0bfa63644237f1fcfe178f94883c3c784005249f38bbbf946048d2ff5608b236

Analysis

user interaction
yes
max time kernel
665s
max time network
680s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
RAT.exe
Size 82.3MB
Sample260813-h1jweadj21
SHA256 0bfa63644237f1fcfe178f94883c3c784005249f38bbbf946048d2ff5608b236
MD5 a521c682bf2c394b423e491985b6384b
SHA1 56dbd5e9dfcf3af6036c9ecd125d8e45d69eba12
SHA512 dc4fd6a6c46ad0a505f2f0e95a8281344b80203823d2a74e4ef9cf9ee926c674c9d0c7f947bd5da4fe2825e054f24f4b20cb65df566583d0dea6ce27a7565fab
SSDEEP 1572864:ZTIAiPJxw+vWlM9ojCrD4WWJvKSc/JUNn8c0oZ/hvqvc3ufgjcnodIRaYx:ZUJ5elKbDSc/iFjDhvqvc3uFha
TLSH
T15F1833856F50A84BF48CD13756E48E19E67768342AC24ACF16F90B722DA73C8897F731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware discovery execution persistence ransomware spyware

Malware Config

Signatures

Renames multiple (161) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Loads dropped DLL 49 IoCs

pid	Process
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe
2600	RAT.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	discord.com
37	discord.com
90	discord.com
91	discord.com
99	discord.com
101	discord.com
223	discord.com
7	discord.com
98	discord.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File created	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2092	powershell.exe
5000	powershell.exe
4812	powershell.exe
3336	powershell.exe
5720	powershell.exe
5304	powershell.exe
5584	powershell.exe
4304	powershell.exe
4716	powershell.exe
5516	powershell.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5524	cmd.exe
1036	cmd.exe
5532	cmd.exe
5024	cmd.exe
3852	cmd.exe
5644	cmd.exe
5976	cmd.exe
3420	cmd.exe
5896	cmd.exe
6020	cmd.exe
5384	cmd.exe
5436	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5948	chrome.exe
1100	chrome.exe
2636	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310792682084790"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\ = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\NumberOfSubdomains = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\Total = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4304	powershell.exe
4304	powershell.exe
4716	powershell.exe
4716	powershell.exe
5516	powershell.exe
5516	powershell.exe
4812	powershell.exe
4812	powershell.exe
2092	powershell.exe
2092	powershell.exe
3336	powershell.exe
3336	powershell.exe
5720	powershell.exe
5720	powershell.exe
5304	powershell.exe
5304	powershell.exe
5000	powershell.exe
5000	powershell.exe
5584	powershell.exe
5584	powershell.exe
5960	chrome.exe
5960	chrome.exe
5936	chrome.exe
5936	chrome.exe
6092	chrome.exe
6092	chrome.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe
6092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	RAT.exe
Token: SeDebugPrivilege	652	firefox.exe
Token: SeDebugPrivilege	652	firefox.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeDebugPrivilege	5304	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	5960	chrome.exe
Token: SeCreatePagefilePrivilege	5960	chrome.exe
Token: SeShutdownPrivilege	5960	chrome.exe
Token: SeCreatePagefilePrivilege	5960	chrome.exe
Token: SeShutdownPrivilege	5960	chrome.exe
Token: SeCreatePagefilePrivilege	5960	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeManageVolumePrivilege	2192	svchost.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeDebugPrivilege	3412	SearchApp.exe
Token: SeDebugPrivilege	3412	SearchApp.exe
Token: SeDebugPrivilege	3412	SearchApp.exe
Token: SeDebugPrivilege	3412	SearchApp.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe
Token: SeShutdownPrivilege	6092	chrome.exe
Token: SeCreatePagefilePrivilege	6092	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
652	firefox.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
3584	chrmstp.exe
6092	chrome.exe
6092	chrome.exe
3412	SearchApp.exe
6092	chrome.exe
6092	chrome.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5960	chrome.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe
5368	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4856	OpenWith.exe
1696	AcroRd32.exe
1696	AcroRd32.exe
1696	AcroRd32.exe
1696	AcroRd32.exe
1696	AcroRd32.exe
652	firefox.exe
5996	OpenWith.exe
3412	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2600	4092	RAT.exe	89
PID 1696 wrote to memory of 3460	1696	AcroRd32.exe	114
PID 3460 wrote to memory of 4580	3460	RdrCEF.exe	115
PID 3460 wrote to memory of 3248	3460	RdrCEF.exe	116
PID 3460 wrote to memory of 3248	3460	RdrCEF.exe	116
PID 3460 wrote to memory of 3312	3460	RdrCEF.exe	117
PID 3460 wrote to memory of 2028	3460	RdrCEF.exe	118
PID 3460 wrote to memory of 2620	3460	RdrCEF.exe	119
PID 384 wrote to memory of 652	384	firefox.exe	122
PID 384 wrote to memory of 652	384	firefox.exe	122
PID 652 wrote to memory of 1680	652	firefox.exe	123
PID 652 wrote to memory of 1680	652	firefox.exe	123
PID 652 wrote to memory of 1680	652	firefox.exe	123
PID 652 wrote to memory of 2644	652	firefox.exe	124
PID 652 wrote to memory of 2644	652	firefox.exe	124
PID 652 wrote to memory of 2644	652	firefox.exe	124
PID 652 wrote to memory of 2644	652	firefox.exe	124
PID 652 wrote to memory of 3056	652	firefox.exe	126
PID 652 wrote to memory of 3056	652	firefox.exe	126
PID 652 wrote to memory of 3056	652	firefox.exe	126
PID 652 wrote to memory of 3056	652	firefox.exe	126
PID 652 wrote to memory of 1252	652	firefox.exe	127
PID 652 wrote to memory of 1252	652	firefox.exe	127
PID 652 wrote to memory of 1252	652	firefox.exe	127
PID 2940 wrote to memory of 3516	2940	firefox.exe	129
PID 2940 wrote to memory of 3516	2940	firefox.exe	129
PID 652 wrote to memory of 4472	652	firefox.exe	130
PID 652 wrote to memory of 4472	652	firefox.exe	130
PID 652 wrote to memory of 4472	652	firefox.exe	130
PID 652 wrote to memory of 4472	652	firefox.exe	130
PID 652 wrote to memory of 6076	652	firefox.exe	131
PID 652 wrote to memory of 6076	652	firefox.exe	131
PID 652 wrote to memory of 6076	652	firefox.exe	131
PID 652 wrote to memory of 6076	652	firefox.exe	131
PID 652 wrote to memory of 6088	652	firefox.exe	132
PID 652 wrote to memory of 6088	652	firefox.exe	132
PID 652 wrote to memory of 6088	652	firefox.exe	132
PID 652 wrote to memory of 6088	652	firefox.exe	132
PID 652 wrote to memory of 6096	652	firefox.exe	133
PID 652 wrote to memory of 6096	652	firefox.exe	133
PID 652 wrote to memory of 6096	652	firefox.exe	133
PID 652 wrote to memory of 6096	652	firefox.exe	133
PID 652 wrote to memory of 4208	652	firefox.exe	134
PID 652 wrote to memory of 4208	652	firefox.exe	134
PID 652 wrote to memory of 4208	652	firefox.exe	134
PID 652 wrote to memory of 4208	652	firefox.exe	134
PID 2600 wrote to memory of 6020	2600	RAT.exe	136
PID 6020 wrote to memory of 4304	6020	cmd.exe	138
PID 2600 wrote to memory of 5384	2600	RAT.exe	139
PID 5384 wrote to memory of 4716	5384	cmd.exe	141
PID 2600 wrote to memory of 5436	2600	RAT.exe	142
PID 5436 wrote to memory of 5516	5436	cmd.exe	144
PID 2600 wrote to memory of 5024	2600	RAT.exe	145
PID 5024 wrote to memory of 4812	5024	cmd.exe	147
PID 2600 wrote to memory of 3852	2600	RAT.exe	148
PID 3852 wrote to memory of 2092	3852	cmd.exe	150
PID 2600 wrote to memory of 5644	2600	RAT.exe	151
PID 5644 wrote to memory of 3336	5644	cmd.exe	153
PID 2600 wrote to memory of 5976	2600	RAT.exe	154
PID 5976 wrote to memory of 5720	5976	cmd.exe	156
PID 2600 wrote to memory of 3420	2600	RAT.exe	157
PID 3420 wrote to memory of 5304	3420	cmd.exe	159
PID 2600 wrote to memory of 5896	2600	RAT.exe	160
PID 5896 wrote to memory of 5000	5896	cmd.exe	162

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RAT.exe
"C:\Users\Admin\AppData\Local\Temp\RAT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\RAT.exe
  "C:\Users\Admin\AppData\Local\Temp\RAT.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')" "
    3⤵
    - Executes a command shell one-liner
    PID:5524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -Command "Add-Type -AssemblyName PresentationFramework;[System.Windows.MessageBox]::Show('WARNING! This device is filled with viruses. If you would like to get rid of it, pay $234,324,214 in crypto and we will remove it. You have 24 hours to pay before all your devices content is deleted. Don't even try find or delete the virus, or save your files (they are encrypted) otherwise the auto destroy will activate. Have fun :)')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "*"
    3⤵
    - Executes a command shell one-liner
    PID:1036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /s /q *"
    3⤵
    - Executes a command shell one-liner
    PID:5532

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=385981221552860A586EED0EE93ECD78 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=79E501EF603FA686AE0B593A8331F11A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=79E501EF603FA686AE0B593A8331F11A --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3248
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EB3BBC92BADBA37721E379023F6CB04E --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=605F089231557C74C94223565B70ADF3 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2028
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C641075D1DAD1D8FA0B1C2DDEFFF55AC --mojo-platform-channel-handle=1872 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2620

