1-0.dll
Size 22KB
SHA256 1789f5e749cf3a5d419e3b835bd9d78a077ee77f3e761f0fbf3609e38ace6f40
MD5 65a995eaf06202392453b37cfc8e459f
SHA1 69707ab23d628b5446102d3387c172449128ade6
SHA512 c0414ca69cdd52099c0931211daafa3ca6efe330b367785f5c8f67efc7d298ba87fb0afed8e8e03587a56fe5e9202f411a480da1071ddff5350324e6d2003bbf
SSDEEP 192:gzW2hWmGca8Lxyf7LRroihrSl6XpUHWX01k9z3AKCj45VvH:gzW2hWpcaGAf7pofl0pjR9zLCs/H
TLSH
T1F4A22AC3DB289402FDCF2EB052A9D9537C3CA7D70960A55649D6E0092CEB789EB2472C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-core-util-l1-1-0.dll
Size 22KB
SHA256 c893a59c4d1fa86fb50d486ebf3a873244b910efec5b00690d4a20afb7ce0761
MD5 ac4cf03b7a2f5757121f917214c2720d
SHA1 1b1e5ed1cea44be003c7b4acf3f86711885e1537
SHA512 41d8c3621c641b6865fd3aca7361c689e09706545e0e1b5221f05bc251ab5f1b46fda70a78b12240376295af22f6e631ce68615cb4c7a15e475b2d0d7e939758
SSDEEP 192:SlyW2hWjca8LxydkeR+Yhf1TOwGOr49uX01k9z3AFXGwDp:WyW2hWjcaGAVp0wGOrjR9zcX3t
TLSH
T186A23AC28BBCD042FDAB6E7062D8EA437C3CA7C75990949159D4F15828E37C5EB1463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-conio-l1-1-0.dll
Size 22KB
SHA256 9e466e76079b73bd9b0114004d040d193dc982e4150eee1241a902d16c2bda38
MD5 9898df995b7e317efb1278de089a9fd1
SHA1 78196b60beabbdd71835df4f47ec3d6b1e347a29
SHA512 82333d8ddbdd03874473c2b2ca3676cee0aa8ee486d60093f4dfcd4b48a42eb141214cbaa65dc26d891bc64c999cbd28b2ea4dbfd8a028ba66ef390c8de3a4a3
SSDEEP 192:/BFywW2hWXca8Lxyf7LRroihrSy2WVPwZNU6nq9bFs0X01k9z3AOA8DkI8:JfW2hWXcaGAf7pofyfOA9bFs0R9zNAO8
TLSH
T1EFA2298362BCA903E5575B30A2F9EB937D391BC32990B0665494B41438E37DAFE1963C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-convert-l1-1-0.dll
Size 26KB
SHA256 64c48b1280e4540c205ee7798b7da200afd95898d520ece1d56bf8a8a351fc3e
MD5 236d7460e5d69e0b366bc9536a4de45e
SHA1 1f093347533303aad6f1b7c5d232c30b23f69f71
SHA512 ed44c5097c831a1865078c6ded876929854b3cc01e8ea227cd1fb78df3f44070c8c7536cbe24223c5177e14322ab3580cde3bc5ed8aeddf29cdb1d480ef59091
SSDEEP 192:a9cyNW2hW+ca8LxydkeR+ysI0yQN+HTeQZNiBX01k9z3AIsPr/eanig:fyNW2hW+caGAPwdNQq/R9zZCr/9ig
TLSH
T19EC2E98366E87F55E59F177221FA9BD36A381B86159153B4C203D14C3883782BD97C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-environment-l1-1-0.dll
Size 22KB
SHA256 1a513c0601c5b628018c003d8598586d4a48fd1acf51372f6783dc23b0a27756
MD5 1affe1e2dd2a340a606e2ec7d3bfbb31
SHA1 f916344fcf71582cb84139931366107065cd9762
SHA512 0a372ca20f62197a62728b43e78f43e33fe44f5eef599e38ab4779b14beafc947e643485a4d6baa67c7ed2383f2fbba204340d0d3df60cef9e661d5cdfc5b8e5
SSDEEP 192:DW2hWsOca8LxydkeR+g5LKY8u27X01k9z3AxG1ms:DW2hWsOcaGA5xo7R9zqW
TLSH
T11DA229C25B786142FADB5E7092B4EA537D3CA7CB1D4095770AE6F2142CD3781AB2063D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-filesystem-l1-1-0.dll
Size 22KB