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {afc70c41-fbab-4cf9-9141-c91bb16ba64b} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {a7f590a6-589d-4c50-a0a8-2b18e75a88ec} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3636 -prefsLen 27276 -prefMapHandle 3640 -prefMapSize 270279 -jsInitHandle 3644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3652 -initialChannelId {ee020c2b-9e5f-47ea-a7aa-2f2d495f724e} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3824 -prefsLen 27276 -prefMapHandle 3828 -prefMapSize 270279 -ipcHandle 3896 -initialChannelId {8591af58-66eb-43f7-8969-4e6d2f555c1a} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4448 -prefsLen 34775 -prefMapHandle 4452 -prefMapSize 270279 -jsInitHandle 4456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {22625749-36e7-487f-8214-9edd6f7402dc} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 35012 -prefMapHandle 5008 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {8a31eb57-186a-4797-ba1d-20cad442c250} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 32900 -prefMapHandle 5184 -prefMapSize 270279 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {903c7f40-508b-4769-bfb1-ad3d83db43be} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 32900 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {558c7846-223a-40e4-8bca-2711e3817613} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5016 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {f866aca1-2686-4a73-a6fc-52b39dfe9a55} -parentPid 652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:3516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffacf43c728,0x7ffacf43c734,0x7ffacf43c740
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,7482370813782506767,8050643783466207197,262144 --field-trial-handle=2032,i,3206734758846524587,15448866085263611606,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,14806301520823447187,18045715221729460349,524288 --field-trial-handle=2032,i,3206734758846524587,15448866085263611606,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,8322777894792203724,3369834518461278226,524288 --field-trial-handle=2032,i,3206734758846524587,15448866085263611606,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,4433836663207773936,14624110774517641123,2097152 --field-trial-handle=2032,i,3206734758846524587,15448866085263611606,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3372,i,11934620162146410991,13362590327552360684,2097152 --field-trial-handle=2032,i,3206734758846524587,15448866085263611606,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,18413211063026871640,15094731753956593541,2097152 --field-trial-handle=2032,i,3206734758846524587,15448866085263611606,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,17273513535698558431,15445329872421892102,2097152 --field-trial-handle=2032,i,3206734758846524587,15448866085263611606,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xd4,0xdc,0xe0,0x100,0x104,0x7ffacf43c728,0x7ffacf43c734,0x7ffacf43c740
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,1417670654771394966,10729798009904098190,524288 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,12686361906384957096,5672191034549801375,262144 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,8553730826678277496,10739873906964539396,524288 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,3937661274834007920,9421081037155182324,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,10985390864106544115,4358246900609176430,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3736,i,5153697757990052110,12634066793016392650,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3800,i,17755807530719910307,8734341350803429758,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3228,i,14728941653597847379,17072230649413794536,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,1475975271486808181,11604784481388640761,524288 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,15843877413967798022,14530202001424630790,524288 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5556,i,3332292387201902278,11998650895045935350,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5596,i,12368172234566114440,17345223000281503620,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5760,i,11885272480117907110,15580049099953687768,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6032,i,16987778880171746077,15287850216345425917,2097152 --field-trial-handle=2488,i,12039940628501654698,2476666553665131865,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4356
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff6192a55a0,0x7ff6192a55ac,0x7ff6192a55b8
    3⤵
    - Drops file in Program Files directory
    PID:6112
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
    3⤵
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3584
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6192a55a0,0x7ff6192a55ac,0x7ff6192a55b8
      4⤵
      Drops file in Program Files directory
      PID:1820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5332

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:3528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5812

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3412

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:6008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffacf43c728,0x7ffacf43c734,0x7ffacf43c740
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,15378923465795904453,8715719428700076941,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,10315665655993675348,5261953947723596958,262144 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,5004182534736933060,8788646842140150950,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,11982752246194026092,14387984005170062244,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,17493031492282075714,14246060325034228410,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4376,i,9875195927049640269,11355854605674497788,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,14522051632614973043,5490138717641603329,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,15284276560532586154,15527799881588222305,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5352,i,1993260267639417646,12802567183462440923,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5392,i,9973988873052898084,9420776110655481258,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5700,i,1588120641829781294,15243066716629707362,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,17993821515397278953,12376471229057939373,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5348,i,2931990021393851828,10323058787728160494,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5964,i,14581472916088272275,16693925678205959792,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6020,i,8098686770240228407,12574793464651947537,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,12167334028654094468,1788870982503208311,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4560,i,450787038445091928,684847490519550582,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6480,i,6881363797140209363,6470412978497905613,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5948,i,7769503718975771684,9828870013588691423,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6436,i,16122578385183988773,10400123955843889187,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:2
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6408,i,3005093478830271406,15629802330472733789,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3472,i,16054693087403410633,15522391557125773214,2097152 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,435361211867533004,7156321920242290432,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6496,i,9724010113805756686,11362379201596509680,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,14091091511248225022,4916585071900535471,524288 --field-trial-handle=2068,i,7329910432532807660,1247912783126800220,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5632

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 45a2fd97cdc429a132dff83aae27d6a8654cdfe59c8e68df7f43cdcedf878595
MD5 9210673b99b163ff0df2d5f1a590d82b
SHA1 cf011786f746637da2848814d72a9c6e0a79da3d
SHA512 813fbb4aff01df55dfd03682fd08b612994aafed470c210d302698b8608e36f39120959cecf81800922636379981bc2b49efd856c50782d83c85de4faff9bd7f
MD5 SHA1 SHA512

Submit Download

7c83536a-c37e-4ce8-9196-d9a903efa5d8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7c83536a-c37e-4ce8-9196-d9a903efa5d8.tmp
Size 13KB
SHA256 7e2e104b5fe89d9e748acb2707d2c56177ba656c18feea322534c522a3588b02
MD5 97068f35d06e2300a6f433e98f47082f
SHA1 b4fd196cb5aee55d38d57752178c40caab98b561
SHA512 f7fb9e0893481423ba1b52861ac25d8d39add4e1bf6a3187a4822e9853a343f676af57848e866f8396108ea8cc1cafca077193b13c673c2513c5ee0fd16e98df
SSDEEP 384:Nnj587KxkXqKf/pUZNCgVLH2HfgO8eXOD5k+ErU3uVHGjxfqR0F:Nj587KxkXqKf/pUZNCgVLH2HfgHEOlkS
TLSH
T1CA52F867688C9A3F0FD8D98DDC166F4FADF5025675A8082496FB9C1C03A57DB020A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 12cfbc28b079376960f22a59ed75908a124c7c81fe18f2862439de6ee05f0014
MD5 89dc4ea158d47e9802b60ed839f703e7
SHA1 c296278c0bcc9628a32142df4f48d96e21f68fde
SHA512 65d71da49ec1fd27fd2b6841374579807e81df4b131096ee2456624dcf1a9a3bd271e446744696cd3999db60402c737dcba174af54cdd95c8e373848e4f60c9a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 dc23c85cf6949bafb3403682917075b1f19b16b642dce9b51cb4688e9ad3d020
MD5 a9418092d7fb9ece9c840378c8351868
SHA1 114079154114ed09c78dabc652190f6ebdfd0f1b
SHA512 9d0b093ac3dcf0ee9ca294576f8204b915ecd848f8577d97f843b72e97f80ab418bd545e74a17243ffb8d3e86e4a03c4128f16974a973a9f09b1525a8dad7260
TLSH
T142A0021012C404CADBC003B9A46125452294CA2A113CD393D2E0448698675F99907481
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 3caec85d5a1d26cc760537eeacd0c72d2e0c792f1f9d6c50c61dcb2b099b0662
MD5 1a7eedc42f222d7156e7cd9c61efbfcf
SHA1 b668949dcb902584099ae33b6d874f7b2f307c07
SHA512 c24638a9436c326f6607f7d4656994af08dfff326b87e0cda2b31ac09e84aa7b4884240ed24c025c0027655a7f152e78119db15fb3c1670ad6780dec43190435
TLSH
T1F5F0A04B83210075D7C623BD74511D1226BE7E0FA6F2C2E6444C6D7FE9E52EA0E0BE81
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 69335be78ed791e759fbc1a9abd98c36a098edb287adc1d46b25758f90f91354
MD5 bf6fbe006157efbeeff861874691f8cf
SHA1 a75d691d57e24367cdcaf14def736f2c80e17cd2
SHA512 d4098b581974a32e97b64e486bdcb43c4f5f22c201f42f109dd4bd3f5952e79d8e0cf786c46176ba3ed655c1899201d5a7c63b4ed7c55f6d09dbbb3b8ef34891
TLSH
T1C3418EF7C3E49A7D891092F4AB156F1FCE6D0924131C3D66C8D4AE1B53E2972D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 d61bf098beebe459c043539b5b6087f8dd4c0124669fb8d83ce967a7f700d6e0
MD5 73c17bd5479592624172711a116fb288
SHA1 2f844ca5bde259c185d241da062e31d2332da3b7
SHA512 e3ea6fc6c7ca08b4d0a33154ae5d3ab5bef62709becdba11ad8696925d0bb461390d09fb136f0fd6db783c17013dbf4dcb079a61b0d6b33cef9d1206953b9687
SSDEEP 192:DxV4k3M4MLiDSEnRmmyeR44UCyVjAUD8WcVVrMFZ:DxV4k3M4MLiDSEnRmmy244UCyVjAUD84
TLSH
T158029CF7C7D8C22DC95116F8D7117B1ECE2D1A28422C3D26C8D9AF5BA3E2871E21525E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 a845a9fd9b987e528b5f43e60452777351d3f0d7a347dea439046df91c0d629e
MD5 e5c0c12d8b8882778242d04d3e3c8f88
SHA1 01710af5fe1985a1fde6b1aac53270c0dce3b5c6
SHA512 329fd808de71ca06f804f1ba88becb260bab960ef9627c2ef9bf747df8dee1954a8753401e1c607e722fb5f978e290bf201708115a91366c0f71e632c14aa022
TLSH
T1FDF059A7A66EB07314BA49AB1E00B8095975A43905806DE1CFAB826EF0C14E31B27457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 99fe6cce6fa0eb13ecb78ca6bd14d0801c8e61a239d2b19f5bb602abdf532cdf
MD5 c7101ec7331325b5058a7847b2c3b26c
SHA1 e915c46a556ea6c25d4bc08db7a94abd985baa61
SHA512 f1fa7c42f15b57e904da75f74254e522c57f1845acb783027678c9fd9c344990bfa23cc0ffe2ba6d7812fb8d92f77f93ee9624729ba772b58370d7d2af91261b
SSDEEP 192:uRjDMVv7RAPRp2JQhmXsb+WNoyrB9392mSwiyIsnAUge:uRjDMlIXOXwF72mme
TLSH
T19A32742FA924793B5CDAF22AF961BA53E7F5102230D52E44EAFC893C15DB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5d1dd745b74527d79df2dfc6b7b96c06297a3ad41e891cedffc24536ede181fc
MD5 7e244aa70be2a6aeccf6769dd1e96ec4
SHA1 5b7e3ea2bda163ab5d98eae99a8f4d7572e2d047
SHA512 0be13639c1684f79c7b3a6f48012a328bdfd9aea912f828ac3326205183d5efb7d9078d1056791f9a610804a4fe68e62f70ea6e004d7c36cf546b0e1f0e6ed1e
SSDEEP 192:VRdx7Z+yGoLUlv7MF+pAPRp2S9HHsb+WNn+c01HPyIsnAUge:VRdx7MJVgoUX91wl0de
TLSH
T11032955EAD15697B6CCAE22EFE667B53D3F5102135D02E44EAFC892C11E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6df4b41a2fde6b1a3aada09d5ef2e6b8515da5299e869d1e78007b0370e7602e
MD5 c46905ac5c3c2a89ef5eb8f7867d0cb0
SHA1 7d55b8bf31cb9c9cd7ee82eaa94aedcffdf5ad4c
SHA512 8defe53f952cac82fa6397d1da7b1d1bac718fd670b8f680b8dcc137aa81d01407aa479903bd02e56bf148d92cee3d63a80b52eb928cb650fb17c02d1278c278
SSDEEP 192:WR8DM1v74vAPRp2uXsb+WNnbo264mxNAR8xoW8eSwyIsnAUgR:WR8DMF06X9XwM273R0BR
TLSH
T11442B66EA924B93F1CCBE22AF9653B93D3F5102234D12D84DAFC892C15D79DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 cdd476da1272a8350d90f43eaca85fd9c86bcef920babdf13a46c01dcca600d8
MD5 8727508f0187d99b9de621ff247a0ce2
SHA1 adaaece7988bb5413a17522762dc3352516eef17
SHA512 e8435ba069ac0616f2b9d5eb9ec254a985af2ef188b55efe5b158eeb0b9b2b95934e6413c21797f5dc13acaf2f3dbfd76d55aea5565e3cbadf7060d0ab63ad4d
SSDEEP 192:uR8DMVv7RAPRp2JxdhLXsb+WNnrB9392mSwiyIsnAUge:uR8DMlIXmXwt72mme
TLSH
T14B22852EA924793B5CDBF21AF961BB93E7F5102230952E44EAFC893C15DB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 de38c3d78f111bcd77279c5d8e5e74f803abb4e2fdd9e22dc1850373c7585f04
MD5 c1dd172f5ded2b877471d9f1166d2674
SHA1 2623ee14244787f2ed712c7de23682f34d3e6133
SHA512 285830d746b3a35986c0330613e84e5e9134cbb34b829368cc33f6279c806052c8c8c1856a798dda8f09da582e891b007c17f4993b1223b6ba1d401ae1322183
SSDEEP 192:uRjDM6v7RAPRp2JQhmXsb+WNoyrB9392aEiyIsnAUgE:uRjDMWIXOXwF72+E
TLSH
T14132722EA924797B5CDAF22AF961BB53E7F5102230D12E44EAFC893C11DB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5ffa95.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5ffa95.TMP
Size 3KB
SHA256 5b61cb6a33e9a7c49102f2d960a69fd21f092fe14ee8cc9dda74f4114a4ce34e
MD5 113fddc12451ac2e71fdcdffad26ec96
SHA1 19500b5296a43149945883538027d9c2c06a0415
SHA512 efa86e3a3bf511eaf4dbcad8a18e3271d10a47c68034ee3d7901cd138660914be182132d5f9bdba6d2c3a20b2d246cf41ed718827a4c00a46a23c10bb038b92a
TLSH
T1F861639AC4B48DAB0DB26B75B4390B82F951473F65921446393E05CD8FB397B8040FAA
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ece5d3d8e17942d8453be37b6f76be65776157b79987bda0ab2227044e0ace67
MD5 84a96ad0f34f56dd64229c7da86319f6
SHA1 c62ae03400f30ce1011b19a8208ff9cf0d41993b
SHA512 1773509e61c6749b8cd869405ca27aa31604da1e2dd976cc88ef8d7b5359b23c017280ca598f04c13f8c25cdcca235c4572f2701b6214378eb7a3784cde70ed8
TLSH
T10DB01200C0415110C00309B85112548C62549F11AA0D2B0383E4A922C8364619815150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f17d6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f17d6.TMP
Size 96B
SHA256 5a782ef9b93e885c14dff24f7b0fb452c01fb9b123ae665006a99f45c66335f2
MD5 a24f1ca35b9e3edfad6d1fcc94c4437a
SHA1 b609edeb0c497c51bf4740787d07b775c69389f9
SHA512 9232f6b788707f6c1ddeb1a5cf754ad09dc73380108df289652b11a1f0e995285dc5c9034308c4fe8e91547260948ab540a4d91b08217d949d7b4d3a6caa2f19
TLSH
T1EAB02200C002E222C0020BB0288280C8B220CF38C303220382F02A33CC30B200822A20
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2e066d0a4324c0054eaaae5f43c75b1a151b8b8424a5365f403a9e3be73735fd
MD5 e22fcbb3f076bed4e457166615597ede
SHA1 28f4e85826dbbb549dcc1bc9d36af567cf7de59b
SHA512 5e4fa0631a527ff0aa1f485c7fc6dad4ffba9b3e60b5b864ae208a48ce73e9578dcf1e03da6ffce2219a49808b6e50092390038d9d16633fb52f97f981c9667a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 152e8d0712e4095b2bd2b9cd9f3ab4366f7b20fd7b9618b4d494bc66abe8db86
MD5 bee8a28d60bdda25b2165c39295f629b
SHA1 1e4cb817c5abc8f3fd06104eddb1428b1b3ac42d
SHA512 80e676f6886fd04d225aae5ba44c0d1084986385b155fbad5011b00f6befdeab4e9a78715e2938956f7be790eb7b5f3795fe426d915f28d3400631aa80b653bc
TLSH
T152A0023B51C25C56CFC14270A576854626A1CC171A71D75365E60848A95F2D04903920
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe60fa52.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe60fa52.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
MD5 398cdbfaa7de9f8a3931365e364d27f4
SHA1 ed1a3d000aca1e13108f0c0dc68235e444126d5c
SHA512 998dc6d33b867dedf26dd9e773e37038c697407b5d0600e9fbff01a9d30e50c004b9ca00e5ff4f13a18bfe4cdd7669e23a28b8c547c8cfa2fff1fe323506f092
TLSH
T13F3107848DBA44924EC31A70239760AA3C18F91EE235D48A109ACF527B063099BDFE51
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
MD5 ae3b722b45c677f2b47afa1d9f0fc94f
SHA1 609c3dc27cb90e805157537c673e6b4e7a6c3d96
SHA512 7cd894c041a3c7530698931a93639ed7fd9131aaf1bfeaadc6d29867f5b0a49e101dd0b1572eb113a465d5adfc497f872617cc8c51270d08227f9981db71d19e
TLSH
T1F6516C2378FA9142C8345043D0EFADAD71FF52D3C74A451B31E64020ACAFAE121A139E
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
MD5 ca441c15198089107955d8c8e5635b7d
SHA1 fc8403f74ead7b83017b9ef45c909576cacf2ddf
SHA512 2db07cb52541df66ebe059d1ada731315f87f0c46b553e72370c006ed313d8d754d8fd15ae317258fee0bc0bc13724219a5de9db8400e81193e4b4ffcfc01abe
TLSH
T158817B01730F99818D289BA9733E44F1526A3C04820775368035BAFA85D2DF618EFE03
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
MD5 c633806d580f67b98743782c74dde9fa
SHA1 8acb5f35cd7ee2e7d3174ce06d399d46dd275ccf
SHA512 04cbe1571369525f4aab0b2a9fddbb425e9a935d9307d3b4fd2623899644e15419d0f7e0d33372a46442778043c03448e8130d892b4978aedbbcc0a785eaa9e7
TLSH
T1A9210BF662715F4EC79B05AC1FC14A676310122D665033AC5C2594047E4BCE78DB4D17
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
MD5 310d0edac146f7ce3e4394c066348637
SHA1 b1f1be49560ccb7007700fdf86a5121eb99eaffb
SHA512 1db1aebc30d4912eb9f3474476a2ca3683d078e3e141fbb7964402d01cc5fa5c2e24a1af7b4fad2f19b731d4b26ec9616f5406bf84d66d164a716e9084921156
TLSH
T19C3187F0F47B2D96DF75AD3427028960E6559E962D93DC109D482EE94B0C70981CE163
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5936_1839653886\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir6092_729237353\Icons\128.png
Size 8KB
SHA256 fa0d73901ae74d2d2c01f26442a2d489abc53facb18d532c67846bcb2cc6877a
MD5 0de22373525e2f8219958621a66ba3d0
SHA1 130e89d9409eda3bf4c24c45e8a7d50086134c2d
SHA512 ce3bbc18af6a84da5859f639ed0e8b578e0a4534ca16fac254e757aa06bf19bba00c0d4e922831a682e1d7ec5456af0635cc01c0a0885394dd6faf5565404767
SSDEEP 192:CKwpZjVWBmHOxZMDkfoy89zziiGjQH56E6vXmU1z:CTp3hOZMEj8J5IQDM
TLSH
T16502AEB2D08CAFA12ECD11D7D7111631F809B384481E9B047A3B789D6DC67696BF0963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7cfab91-4c19-448e-8997-ec3f06d48114.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a7cfab91-4c19-448e-8997-ec3f06d48114.tmp
Size 414B
SHA256 e232e13bb72839d237db2e8c52595276535936a5ed88b7d3acd3c89350e97436
MD5 58998410be48d86f0ec1275e98da8367
SHA1 347e016d06ad4ea6b2e7f48ec8c92d8f6d86e6ca
SHA512 e9edbe2bdd96ed6cc941435c0f72f9a4a48df5c06da0e4a4b033d992c47c2f51af148cad78237f92cbe0e9e85c425a1d0f4acd6423a0f89a330e134a0ff6df22
TLSH
T1D7E02BAAC835DC6B09FD1B1811904706E75113162A9155AF7A3D920D8FB46370AD9C6C
MD5 SHA1 SHA512 TLSH