SHA256 89bb192dd079784d9ba716a2e45a1ee6af75c67e9151fde77eb8ec32cb014182
MD5 cbe1b07d437d0f857b14ce71e19fe0c8
SHA1 4c9b8a63cdf9260298532bc5b546ef385e56b461
SHA512 d943dd486483d556dfc378e023c5760d887c2d08132f649428be646634f01995fa7643e9de5594fa995047e751b06a583d1570d7444283800505f42a995d6d51
SSDEEP 384:lN7nWm5C1W2hWRcaGAf7pofYhcSgnS+R9zn7uy:LnWm5CDkbdewTgSi9zKy
TLSH
T11AA22A8357E87E02EEAB1B7251FDDBD73E3D1B82099247629082A11839E33C0BF1546D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-heap-l1-1-0.dll
Size 22KB
SHA256 e5a0c8d551e36e5fd394a45a5e9229f592b46d8e80897f25e7f0ca449abb6b00
MD5 824274f2f049648f720ac3b101db27e1
SHA1 29c51fea85d7f166c1eba7d91f8d11f962853a2b
SHA512 c490a90c886452b8e95e15b515ecf0f211bbf1693d90e8702ea9edf55b4a1ade7c94cc5c3ef891762579497e470af4867000fec8f106cca455aeff9606d05a98
SSDEEP 192:YCh8Y17aFBRQW2hWVGca8LxydkeR+qSTdbV46X01k9z3A7EAc+LlSOPP9:LLNW2hWVGcaGAfS5FR9zeEA95SOPP9
TLSH
T1F1A25C8386B85402EE9B6F7062E9DA873D7DA7C36C50C9669197F1582CD33C4AB1063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-locale-l1-1-0.dll
Size 22KB
SHA256 f13dc1d6895f21fe2f7fd4b7ada78828b5a819013f751aa32eb1704beb4dc469
MD5 aac72a019b154dacb2a2709aab60eb49
SHA1 ffedf0cec8bc9192d6843f842f865b61552f48c5
SHA512 5785d853c63bf84063c544be8e4238b83634050b63ac5ec7ab2b001fa180111fbd21962912dcf5e2247fb892cb39cd3b87a575a881c80d2878cdb7c3e419f6e3
SSDEEP 192:ZTW2hWmlca8Lxyf7LRroihrSjs3bV46X01k9z3A7EAdRK1r:hW2hWecaGAf7pofjs3FR9zeEAS1
TLSH
T154A26CC787A8A403EA872EB091E9DB477C3C67C31D01D59A15C6F4582CA37DCEB14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-math-l1-1-0.dll
Size 30KB
SHA256 a13aed9e8d7f4f53826cedd6acbc7b75dba51aeecd7f030b0f0d7b7c66e1a042
MD5 9256995809d5692537b9ad3cea7f1f14
SHA1 fe11173f04815f92423fd23442d93ccc3cfa8a23
SHA512 cd834dcdcb28cd1c15780866c42db3ba926b59518c669e6b2d3b92005412cf571aafa6afacc2141510c5167b1f2c9f11823e3fa3eec2f85fd7dc6df13f0b9efa
SSDEEP 384:p7yaFM4Oe59Ckb1hgmL5W2hWccaGAMlscmeR9zXUR:tFMq59Bb1jXbbw7N9zkR
TLSH
T1C7D2F9475ADCFF53D68F4BB301F08BCA69381FA264D1B6B4D84BA08834627C47E43A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-process-l1-1-0.dll
Size 22KB
SHA256 90d0c8e9ea6a4e82efcdc7ba522da3989316397218f3d1320eed1bab491c0938
MD5 2b05f6a42d0af9f4894fba4bee0f51df
SHA1 b8066ee2f6faa0b03129ff5c48bf2d482af62694
SHA512 82d92858938df3ccfee4b8fa0ae603a50975030c2cba49148c33291a163ea9baa785f9569d1e921cc6aac7a57bd91213820c561975db4f1dc847d9e5f6b6869b
SSDEEP 192:BeXrqjd7tW2hWmzca8Lxyf7LRroihrSi4CObV46X01k9z3A7EAKJDE/:B4r0W2hWocaGAf7pofiFOFR9zeEAb/
TLSH
T17DA22BCB97B46506E6675F7081F9C7833E3A97C76C50916A9591F00C3CA378AAB2052E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-runtime-l1-1-0.dll
Size 26KB
SHA256 d893a0f2c1bf6247fb94393728c6293570090028d4dd30dcea01a01b0460b0c4
MD5 08c481821ff304b1b17dcfa16dba9b83