Submit Download

ac848644-899e-4158-a829-6c209de649b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac848644-899e-4158-a829-6c209de649b2.tmp
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 03e154f8ee5f3484235014ed92f50e71b40e5553273d950ce875d61919945a50
MD5 aa938da04928a372f2b6279c833e45f8
SHA1 ea813a3494256ee594e43d093a3cb249c85ce09a
SHA512 763bff29f95335c8ac37dbd3aed7fd44285749092b0cfa77afc3857460ae6c569bf28629138352276b1d7532f9ed05b5a70135d5e6cf8692bc400d016c99b0a0
SSDEEP 3072:X13Z6RGjOVTnfWbB7FALeJcCDl5FRyXIjXMD83RvZ2A0sU:X1fOTnQ7FAql5DyXIj8Y3u/sU
TLSH
T15FC31233D599AD38873656C6F236168D0E00329393A59CD76EC5B815BA0DCC58FC2ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 e93c9d75dc1f7c4e325604208ee807cf703a158ae714ad33efaf4f74a332a68f
MD5 d98964ed0616228872b11969f659526e
SHA1 04c36c85ff9101dd3959b31e0b1daf72f4d6200d
SHA512 092ad797021aad0c43f2b448df0124a072db612d300b18c7e69d900ba3071311bf1381f4a1299f792c8fdbb25274403e13d615c5683dc2757a51f6c6735ccab6
SSDEEP 3072:u13Z6RGjOVTnfWbB7FALeJcCDl5FRyXIjXMD83RvZ2A0sU:u1fOTnQ7FAql5DyXIj8Y3u/sU
TLSH
T13BC31233D599AD38873656C6F236168D0E00329353A59CD76EC5B815BA0DCC58FC2ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 86171df1c0085aa198d28b57b68ed59d7f2a8d8ad58aca92d4f8e13111f08d76
MD5 a49fd574d9f6a7b537542bbe469a7f3a
SHA1 f887725ee9de3d70acc83e50663b68dbbb7d4762
SHA512 f57d0b26dcc9b3ecad3b80a66be034d0c88e5976611c101acd816f7590bab7c7b3ea55cf040f487ebc0d0520f904832dbf93aee159114061e67115c209163a48
SSDEEP 3072:/+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Zm7Rkm1tYpBeh2BAoM
TLSH
T123C312275E75E9375878BB4EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c60aa5c2f1294d34cca98602662f23f7a297b4461d40b74c3d3eb8320a7070d2
MD5 dd63dee981cbec18ed431797db32039e
SHA1 ec3350bb17f1ae04f402204d24938e830f0b999d
SHA512 2d80e8521b72915893147a9f9d56622b6e197559da86a4405832048f0dcacd821a32a30e3f47e59f3685ebb0ef883a0ec42bb132b362c1fded65ea2c0f13d2da
SSDEEP 3072:LqGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:Ltm7Rkm1tYpBeh2BAox
TLSH
T18CC312276D75EC3759B9B71EB04E0B1F1EF14966D820DA92C8D85B0833F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 50be6fa432048dc6fc509be1e2fab323fd560c6322d7c99a1adde34a67465a85
MD5 334ca358b7dec82d32e1be99e9b9befb
SHA1 e54e9776329c2f1fa052406969c65686d52b69e2
SHA512 26129d1c2cd9caa154e501d77d4204fbaba620e1823f46f4c72b2848febe0dab5a2a096914bad3605ecc20675dc22594c1d1551b54406b0e8b49076d74161fce
SSDEEP 3072:D13Z6RGjOVTnfWbB7FALeJcCDl5FRyXIjXMD83RvZ2A0sU:D1fOTnQ7FAql5DyXIj8Y3u/sU
TLSH
T10FC31233D59AAD38873656C6F336168D0E00329353A59CD76EC5B815BA0DCC58FC2ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0a1b2bfaf8e78149be23e7c7198bf32e26d8bef896445143b5b48a0d95d1b8af
MD5 007727d10835686c799aa621ded3aed7
SHA1 59631a85e5b471696069fbe56845ccad66c719a2
SHA512 70a67c35ebbc5a5fef6455c814ba484a267a906db54ef88b5e520d8ba9ae4683236ea7484ec3b7d4c9bfcfcef07bb62f538b650154ee4b9d5d87f535384d15b2
SSDEEP 96:tMC6Dld+lFybfxEEfgDXf2OXeRDotok5R3iDaB61qGyv/+N+3x0j9I6rwV4a:2CElqFDv2zDUD2KgHN+BUtr0
TLSH
T15FA1F732A079AC735976D886B5423E43CFA47127A861AF98DDDD0F2C01FB5E81303527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5ffa76.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State~RFe5ffa76.TMP
Size 1KB
SHA256 aa53a48b6f6d64d296ad5ed14ea50960ee291b7fc273adcb6b13267250a40611
MD5 9a1223cc69ca2975332ed4adaa79c368
SHA1 757c6361c4db3cce17fa8b0bb45b9c9b1235d4e3
SHA512 b533e4921ba059d153223d9df21670db00b4f0f32f3348d34c0e72fb0f960f3f2554c841804dd786e8a11b813c4ae1fe5dfdd6ac8f4bea8080a4be5464bd27b0
TLSH
T1D721DA7394287533AE126DC575D297CB4F20612382719F041DCD081C027F1EC1627C36
MD5 SHA1 SHA512 TLSH

Submit Download

microsoft.windows[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2VRD1ENA\microsoft.windows[1].xml
Size 97B
SHA256 203c00d5bf668fc3b09caa5359b5a210d8ec25ac79d0c98bd409006194ad1d38
MD5 219e167efa4860e0d7f23dbc092e08d4
SHA1 cfe917e6451c7d533012bd0f29e948ba2b36b555
SHA512 693cff01168d2c332c04cc522d325ba5b72d87fd164616a1490dc6c88b4fbce0e862f71f7ab2fc84e7b630f2a499491085cca939cdb65a60dddcff9ee401ba20
TLSH
T18FB012113989AC1C06C455F92E0B50E032ED008A6305B8F834E8BC01B9C5D8BC022CE0
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_ControlPanel

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
Size 36KB
SHA256 1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170
MD5 fb5f8866e1f4c9c1c7f4d377934ff4b2
SHA1 d0a329e387fb7bcba205364938417a67dbb4118a
SHA512 0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c
SSDEEP 384:szMgXGKheIII8SVFBSQ8xFLlSLQU7lbdozJbQt1A+svJC3X:BIII5zb7larNvJ
TLSH
T10FF2418548492962C8CFC631F0D91A370A3E7ED6B850AC616265F6ECE01FB5A3F4F356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6D809377-6AF0-444B-8957-A3773F02200E}_Java_jre-1_8_bin_javacpl_exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Java_jre-1_8_bin_javacpl_exe
Size 36KB
SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
MD5 8aaad0f4eb7d3c65f81c6e6b496ba889
SHA1 231237a501b9433c292991e4ec200b25c1589050
SHA512 1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62
SSDEEP 768:XmmmmmmmmmmmmmmmmmmmmmydiXjPJdKQ7ai3ZigbmY9//JD9UZ99tS0FVGn4YEbR:fig1Z
TLSH
T1B7F2DF61F616A589F74B58B159ACCCA080D63C7D8EF0051CF2EBB71E42B336205A9E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_NEWS_txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_NEWS_txt
Size 36KB
SHA256 719fb4e7016e1c4fff64166a8809a6ffe5d16ba0a40e4e8593ba7f664337e239
MD5 968e7d1aa993ef1052b35a95c51946d5
SHA1 c67817521eb4f70d692d3d29b32676b1871e3d40
SHA512 3382a01b518c38859c1ffc8799aacb941fd7bedd2cecaab4fc8e7fe8e44aeb6acf3997b844b9b5d8ddf4e72331e33972606cab1e9d8b527bf80ef7a9a0136022
SSDEEP 192:bJYeeeer5ee09Veeve5peeeeree3Teeeeeeeeeee7+9AeeeeeeeeD+beAeeeeDGD:lua9ITgKxFI
TLSH
T13FF2651DE722BCE9E51D43BD34B21A533F92D26394BC99AD206A36110D6424218FFDEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d66c2227-6f97-4ec4-bf02-71e4b0738426}\0.1.filtertrie.intermediate.txt
Size 5B
SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d66c2227-6f97-4ec4-bf02-71e4b0738426}\0.2.filtertrie.intermediate.txt
Size 5B
SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
MD5 c204e9faaf8565ad333828beff2d786e
SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
MD5 SHA1 SHA512

Submit Download

AppCache134310792690446704.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134310792690446704.txt
Size 75KB
SHA256 12a9297da84d18c3f69dccb450070a925fd5c5352e06ef8f1c48a88de791dfe2
MD5 5c77f0ac02a300bb7990e5e6ad66f2c1
SHA1 c5f4619db4fc6edab3e0ff9ddeb80bd58a40100f
SHA512 602e3af6eb0f5bc5536eedfee029dbd0c7f6dd9f17c91d7a00237c2be04e560dec91d305645d65805e31d737dbbe1d5620ced7b10f6e8c1ae8dd5af1e4f7b86d
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/i6:vYor1D
TLSH
T1EE73A5A53281CBF3317966E0BCD9E525E13926B1E0A88F4561FA9613FD5ADCC22313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDX_CONTENT_TASKBARHEADLINES.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
Size 338KB
SHA256 e3a3ab917f955f13e0f53c2871d0704d0e827417d1fe0ff5a24feddde494089d
MD5 7c5f4ca706dde991dcd8aa52d4f674c1
SHA1 625a1fea2ade8cc780fd569e839004e1035a7118
SHA512 f06c087eab72ee5b709cf8ec76cc96fa51efc8b1f117fc89b3c6758ef1ec4fb1b48f14287bb1611e0f08c0a518efcdf96c53c06b665ac48203bfb506f43fdffd
SSDEEP 3072:I5IVSSPCjRw9tUi/NolOeMmBAIkXlbu/iG6AgAAIiyhr9:ngS9/AA9XuoAgAAIiyhr9
TLSH
T1C4741A235218E476CB8666CEDC3F3F376156611E99D5C89CE78CCE088DA84BC276A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CortanaUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Size 10KB
SHA256 ab87679b954bd511e4b9e8263042746423149d9a87378daba1b34161ebed3025
MD5 bafabcf32c884859cf12c701f214891b
SHA1 3369651920928be510410cd29156fde4650aa107
SHA512 d95c8e032c5886e4371f5f8139583a390fb25ab80aa9ae34bb56de0f5608e8408e1c8acf866f81f497dfaa2755cb06ffb649d8c874a6eff934811bb4e1ed56cc
SSDEEP 192:TJAvpJmx97iyi7czkYJekoJkpCk5zhmkxZg8Aksz2ZUSRRPQReqxefQOVjeQ8RJd:TJqpJpczkkeZJBAVmbxpefQOVjeQ8RJd
TLSH
T1B53229742AF503A7F3B29A754FF0DA26A435B8729841DF1E01A207890677D1298E5F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CortanaUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Size 11KB
SHA256 f662e1956b575633c5be93e689027d5c503736190a6fdd3c997508b4d2d558a2
MD5 2ee416b6b388d7bb357529a3842ec5b6
SHA1 1034477bc8b5076d27e9f8001c5e4be15eab27f8
SHA512 06919bd633b092ea0ab2f87cbb3a9be02494be9113010dfd9017a0d58b430998598da09f02181b0715e00dc4f4ed95402947047eb5629f0cf6d614e04d2e4b84
SSDEEP 192:vJAvpJmx97iyi7czkYJekoJkpCk5zhmkxZg8Aksz2ZUSRRPQReqxefQOVjeQ8RJp:vJqpJpczkkeZJBAVmbxpefQOVjeQ8RJp
TLSH
T1CF3219742AF503A7F3B29A754FF0DA26A435B8729841DF1E01A207890676D1298E5F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