SHA1 2fc9606b99653bc695a5eb7b8544b5aaaf0b4593
SHA512 a1eac79a50220b16124eb8a4bcf3fbdef63cc39a271daefd33b570dad41694cfc6a9b71a0ef884cf5f89031bb5b4a80c5c782ede4d8a81222aa3536e0c54fc94
SSDEEP 384:Aysyr7XW2hWucaGAjrrcUthXBnR9z6IpflZ:P3r75lb/QCf9zNfb
TLSH
T1F3C2198756F87F03EA8B2F7316F9D7D72A3663872A509575C493E0883883784BD1721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-stdio-l1-1-0.dll
Size 26KB
SHA256 456adaf7d2116f3e9410a0c1acd19f54bc9decc8e75b02f82c4a7d56c980e71f
MD5 92e4dadae9a9a0a2b96cfa9476772114
SHA1 6a0785c373dc2d691dc542ff19a5b7236fd1e819
SHA512 c5cf819193a220880c0d200fc62a9fc98afc85f5250a47130554e8dac67d81e61dfd7aca8488f6ecfbec37f1da8b6abe34d58368ee8990468bb1e4fe39ac4699
SSDEEP 384:3V2oFVhrW2hW8caGA13OGTYAsR9zCNEK7:3ZD/bpdMj9z6r7
TLSH
T1D2C2D68392E87E01E38B877369FAEBDA5734578328407579C543E58439C639D7D0316E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-string-l1-1-0.dll
Size 26KB
SHA256 8d360f373b21726d005df5d6e1e5d55f5aa83f6d9d6a055f4dc0331965671dba
MD5 b9bfbf196677d56b05fd0e7e069ee277
SHA1 4c7e5ec8414684d9bd0ae443f741e80cc21186ad
SHA512 d454c2bf246e7fc61adabe5d71b13f97cdb9a803cfe6d80212a4358ad8417546da4c1aa08fc34804e6659ac355e5aea6e312a7a13fc1b117427cb03eca52a9fa
SSDEEP 768:YCV5yguNvZ5VQgx3SbwA71IkFmQbq9zV6j:D5yguNvZ5VQgx3SbwA71I1QSzUj
TLSH
T18CC2E78347F83F51CACF5BB355FA8BC32A384B4615406375D463918C38827A6BE6BA0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-time-l1-1-0.dll
Size 22KB
SHA256 c674ee45208477eec3669db64abb586df50d4fa38aa5b47ed2012d4bc5d9ec4e
MD5 c70f5907e0d9400f00705fd92c921406
SHA1 b4440d7e18afc8206d8ad33d1784ce42058c8fe2
SHA512 6341f5bc2ce3312979d810fee390c350922355952027b4f40028ed16a26c000989c1f3b7f5d87d28f2ac42b3cc4cc59b38d42b6bfbc3bdf747b4a492a9a2ac65
SSDEEP 192:8ChwDiW2hWskca8LxydkeR+1PmbdxP3NGmVX01k9z3AsHU:DW2hWskcaGAEuP3U0R9zjHU
TLSH
T12EA2198346E8BA0BFACF0B7252FDDBE73B3817C21AC0B5669152944435D3385BE2256C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\api-ms-win-crt-utility-l1-1-0.dll
Size 22KB
SHA256 7c31b21496d4783456d9093d0742e1727fe77e1ccb27d717c327039859561438
MD5 abbcf187c339d5e444f6cdd06268cbf3
SHA1 9654b885a6e193db38664b7ee3024d144075635d
SHA512 6d2d41282980df21d5b9bd5a4d0732378455b8708fdbf88c1a7340322c7b6c52a5280d09af9af06a4ec13824d627e3efe27a34bcc3a9f528ef042c94e5b9d37c
SSDEEP 384:7/fxW2hWncaGAf7pofccQBMscmeR9zXJH:7/fvqbdePQBM7N9zZH
TLSH
T1CBA24B938BB8A502E6DB6F7093E4DA837C3C5BC31D50966681D5F0482CA7B85FB3162C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\base_library.zip
Size 859KB
SHA256 b3c165d29fa27c572dba0d4dfb03a2499c056392f44ff5b301a94050c120ea3f
MD5 b5f87e101c028687239e763b53d70dee
SHA1 017a54d0ead01fe345ce2b46bcdb118fd85bdb1a
SHA512 b27b5be62ecd059f96abefe0b02f4233c8e373c4156aaae9133a6fc25aeda1941090f106b37eb5119013b13d3673904e623d6b4a11305e1771d4adb5f1a36128