284c43f6-dfb1-483f-aa44-13e2a058f816.tmp

Path C:\Users\Admin\AppData\Local\Temp\284c43f6-dfb1-483f-aa44-13e2a058f816.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_bz2.pyd
Size 85KB
SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
MD5 98aa4ec9b691267912bcb3336fc7cafc
SHA1 8955d7e923c4bf05d84a03666ec8cdb4fab2f616
SHA512 62084c7077ed896b92055e5a278651d6eeca65622321e389e551e8a331b51c9fe2a5eb1b903eaed41117a7a8efce514b9d62acf2b62985d1535812ab59011387
SSDEEP 1536:w1sxz74jpCk2wWdyOeR3RYZvksL8DdRbEvtwIA3V4y7NsR9KfIkWO:GsxzsIdtYOeRuZcsYZlitwIA3VU
TLSH
T162838D82E3A462B7F59F91B4D7810753F730FF560710A3AFB25482863F12B91AE58366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_ctypes.pyd
Size 139KB
SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
MD5 409e2c98beb0554395f65fc8b55951c7
SHA1 f7e25afa8bd80fa8ed709aed8ced4374c0f1ed93
SHA512 8babb6fe295975868c1aa57c63dcab6f2cd151ba7074848dc7da27de2ea46a886496754b7c7e09b043ec5dc2813d30cbdbaa136f0f26302a1b7246a5da7962a7
SSDEEP 3072:5Dpx2Lp7KR+FrkdOJWWcovIXBzTKRFyxpMIAGPwuTkY:tpxCtKUr8WDvIXBnU8xppkY
TLSH
T1DDD38E4B736840A6DA678138C6739E47EBB1F4521A1087CF4264C99B1F633A2AF3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_lzma.pyd
Size 157KB
SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
MD5 d5e9416137026497171e131dff6e569f
SHA1 16de80a710940e38537d1d2aea22bc33d5948591
SHA512 e7cb2a3c68e7f5129a4712b38b81fc84fc57881bd1d087c755ba16ee6d892be7ec0708a30465d2a28fe9b587226f233e02a2f512f861ad58012b5b80fe7c1927
SSDEEP 3072:QJ66gwnM5uNIJfuPdX+ENYQrHznfx9mNopUpdgwIAI1ho:QURwnNIk1XrBrTpYOQgL
TLSH
T11AF35C86B794F0E6F3628C38D6624F57E6F578190320929A01CC976D2B1FB759A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_zstd.pyd
Size 491KB
SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
MD5 a75e9eb46c217f915fb8db1deed6dbb3
SHA1 b7e1bb9e18856a93b405c8adff3a198695b37d50
SHA512 c160a4681d9e5ecbeaa9416e294883fae9a212e28a8fdee5b86181f7e1cb35b9f1352e2af7894ae1023fb839e75d4fcaa4c5bc61024bd7cf0e261e21edb02cfb
SSDEEP 6144:dZ87M+EgY9pB2l1eUVcnmw3Vh4S+zKhThruVxzeeO07WEz9LKE+UIHHHRToSH2l4:vNcumw3vT8eeOyWEz8xHnRTrWl93R9D
TLSH
T17AB48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 56a3c8ec50eedef1f5024696ef928cb2a0f5d8b40c8a122cba412944dae81c46
MD5 58d47110a15413dd2ac282072cf7ebc2
SHA1 57e62abb007a94c7c25c5a23909c08b6c9336be8
SHA512 5200318833751c7f6c3f86e29744721d882ca833f8e02d18aa18a45d97c8fa9216f0b19c75538444b5eebb8442305c5ecfa150dfb8e59589bccb1ce8ccf7f95c
SSDEEP 192:JmOpW4hWoca8LxydkeR+G4GMsc+6UQ/X01k9z3AhEss//+EG:JmmW4hWocaGAv4rj/R9zlsc2EG
TLSH
T1F4A22A838EB89582FD9AAEB05694E5433C3DABC3188094113594F65D18E37C6EB1873D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 e91b155e01b98aa4466b94da39e04c379f2fd392c154e7b6d80c05e0476f0552
MD5 fcfb48ea4e06f629e0bf4ffb1feb6f96
SHA1 cd4b7756822c65f60fca3f1546a96a5aa928becc
SHA512 83733b4a0f0dcd3651d70b7cca6865e12540a69a75fdbf13cd870f7da650846c1c217ab0b3d1c46c2df40c2a101da975635ef4c38a1ee3279fced98448815911
SSDEEP 192:HW4hWVPca8Lxyf7LRroihrSHGcniRp4Kulc/9X01k9z3AmoiXPCWZa:HW4hWVPcaGAf7pofHBiR6KuO9R9zdoiE
TLSH
T18BA26BC28B7CA003EE9B6E70A195DE933C3C57DB1D40E25A05E5F1581CA37C9EA2872D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 2117e4953f5ec36adff21a416db5ff5f9ff27ea5f70b71b2e7d87897979b34e1
MD5 d867a8864ec8b4ae75b5465af0e080dd
SHA1 64c329f055930ccd1bfebea7be2771e752bea466
SHA512 bfc4ada2e09284055885f4e52fcde19f744efe075518dbcf3c9a0b71a67458c1654a0f7d2e1d979b98f5587c4dbbcdef2d404fede8c79524530a3bcbd9aa573b
SSDEEP 192:uW4hWlca8Lxyf7LRroihrS+BEMUNn9X01k9z3AwYq8M:uW4hWlcaGAf7pofgEMW9R9zBYJM
TLSH
T100A24BC28B78D003F95B6EB092E5EA637C3D67C70850A95259D4F1582CE37C2F72462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 ce83855b81333be8ca07a70700bff553dfb94869637dfe529bc8ef64094032be
MD5 7410f759a304d0bc6bbcc78fa6cc4430
SHA1 7f551a1944b64eadab563fb0508830b878ed19a5
SHA512 9d07f05f62d61a0cffda83851b41aec7711a643a89d1dbdf4e2aaf63983ce57ae0a521b07a25243f13af2c953a6085cc32599596b0c60db7f015542c011679e9
SSDEEP 192:6X/mxD3azW4hWeca8Lxyf7LRroihrSudc2qKIxYPVCX01k9z3A9M53y:6PNzW4hWecaGAf7pofuzER9z6W3y
TLSH
T1E4A25C829B78D003F98B6E7062D5EE537C3CABC34C90A65646D4F1042CA77C9EB2863D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 5fae6d3fa0df3ac9a0171654062b6518b56bc586ab03d8a05e9cd4a112628934
MD5 de531d749cf9cc93c226be08cccd93d7
SHA1 664fe7c7c043dff3fd1bdf96c44226c9490e0e85
SHA512 7839777405a97063f91b0247e3c9468d1155646d6411e1797502ecb223fa6d61ae362d809d496c6931bedd0b09dfd52fae8c86000ef09e4ff5d825987086622f
SSDEEP 192:qW4hW6gca8Lxyf7LRroihrSr7X1ATsX01k9z3AwLBbqk:qW4hW6gcaGAf7pofr7FAoR9zPLBOk
TLSH
T163A24AC647B8A043FE9B6E7052E5EB977C3CA7C70CA0915A45C4F1480CE77C9E614A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 be54476a0d4394d8ca6a5943b6425569403a1a7e939cf9b4948319b450022b45
MD5 9faba82d01302136c5a7209ed237f36a
SHA1 c6cf4c84859d28f6c25732c207fcd95775128274
SHA512 8da4e097a919efa1d874ff864ce1dc0409078a68b18d5f47b8be3a30e44e9ac547c777aa20a3544dad7211c3c48f2cfcda01ea6b8b035a4e985f315705258324
SSDEEP 384:u32h1UrJPvVrzW4hWLcaGA5lU9xDE3R9zjlAXB:crJPvVrnybbULi9zh6B
TLSH
T109C20A83DA74E28BFC8FDE7111A2DD83683953C7042084961BD4A75C3CE73CAE7985A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 87cd5dac0ad2c7f6d64a51c58bc6fb9f2b207fe4966dcf47dd83728b0e439a75
MD5 bc2ee65102d738282eceae1686902b71
SHA1 8d9850a29081db23daf692b73313425f5c3a097e
SHA512 58b9dadb0ec34fe90d9e06cc7402de9b8f742897f6ce46f140724b5e008a5b64e6782cca4afbbc6f7212892054c3c2cbf60d5b7f57e89a8a2b9609ce7b7a07bc
SSDEEP 192:ruO1W4hWIca8Lxyf7LRroihrSUDAWUNn9X01k9z3AwYqD8FYUKU:rZ1W4hWIcaGAf7pofUMWW9R9zBYAseU
TLSH
T1FCA25CC28738D143F99B5E7062E9EA637C3DABC30850D4525AE9F15828E3785FA2473D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 5ae3a6e15f6a47f78b59f8a24334ffc88e8de05664c4c04d6243921ecba16325
MD5 cae5bc2ee758903cc7ba042e4ed8a625
SHA1 7347c4c4595b54abcc8051fc881bda66ccee4b35
SHA512 6850518f9125263e0df9966077893db0af77c530621e2bc816f2f443e9f0a30baaf4d317dd3b2a89ecd8fe16ff6a3a3641ebdee80799061934cd07c1e13272cb
SSDEEP 192:5VW4hWgca8Lxyf7LRroihrSXv4vqKIxYPVCX01k9z3A9Mjsrrl:5VW4hWgcaGAf7pofXaER9z6drh
TLSH
T152A23AC1963C9042F99F6E706299DE537C3CABC71C40E5A609E4F14818977C9FB2872D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 5f8dca9ec0204453ad8e31b8f36226fef8342c36d3a07b15bcece301bc7f24cd
MD5 7bb4ba893acf0bc923570c94be58e49a
SHA1 aee90b130c52b7e043d1fa084aaedd81df2e6f6d
SHA512 5980f4e3fe1ff79be08cd561151074e18ba678161755947fc1498d3665fca96fcce52f42c091fd4f8b4f87c069523ef624f6d5e37412215898333dfa582a9d46
SSDEEP 192:VFxloW4hWRca8LxydkeR+cUKvthuFwleX01k9z3Aji4aTE+V:VFxloW4hWRcaGAdUKvUwleR9zo7iE+V
TLSH
T1A6A228CA9678A042FDAF5E706294EA837D3CABC70D90851605D4F24828A37D5EB3867D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 bdad0c627f722de797917a9ebbb02acc0669c44326f64ba5fc1f8d6c2d978128
MD5 470bd2e028f58a5b1726ea5bd3aad5ee
SHA1 d3c0e7cebdaa17a6c0414a4ed871de37402b1980
SHA512 473b0d2e83b034182076b93d70a642ad33c9a758412235b3dc6c93d89f9c57fec2fb30ff76372bdc6cb318f68d7c248b7f51962534eadfa274fcda3bcca19426
SSDEEP 192:RqNW4hWwjca8LxydkeR+HxPWvVTsX01k9z3AwLi6EZK:RgW4hWwjcaGAOxQVoR9zPLihY
TLSH
T1C6A23B868B7CA043FAAE6E7042A8DA937C3CA7C71C90806116D5F14818DB7C9E71463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 b17a00e4640a1d5a91c1b1ddf0465ba04ffc2ac5404e37d02b56ba7d2fabbced