SSDEEP 12288:vm1+JcyAQ36uBBlA4a2Y2MNSgYJuMfpE1OVwx6SCaZdbD:e+J7f/La2JMNSgYJjfpE8VwxLD
TLSH
T1F6153A8069911ED7FD05F278815F8E3C069AB33ADB89D543BA4FC2D8BF472E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\libcrypto-1_1.dll
Size 3.3MB
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
SSDEEP 98304:YP+uemAdn67xfxw6rKsK1CPwDv3uFfJz1CmiX:OZemAYxfxw6HK1CPwDv3uFfJzUmA
TLSH
T1CEF58C5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF18B681780F13BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\libssl-1_1.dll
Size 688KB
SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
MD5 bec0f86f9da765e2a02c9237259a7898
SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4
SSDEEP 12288:WhO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0TGqwfU2lvz2:2is/POtrzbLp5dQ0TGqcU2lvz2
TLSH
T197E44B95ABB51498D5E6C17C8A534A33E3BBF4141330AFCB06A5893E0F177C92B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\pyexpat.pyd
Size 194KB
SHA256 4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c
MD5 1118c1329f82ce9072d908cbd87e197c
SHA1 c59382178fe695c2c5576dca47c96b6de4bbcffd
SHA512 29f1b74e96a95b0b777ef00448da8bd0844e2f1d8248788a284ec868ae098c774a694d234a00bd991b2d22c2372c34f762cdbd9ec523234861e39c0ca752dcaa
SSDEEP 3072:13BAJzkk5dT6F62eqf2A3zVnjIHdAPKReewMP12yGUfT0+SYyWgOmrpjAxvwnVIq:FQg4dT6N5OA3zVnjNed4yGKTKR/
TLSH
T18B147D5B71A5C0EBE8938038D6D78B0BDB71B8A5039097CF1284E77D5F27B523A68319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\python3.DLL
Size 64KB
SHA256 dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9
MD5 fd4a39e7c1f7f07cf635145a2af0dc3a
SHA1 05292ba14acc978bb195818499a294028ab644bd
SHA512 37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643
SSDEEP 768:t68LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqn:t6wewnvtjnsfwxVILL0S7SyuPxHO
TLSH
T1A4536C525B68FCA2DAB6A5FC38D199CD642B12CC972584DCB578C3D30E1A310A627F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\python310.dll
Size 4.3MB
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
SSDEEP 49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbH3:Uw5tVBlicWdvoDkHUMF7Ph/qe
TLSH
T102267C26A36401A4D9B79477C523864BCBF1FC442F24D34A41A4BAD92F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\select.pyd
Size 29KB
SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
MD5 a653f35d05d2f6debc5d34daddd3dfa1
SHA1 1a2ceec28ea44388f412420425665c3781af2435
SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
SSDEEP 768:gUC2hwhVHqOmEVILQG35YiSyvrYPxWEl6:FC2ehVKOmEVILQGp7SyEPxe
TLSH
T1FED2AF47AB506C42D8238572A4D68E16E935B6A14B20C3DF332DC26D1F227C277BB36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI34562\unicodedata.pyd
Size 1.1MB
SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
MD5 81d62ad36cbddb4e57a91018f3c0816e
SHA1 fe4a4fc35df240b50db22b35824e4826059a807b
SHA512 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d
SSDEEP 12288:6mwlRMmuZ63NTQCb5Pfhnzr0ql8L8kcM7IRG5eeme6VZyrIBHdQLhfFE+uQfk:ulRuUZV0m8UMMREtV6Vo4uYQfk
TLSH
T16E355909B9C24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3904_942582200\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\AlternateServices.bin
Size 6KB
SHA256 56dabea408300e815b52787684ae647b282b920fda16eda8c5ab1993813e66cf
MD5 1fbea61494ed3aeb3ee1c801b2becb72
SHA1 2bbfb8ddd67a8bc52fc99c072b37034fad22bfc5
SHA512 bbdca7adc7ebcc6227980643fd4622d565b25a8f11c97142dc8cc2de701baea69a190a07ea5f80fad4b3d57f48dc539e3f976444d094c0a0741684b978c38271
SSDEEP 24:XuhMZ4kFO91RwGjF9BZkFGJ9xdkFGO+lz/kF:akFU3wGjLkFGrXkFGO4/kF
TLSH
T110D18EF71FB69061F4528FF4905A328CCC3317265539D984E744D4E742C5BAAD0AEFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 49315157fbab76c19ec882b90656c918997c10819016b26139725f674d18ed7e
MD5 4b7d61e1b4002bc219ecd0e28aec98dc
SHA1 227f289ddafd93b76d46e8107dd23758ad216173
SHA512 d6c32e54c84fa74122827f6848dffa52301833c09ec40234e4f145f66a8d6b16277c46582e6dd9595022bfa2090c046dfbec3d32372cc86b3ce00a21205a13f5
SSDEEP 192:qSOv5zbobbC9yjH+041d66JoztdzgCl6mc0d:qRbobbC9yjHyd66Joz/zgC1j
TLSH
T195D1EE25E729863FC859423BCCA62F400F75384AD88E3F1535EC640C2D562DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3e0375492ced82998c046c2860c956a87b5f6e6812f9024ff23fa7f439bd246d
MD5 b98bdaa9f6933dbfe702dec91a4358be
SHA1 1573459df578a5bdfb744c6b036ad8db3da54c0f
SHA512 736b31b9a199a74a35ef4bc122bdaad2c741515d7c7ceb945908b58a6bbba7532f4c2e2216975cba691a09c2618baefd84b31b47215014f8003e451800bbc19b
SSDEEP 192:K41d66JoztdzgCl6mc0dvSOv5zbo72ZC9yjHsRb/:vd66Joz/zgC1jJRboiZC9yjH0
TLSH
T173E10E64EA28863FC408427BDCA62F410F39388ADC4E3F1975EC64082D572DD7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c06ffd2c6a88d4f8cfb9370e0e1a0e7f3e3095cf335e6d50e5cda32a3a90682c
MD5 b748d4cf7770fef5083d47ad6dcae9c3
SHA1 4ec2a6728ec77ddcd7e6431a2f68752d7c9378f0
SHA512 d0da7d2a6d2f490a2b3753c949863f51335aed3227a4691d8a7abe4fdd79c46442400154028f64a7ab640e950f5fe7e9a0edc5b4d750e9b750d4d2edb6ddbb8c
SSDEEP 192:Tf1d66JoztdzgCl6mc0d0SOv5zbo7EC9yjHsRb/a:Bd66Joz/zgC1jORbooC9yjH0O
TLSH
T1C7F10F64E628863FC408427BDCA52F414F39385ADC4E3F1975EC60082D572DD7A8E57D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8553ba7f1a1eff8ff572f73f45239415adc5a49e6e9a679719a6e5edd97da043
MD5 dd46f8e3d1df4104c8b1fab4b08cabe7
SHA1 af8e8a8a5cf0bb6e9b910b388a4b77198a86cd44
SHA512 e95564632230b7cc07ce01a66dc6a3a204f00db6428b0f5716789d1b5a6ab5bc53e1fc9614cccfb1cd45428821019102a1aed1d125f14570ccd03ce136a1e3ff
TLSH
T1DA213A5C3EF88D2A68C7F3AC7452028E57A54E0704471C475D12EE8DCE95AD9326A93D
MD5 SHA1 SHA512 TLSH