MD5 774f4105720d5bc8029b4a17acf45356
SHA1 5931171a2b2c2c297b829bd808d899784502f4d0
SHA512 ee5c183dac038a2a2a811b1bd08b131923e7ca95aa33ad26975acb183f35f05d001140b2a33a946d9bdd40f24409af4cd615ef995761e9ca7b47d8dbcda2ad47
SSDEEP 384:6TvuBL3BKW4hWORcaGAK4alUyR9zZybCZCK:TBL3B0dbKPlU+9zZZz
TLSH
T19EA22AC3867CA182F9EEAEB09255D9437C3CB7CB4950D9BA45C8F24818E3395F714A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-localization-l1-2-0.dll
Size 22KB
SHA256 4b5c4d32550d6ec0715c6cf651e9c1bbccb01bffa72e082a0ae04251800d43a1
MD5 6e934057e7a81a0d04103b5cb0c69463
SHA1 335016276921a67914c02dab3efaaa9780d18cbe
SHA512 d9de058683295c2428bec81f89925a56cd02751c1b092701875deb3e886273e591bf902877e117d948c9204e8ec4c2d285eb52f3d8b54593a27621fbf2108a7a
SSDEEP 384:inaOMw3zdp3bwjGzue9/0jCRrndbOW4hW9caGAf7poful9fPOxFR9zOsd4:3OMwBprwjGzue9/0jCRrndbI8bdeAPOe
TLSH
T1E0A24B86C7A8E207F88DDD71705BD5423C3CA7870811A99246E1EB1879F378AE6A472C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-memory-l1-1-0.dll
Size 22KB
SHA256 47817a21044295a18907f13cd9f2705f9a21579f80fa6d3f7bf22e00607189fe
MD5 60419686f4223331b18846c34ee62b33
SHA1 4e5a8b090542020028f8e6d84abff61ac237311b
SHA512 6e1200f63243da42fd364f4fc5b43a962812e98a18db7140c3aa64929c7c0d056c0b0ed459747c67713331053eb017b7297c65198d6abbed46cf21db0fcdab0c
SSDEEP 192:8Ky9e6sUW4hWKca8Lxyf7LRroihrSirnthuFwleX01k9z3Aji4wRcob:hUW4hWKcaGAf7pofirnUwleR9zo7w5b
TLSH
T1EFA24A8A877CA143F9965E3052A5CF537D3E9BC70C91A55611A4E1082CE33C6EF2477D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-namedpipe-l1-1-0.dll
Size 22KB
SHA256 64896c2ca9b8da6c6c327602000f1f6d95e49e6f8df06929176a319cc2aa985e
MD5 5bfb4127164db1d4f3e99da0c7022016
SHA1 9408625c79734a36d2ab0fcde18d655771bb86c8
SHA512 9d2d9e577a669cbb898f451a4a5424b394cec3534a45b8d35e9f9d299f9f8d1001cbc8d651fc4e71fed9e8df5c455d2afa01c1559d7af0da4cc8026a363832e4
SSDEEP 192:sW4hW6xca8LxydkeR+UfMU82SQcNpcspKLX01k9z3AKch7D:sW4hWIcaGApfc2NscmeR9zlqD
TLSH
T13EA238C68778D042F99FAEB052D4DA037C3CA7CA2890882556D4F9142CAB7D9E73463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-processenvironment-l1-1-0.dll
Size 22KB
SHA256 8df2ab621406d2905a330df3955db715965c2c097061345ad94dafab1b04ef00
MD5 18df3d028d109bf76511a50ea6a216c0
SHA1 bd70ad51d45a404bc9e3af80ed0aecfa71b5d244
SHA512 17df663ab717ec5d00c0ae3335d07e6790ef256861ade1bfddd6497fd881899abe913e900ac0ac2921c3c9df3d54788e9fce685fd7fa9c9d477d3c1daf9f72d8
SSDEEP 192:x3AFdhW4hWwWwca8LxydkeR+W7KFOZKU34DcX01k9z3ADYQ/sMt2O:xQFLW4hWwBcaGAHuFZcDR9zMYQ/Zt2O
TLSH
T15AA25DC2D678A002FA9E6D705298F9633C3CA7E71C90C8A951D4E71818E7792E75432F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-processthreads-l1-1-0.dll
Size 22KB
SHA256 a0299f1564ea8aeeff67226b6d2f9b9802aab877c9b89c82d50377ca2a12dba9
MD5 76ceb71d1e978293a0cc4a02ce51423b
SHA1 916b9cce5b6e1e4694bc60a9a9bd1ec6998d0916
SHA512 ce6f3fffdf7db0fa0fa94b8a59c85ae7a99f418f51acae72207be749f94b2308dddb38141d73044d945a77852748a0dde063837cb241f4debb75bfc9b63b7017
SSDEEP 384:Ock1JzNcKSISW4hWjcaGA/GEfFR9zLvag:ocKSVKb9fX9zrR
TLSH
T159A22BD286BCD183F98EAD317255EA633C79C78A0C65856106D4F2983DFB3C6D22853D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-processthreads-l1-1-1.dll
Size 22KB
SHA256 fe33f48a34243481782742168b24f344485527327534f7e05c60ba5420715387
MD5 39340a6cf4e18e99a24e1c00b49f8d5f
SHA1 428b138d26ec4ef24505758aa46652938c60a90f
SHA512 7a51f1ec0d01e60ba9051b2ed3dc2be303b8850febce38017db41be7bd760ae9b37e915c47d37c6a5850d0afd1cfda4c1c47a46ef6400605aac851d9e47ab3fa
SSDEEP 192:YIDfIeKW4hWLca8LxydkeR+/YXxz5j4HsX01k9z3ADr3bWj:YIDfIeKW4hWLcaGAuYXZR9z6ra
TLSH
T15FA23AC28BBC9042FADB9E706295E6537C3DA7CB5961846506E0E24D2CE7789E30023D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-profile-l1-1-0.dll
Size 22KB
SHA256 2f506ccb47a0513d16b3dece9ed1a0459b796fdb96e40d8967dc84e7d4e36954
MD5 63ae31b163bc6a1149d272b8f14ece18
SHA1 cc97547444496c63708a6e0f57a98aeeb907013f
SHA512 5df450e5172656f03ac517c9c419be5d048044e5cbca6aeb28c8419bf776e8583f117e71a9aa0bc773716c0a808de95fd54e4e62e8e80ec0e6b27382ba2f267e
SSDEEP 192:PIW4hWCca8LxydkeR+aH7/djulc/9X01k9z3AmoUQ03:QW4hWCcaGA/7/tuO9R9zdoT03
TLSH
T188A21AC2873C9042F9EB9E70A294EA937C3DA7D71C40956A15D5F0582CE33D5EB24A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 22KB
SHA256 4335d1e4051cc16aee5745b1ae9027e1e710f41972faefc57c065f2166209853
MD5 7c03e762800f06e15de328b1c0d31856
SHA1 9831d40ceb79aa29436e4565ecb43d128a80b5e5
SHA512 2ac8751368d78685682772e5eb8a51ee81ab7e21f01415f5011f5652e8437d1032309ae7aacdac6aba8ff962ae47f6abfd116d4e514a3cbbece6313c6fb61931
SSDEEP 384:z3GeVLW4hW67McaGAf7pofsbToR9zPLBkJ2t9:bGeVfHsbdeET09zlA2t9
TLSH
T1B5A23BCA47689042FA9BAF7043D6CFAB7C7D6BC71C90956614D4E1480CD33C9EB2866E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-string-l1-1-0.dll
Size 22KB
SHA256 4c8b4993badf3d843f57638b5f82e98769d3c7e0bd524d999ec2c720013a2fdf
MD5 efb7eabfe3811c025f604b545b29ae38
SHA1 3b9fa1c813f8b3283e52b11af3badfbb2e671272
SHA512 246deaaa30e630c3ff8903af7c1811306da2edb7c20b2d2d6dbd1b679bb071e2231b7a4c5c72715d8ac66ee3bb074b09545f715587e028c1961db6e4e067f995
SSDEEP 192:jeQyMvrJW4hWw4DNca8LxydkeR+Cyu4AQcNpcspKLX01k9z3AKJZ8:jeQyMvtW4hWw4DNcaGAiL7scmeR9zlJ
TLSH
T19CA23AC257789003F9AB9EB052E5EA437C3CABC7189089A655D8F1581CA73D8E72473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-synch-l1-1-0.dll
Size 22KB
SHA256 a7e2c7177f10d6d35ed2cc79ce71eb979ba69a348f19237121ddac7d61103ebe
MD5 fe467ef86a113fee3fbe27cc2b0bf2e5
SHA1 24c512c7db2a4f0900faa197047dfbcbcb0c9c38
SHA512 4b95877f59feec8918fa0d9806aada3a085e04e60eb8d498159c4a052bd1a961db1732d90d07944969416366be58765bfe2250f69ada62e867b90e1a7a353155
SSDEEP 384:IEwidv3V0dfpkXc0vVaXLW4hWWcaGAoToBNXuifSR9z8U:HHdv3VqpkXc0vVaPhbyo7lfe9z9
TLSH
T1A1A2398293E4F587F58FDEB08299C6637C3857878960C82255C4E65C2DE33D4EB2563E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-synch-l1-2-0.dll
Size 22KB
SHA256 6ff6a5b89c6ccc33a8f99fef4abb83b760c3d6e5be20d4805d95720f67b86876
MD5 950125f971cf676c9cb10d94b0ce300e
SHA1 2042f970a60a9bf610b6c8fcfa260700f8134234
SHA512 d24323c8002ec9bc050e97e294db11eb35afe1115d4cb461827f64a3e0beee9d4c8ffd2a0099a886797e5710ffe243dc94d6a01bfa91b82223099e82b1ee3c6c
SSDEEP 192:4PtZ3JW4hWpca8Lxyf7LRroihrS3dulc/9X01k9z3Amo20:4PtZ3JW4hWpcaGAf7pof3duO9R9zdo20
TLSH
T156A25BC7CB78A103F99BAE7092D6D9933C3C57D30D40692616D5E1592CE33C6EA24E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-sysinfo-l1-1-0.dll
Size 22KB
SHA256 881b7e57388edbf8a167bc7e7714286e9fed54b981479fa540c218aab049a81e
MD5 5a5563eef1a8d57a6bcf259b624aa4b9
SHA1 954a2e50da08702e449ade215ab5143a3c71b2da
SHA512 6dfc63c6bcf417ba1a68e3396837bc90e84ec6153714dc51c803c94abc08edf12ffb69ee3e1b3bb7e459aa03d369d4cb0e4569374dc024626dce4e35a7addb09
SSDEEP 192:igdKIMFcmarW4hWrca8LxydkeR+6W2QrIs+lKX01k9z3A3Mjj9:np7rW4hWrcaGAzWVIdlKR9zWMl
TLSH
T158A229869B78E142E89F9E3062CAD6433C3CE7C75841C52A06D0F3686CE3799E71863D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-timezone-l1-1-0.dll
Size 22KB
SHA256 c886fd30abe580e0bdb29b9e3cb50872159d1c62bcf03355b28850176f1258aa
MD5 d36d620f4a7023d19adddee699117c6c
SHA1 9e1116327cfd433b520fdbd3b425a7280b13cbf7
SHA512 00c6f24120942a76cb2f36fb4bdb8bd0ab85e1dffc7389560478fa323996adaad30910801ad1099471af663fa5ce47b7f423752570efad7050b9f046e82285b1
SSDEEP 384:AlW4hWJcaGAf7pofTaawfuO9R9zdoss6F:G4bdeW1J9ze5E
TLSH