Submit Download

2e789e0f-650b-46cb-99ad-e8abcbd24880

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\2e789e0f-650b-46cb-99ad-e8abcbd24880
Size 883B
SHA256 c8c6372c97112fc2db533e1f2731c615a4f1ce35a04d1c61afd780656e594d7e
MD5 bb0505cc3ac6dc0e3f92fe462e6e309b
SHA1 2b91b9af45b62944191141c115c11dffd60a9a4a
SHA512 740beec34dc946334affd5ab55003cc62bee0291b049d7f8faecbaf93067f0bc1914e05e7518e2bd3d092fb7b61865d34ec26628f9d63409f3312c31d8aab632
TLSH
T170110441D735B5B2CC78D24BCA543B8687E4A423C0C698143DF01A140D7A51FD76F60B
MD5 SHA1 SHA512 TLSH

Submit Download

586db78f-e951-4ee3-b2b5-e694eb63154b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\586db78f-e951-4ee3-b2b5-e694eb63154b
Size 16KB
SHA256 595608e8187f0619af9fa1b28757a751c3df9d0b487fd7e5609932f1c6c94eae
MD5 25710fadda5448b960af000fa98c29d8
SHA1 841633f7ebc76a66eb66fd5795431ec6cc3ad109
SHA512 8e8106ebf702fa6ef556fae9da1d83a712697f5abf7999068dad7aadbe9827389e0458a120ceb3d32e2914cc177cdf2b752b96fba55eea2d2c836cae44397a10
SSDEEP 192:vDN1QBM4dNsY5IyZhJCr2epD5PbEDiYFt0dL6DefA0CQ9QXl0RCsfNlw3R1KzxFR:vQnNsCZ/c75RJNl+R1KlF+ZkL
TLSH
T10F72FA16682045BA81A1E368D4FC7FC3E2F528CF4C419FCA9BF4BD085DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f85634a-ffa1-42f2-89b0-446dbffb0d8d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\9f85634a-ffa1-42f2-89b0-446dbffb0d8d
Size 235B
SHA256 a2f593606e9d7761e851296cb875524472514a461c025dfad01890ba61c08e19
MD5 2278a663ac36a5708aa727cbd0df0f44
SHA1 b4671d631794aee42056c7d52aa8be049d0ca560
SHA512 1030446ad9875fdda202df96b58c2422af780c1ec54fc56c3167c71bc8b849413e1b74257c7190ec9913f1d1b55c26739b80a59f223d2ad810355b201b16b38c
TLSH
T133D0978024B8632D48080F02B0A039C630448C3320F8B860D9A14AB8BAFAEC84122927
MD5 SHA1 SHA512 TLSH

Submit Download

a0b2a2d1-d9ca-470c-8575-a5bf03b8c40f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\a0b2a2d1-d9ca-470c-8575-a5bf03b8c40f
Size 235B
SHA256 35d8e1d684dd3126f4b2abacc287406c2c66975ca9008261a80de7e63be4b89c
MD5 07792f07d8ed1c8b127d09784e4c0a57
SHA1 f4771f0fee0ace20373db372d2f8c02cc3da0f70
SHA512 0a4a64c84ad4d723b9f6d367d0afa996fcaf169952b78c56341f4bea5fc5c6aa7c4358b87cb112c52fdc2ff449afe47149e7547296d505bf577e1c8ea989878d
TLSH
T157D0978418E873AD48100F02B0A03ACA30848C3728A8EC10CAA1827499BADCD0362807
MD5 SHA1 SHA512 TLSH

Submit Download

bc883b6b-b82f-4264-bdf1-9645ce9fe5c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\bc883b6b-b82f-4264-bdf1-9645ce9fe5c0
Size 2KB
SHA256 f584fb5be07a55bcdcbbd85087e00155ce7682e865210fc0a21af6c00595c1af
MD5 3553d465311cc8bdd244a89bea31d7da
SHA1 16325032c0f796822bc5a14b8d2918228abc530e
SHA512 52612e6ddd4a18d838f60500069b3ac0e6e9f1145586702a5b51a9a296539355d6a88ec2d078746f0db217233b39bdd19a585c22b6d5f4325ffd77d08ef84034
TLSH
T11141332836788D769CDAF15DD582338F93A0990344823C436E52DE4CCD9369E776A93B
MD5 SHA1 SHA512 TLSH

Submit Download

d4708bc9-1934-438f-af0b-57b97b53a4e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\d4708bc9-1934-438f-af0b-57b97b53a4e3
Size 886B
SHA256 2bd01512078e112b6179f440a3548763c46d1588158aaf1a81b6a3a037702c04
MD5 336f717c5504e5ff4cce3f39f7c413f7
SHA1 e2b2abaf69beeed1e4a167aedba7afc23c253a2c
SHA512 ce21ab3503f3f6d484d451f9bdb092b2ae039407d3e62fa9a63a19231b7700446bc9d73699d51d642dc029a077fb40f36109c7144f6a20b9452376bfc370e228
TLSH
T15B114041C738B6B2CC78D24B99E47B4287E4B023C0C61C107DA00A084DBA11EA7ABA0B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 6KB
SHA256 e20d218418964479ed00af893aeb64b09df5dc80286294763144fd7f94b49d6b
MD5 58d2a936efe281335ae530962f339688
SHA1 71f9db39336a50e9ee92db04ff755a128e26878c
SHA512 b830acafc82e47714f070ac13bd1289cb0789f7d5294d3a7bbae651efc866a3d3b593d50586366af1bc4121ac01001a8813f4bf3561f74b4d28bf3be7bf52da4
SSDEEP 96:xHTGUTUEqGqSvfkD11zSvSSlvdv9jrXnNHKm9fBw88u8L4cn5VPB:oHRYfkD1mSSFB35Bw88vT
TLSH
T1FCE12F7855488B7F74B677ACAC688C316AB2413B77BF68C610B64484014CF3482F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 8eedb232640f710d5f634e0cd1b16e5d29d3bd8fbeb30e2b9ad95b7bcab28241
MD5 ddf9572cfb7e92324dc857fa723920f9
SHA1 9a6d644554e04f0257538e7161b7e6b1c7918b44
SHA512 7a3144ec5250583b453c800af33962abb3495a82d82eb8c28aa107bc51363a037ec06dda0e6b78fd0fc734e2921ea0e35ede48d4f86621244f59d329a82fc9cb
SSDEEP 96:xHTGUTUEqGqSvfklN1zSySSlvdv9jrXnNHKm9fBw88u8L4cn5VPB:oHRYfklNLSSFB35Bw88vT
TLSH
T167E121789508CB7F74B677ACAC688C315AB2413B7BBF68D610BA4484010CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 7KB
SHA256 1abef6be08a2e569ac91ebde357788083b914cc1444eeee9320ecb9e01463478
MD5 3981c7f29f3baaa523453ab20e7d6f6e
SHA1 a8d211f6887d159efb2a79c5cd7bd85f81527233
SHA512 c04b37796b573b9cf53612ffa1aa9e78896b5ccd489e2761d53ca9af2ea770afb627eac2c07b5e1b086c8ce1ce470d949fbcb1caedb33aa61b36ae33169cdbca
SSDEEP 96:xHTGZTUEqGqSvfkD1NbzSvSSlvdv9jTInNHKm9fBw88j+8L4cn5VPcGS:o+RYfkD16SStO35Bw887E
TLSH
T19BF11E7C5508CB7F64B277ACAC6849715A72013BBBBF68C614B944C5011CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 8KB
SHA256 6b627fd6d4f876af1522ab42d85026936819a1b0e5aad98b73af55a94df74462
MD5 5c2f24cb25a780571a928be4a764ea58
SHA1 b8b2f4e838ca1b9520ef8267e9a92d88ac530313
SHA512 c9308a0bca3d8cdd9f814e0f8f1d01b100d6d8c645e38aa0def607f154b1afccea8a4c4e7c274a3240e17e1e677e0e6db4ed13f9fb9fcebcef410b887ad3371d
SSDEEP 96:xHTGZTUEqGqSvfVDwD1NbzSvSSlvdv9jTInNHKm9WBw88vQ+8L4cn5VAcGS:o+RYfVDwD16SStO3sBw88Kt
TLSH
T16B020F7C5904CB7F64B237BCAC6989715A72023BBBBF68C614B95485011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 7KB
SHA256 6b96f477c88c6ed6d55470ae076b0ef2ba7f1f5eeec703d3a48d5a81e86e48d5
MD5 c497bf87004f912695005ef675339670
SHA1 9b7fa4094d44589751dc93832136070185d747a5
SHA512 ecf05ec3bd939e9f3030e3b066508a907d800e154a01c1b693793384214a52ebec4db4baa0eb0b5d4b41ea0abf8e9354a3dd4dfbae155ebbb62fcdb80200168f
SSDEEP 96:xHTGUTUEqGqSvfkD1NbzSvSSlvdv9jTInNHKm9fBw88u8L4cn5VPcGS:oHRYfkD16SStO35Bw88vE
TLSH
T1AEE1207855088B7F65B677ACAC688C316AB2413B7BBF68C710B654C4011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 05aa07498e2aba0830cbea5ee656f0e3127edcba5f3e3ac786101eea815d2ac6
MD5 236cd91a4005a5a470a41117eeb67a8f
SHA1 8b76f5a47f8344aa16962a9058661fa60825ec5a
SHA512 30615777ea24843c5395fed022afaf7bd5a5e3d7716526c7bd027ad14fbff8e70ff9f8b1ce7ab0bd40e04eb252e61343b2673dc3a9500b2d898aab09ccdf9467
TLSH
T1CA21D8A325335CFBB640D11DE0D7DBFE8BD875A204C984E1A0BC0D01511D2AE332A748
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 10c32d694c1320f3143ba6b1716e90015247ba32ae4e6c31d2171153510f0d03
MD5 c374c259a67e8901a5e800b2511070ed
SHA1 564610be85920331cfc4ed1b1519eb0fa4252e2d
SHA512 31978188f307ee67fe1286c21a0890f5f4fc5c972fd10581f27dc385fe78ff9284f67fd8c548bb555444b65af3d1405c54f138c2bdc08b14d38e0e5e87f73057
SSDEEP 49152:u8ZvOXPV8WpNYoP4416u1vv0kRHQqB5dI:5dQEu1HFRHQqB5dI
TLSH
T1B0362AF820D1A257F3814033664593EF21EFD00C6037DA085BA956E9A578CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4940-291-0x000001E8ABCD0000-0x000001E8ABDC9000-memory.dmp

Download

memory/4940-288-0x00007FFD589C0000-0x00007FFD58D7B000-memory.dmp

Download

memory/4940-289-0x000001E8A8DA0000-0x000001E8A8DB0000-memory.dmp

Download

memory/4940-482-0x000001E8A9F70000-0x000001E8AA976000-memory.dmp

Download

memory/4940-287-0x00007FFD59D10000-0x00007FFD5A1C9000-memory.dmp

Download

memory/4940-290-0x000001E8A9F70000-0x000001E8AA976000-memory.dmp

Download

memory/4940-483-0x000001E8ABCD0000-0x000001E8ABDC9000-memory.dmp

Download

memory/4940-878-0x000001E8A9F70000-0x000001E8AA976000-memory.dmp

Download

memory/4940-872-0x000001E8A9F70000-0x000001E8AA976000-memory.dmp

Download

memory/4940-286-0x00007FFD5B4A0000-0x00007FFD5B7D3000-memory.dmp

Download