T1EEA22AD3CB289002FDDF6F709299DA537C3867E70C50A15B54D2E51838E7789EB2562C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-core-util-l1-1-0.dll
Size 22KB
SHA256 26a32ca4e6a5f853a371f1fff7c4b7cd90288f4364921fbd4b11cbff697767a2
MD5 c23ea6e9f34f001048dbe57a0346f099
SHA1 70ab0b26f7ec3a1fcedb0bfc6acd74ed45899628
SHA512 2a05b1a0fa6f7d6feea68beb783122bad2b12d60cea23a36e1c68d5f8fd82d4d8d14c5beae9c3d6d3c2d68a0aa49da139422e9a426ffa542673cb9eb65a9ad2a
SSDEEP 192:GW4hW2Wca8Lxyf7LRroihrSKEjdoMAAUYX01k9z3Aw1A0EuHSg:GW4hW2WcaGAf7pofKzMgYR9zR6+
TLSH
T1BBA25BD34768D002FE8A6E7052D5DA033C3CBBC75E60A56269D4F1482CA77D5FA1832E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-conio-l1-1-0.dll
Size 22KB
SHA256 988e14fa33743956ca182c1ef033c09427d60f2b0132803b8548e28ca0378b7c
MD5 c3509e7529cd1489fc02882d6279a7da
SHA1 3934699c2752e0fb8f3c04914d8231cfa9b5ad83
SHA512 91a07a8bad7eae2d19c6c8790280f38ded6934f1a6fdcb757ce2dbdf25abc4aa0b43a57b54da8ef91543d2cb77fec03ac43ffbd86ba98d873d0e4a31c820b1b5
SSDEEP 192:Z0IQcW4hWwlca8LxydkeR+IxGHQcNpcspKLX01k9z3AKfh/:Z0kW4hWwlcaGA3GwscmeR9zld
TLSH
T1AFA2298353BCA903E59B9F30A2F5DF837D38A7C72990A46654C5F12428D73D9AB1063D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-convert-l1-1-0.dll
Size 26KB
SHA256 fa445d728c70db47340907cf12dff8893fd249b738594a1825248211b8ec0dca
MD5 ee9f3f1b34dc65468f0d6f8f2296263a
SHA1 0c6c66e246e0e14bf96bb48a8ecf49e06a0ed320
SHA512 c6784511cd9b03983d220ccb8a90e27c6b971c49d833074f049c638f50c6bac9ae6e008ed6b1749d9019eed2e75f97052705f207c141b87f51bbd31b71a87d0a
SSDEEP 384:YKy5W4hWacaGAf7pofY6BeQKNXuifSR9z8Td4:YXtbdeYU2lfe9zC4
TLSH
T180C2D78766E47F55E69F577220FE8BE729380B4219A053B4C243E54C3483781BDABC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-environment-l1-1-0.dll
Size 22KB
SHA256 e2e562ec0ab4be342962e7e885cba380c3143bcbf83fcaff9269f26b2b448e24
MD5 2d9351b0fb5c10659d6f7eea7cad3e55
SHA1 bf04046e50425e0da3e22b4e11de13756b042125
SHA512 995310a57c5b39583952096d1a62ccaa36833ef0ca9f5f571144642562900e6ac203caa82fcaf5accb187438471df8becbaa99a77453707320cc19ffbdc94909
SSDEEP 192:moW4hWw3ca8LxydkeR+WDIQcNpcspKLX01k9z3AK4R:moW4hWw3caGA3DzscmeR9zl4
TLSH
T170A229C64BBC9507FADBAE7092B5DA937C38A7C76C80C56605D4F1042CD73C9AB1162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-filesystem-l1-1-0.dll
Size 22KB
SHA256 f4a1f0ad4fde3752cf7dc6f3058e4c502546aad9029c8bd78ae1ee4cbe37922a
MD5 7f793c53c57a59334bd0fd3aa5b42bec
SHA1 88e9d277639ed764646d5cbc68cde7c3f1185313
SHA512 003d0f9310df4d4036a3bf70f166b957fe7936c42e37b577baa03ce9a8b36cadb843b60affea38c65fe2cc98740aadddebc2bf101b15660af8b983f9f3eb3a75
SSDEEP 384:vznWm5ChW4hWOecaGA4UpDSriSR9z/rhzk:7nWm5CtEb9Err9zzhzk
TLSH
T119A22A8347A8BD52EE9B1F3252FCDFD73A3C5787088286629056E11839D3381BF1656D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-heap-l1-1-0.dll
Size 22KB
SHA256 998294783016c09345cb2dd0f18163fb9bf469edb4954b1408e99f673c60d9f7
MD5 0fcd8ec0b281fb05025624e58e5bd1a3
SHA1 5b8b6f7221784d2f00144260c81968661c64052c
SHA512 84b8e215a2566fde80ae62e5b1284dd84a112afdbc78537caa665de23bb152cfeee909be591337f319605e8b0191dcc7b410ee5cab556cd11eb31132f0733ed7
SSDEEP 192:0Yh8Y17aFBR8W4hW8ca8LxydkeR+Kzs4lTNceKyX01k9z3AIyYlCDizdT:5L5W4hW8caGALzs4lUyR9zZyGCDWT
TLSH
T17EA22BC34ABC9542F9DB6FB062E4EE873D7DA7C76D9089668586F1941C833C0BB1062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-locale-l1-1-0.dll
Size 22KB
SHA256 2376c1ef50f84a2b0e49e66c0e4c2b24e0c48a4d85450fc74ce77ff02f58fea5
MD5 7f5e42a39806c482068d86a3c5a22ad8
SHA1 fcecc1f2500d719069c2427ec261851cd2ea5e69
SHA512 83d96ab466ee9548ec51643f4507692bf35d777a54efed85defd3f0c0ac4c4a12ac870bd6f55fb8f93a67a27cee7c31feea33eb607a639c2ac207a21f0b29a32
SSDEEP 192:flofW4hWAca8LxydkeR+f0TymhVueTXflYBQXBnX01k9z3A7fwdMGH:fwW4hWAcaGAi0xcUthXBnR9zCHGH
TLSH
T1F2A24AC347B85443EACB5FB096A8EB877C3D27C71D51892601C6E6582C833DCAA2563D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-math-l1-1-0.dll
Size 30KB
SHA256 9e1441afa2e6b3cb88c234fd43755fb2716d7266944239e93a8b3722f44ba792
MD5 86215f5f0051baaf073241e9f8641140
SHA1 9bef2fc33a7d6f6ff8cba8b11db8109c0a6c3d84
SHA512 e4ccee3ace0344ecf427f4592b9f8387e121cb1355d0b1730d0aee60a56256924dd5ec0ed54b2dd0ec009b69a5e580905466ab23439145284a9381902067d24d
SSDEEP 384:A7yaFM4Oe59Ckb1hgmLFW4hWccaGAH+vY/NXuifSR9z8Z8C:+FMq59Bb1jhbbHFdlfe9z88C
TLSH
T116E2F94749DCFF53D18F4BB701F08BCA69381AA294E1F6B4C94BA18834A37C47E47959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-private-l1-1-0.dll
Size 74KB
SHA256 98f7d945c15e261c940219f8261a8e2f85fa83b3740ed08a5afe9e54fe894802
MD5 79bdefd61a7dec9edffc0a1621f360f8
SHA1 eec6b4d167049b792d2df8ae3f842fe894beb07e
SHA512 f5b7da813d599afb1f23033615afdafd3a53621d6787bc08fe7d9f4ac773d807eb27fe76c48257a67f5cfec32f5bb24d9ccbb40503cd3acef037742fa0cb1e24
SSDEEP 1536:pfQTZqDe5c4bFe2JyhcvxXWpD7d3334BkZnjPT3cKzs:eZqDe5c4bFe2JyhcvxXWpD7d3334BkZo
TLSH
T13E73F5DB49E63F21E58FF7B76BFB13C90B253A0418806274EAC7556B34853A9BC53A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-process-l1-1-0.dll
Size 22KB
SHA256 df4a913f1708ccc03b9f41f69cf563a9c57bebaba18262fbc377584a2c2bbb9c
MD5 620ecc31956feb206e6c2bf028605038
SHA1 a6181e00ed417476c7a739a7bcdd50aa24e5a3c2
SHA512 a96cef3ea8d2ab101dbceb65205463b7ceea30d85e51245dac75ea7230f688b2ca1457d2bf1a0a578475c051cbd7b6cefa0c2e94659f4e62cf4c92aecd3cbc20
SSDEEP 192:eeXrqjd7ZW4hWwca8LxydkeR+j1Rz5j4HsX01k9z3AD3TwA:e4rQW4hWwcaGAS15R9z60A
TLSH
T1EAA23B8787B86946E6679F3082F4D7837F3A53C75C408565C992F14D2C93389BB2513D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-runtime-l1-1-0.dll
Size 26KB
SHA256 3e95f9a63c2c742c43138b731966d4cfa6c922bdcff3e2958fe24e4bdf6e5461
MD5 29a887f412385e267e2be233394c79ee
SHA1 37f82f1e6c5d1c280389eade734e2c2a08816118
SHA512 e54bee8b87014f7121cd5e4d228ce53b4d6e6c4b98565999459ce22e640bf0ff007aba3c8ba13976cbe4361baee77f567ef4e28da9b0ca490b8de7d540d29d02
SSDEEP 384:iysyr7DW4hWDcaGAM+TWUwleR9zo7fWxP:R3r7XCbDTnz9zOfWp
TLSH
T14DC2088397F87F13E98B6F7316F9D7C72A356382194095768493F08828D3785BD2721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-stdio-l1-1-0.dll
Size 26KB
SHA256 21a5efa2bdf4a89e06b7dad84aa990412e054bac9befd198c05dd6add93b8430
MD5 6a02064a7b945cb3898273c8d7f4b9e9
SHA1 5410e55523a5868a9dd8e8a61bc08d6508fe43a6
SHA512 4efeacf5a5f473943dab02b0ab09a4aedaa96e8edea3a9a16b77e1fdc50bd8eb9ae21326937885ab07f1a66a88b7eb2cfffcbdc05828ca8f587ebf5cbce87161
SSDEEP 384:BpV2oFVh3W4hWucaGAf7pofxerj/R9zlA/:BpZtRbde0rjZ9z2/
TLSH
T14DC2F88785EC3F41E28B8B7369FAFBEA1735478328407639D543A48836C6389BD1712D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-string-l1-1-0.dll
Size 26KB
SHA256 05a910f254a8eae65c0f032ec7740afacb8439f87a64d53f9b8ebd66304b3b68
MD5 cc0a677eef07e9ce36b14425922b372a
SHA1 277bb2550000c024b2630f01cd7e4434956b3561
SHA512 ca535279491ba8b1300e06c84d09cd7324366b2a9404d6c5e1a2c52b9e787029c78d9cbf40b7719e0d43e1774b5188d1674b4bb977c4d6b745652cbbbc10ecf5
SSDEEP 768:jCV5yguNvZ5VQgx3SbwA71IkFkebLiz9zOo8mt:I5yguNvZ5VQgx3SbwA71IzeviZzO9O
TLSH
T12CC2E74346F83F41DACF4BB359FA9BC72A384F4619405375D463A08C38827A6BE6B91D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-time-l1-1-0.dll
Size 22KB
SHA256 4a90e5b2f3fb45b6a92581a39d3b62948a588a360d449554d8cae1a40b009114
MD5 bb496e868eee1350f83f256cd72aceef
SHA1 327b454b86a8204d01eccf87635fff26f47c73c9
SHA512 5a0ee8932c8b385a1ca61b92842760a0e613a3e16f957c5700ac07c9555b24eab05a820c93e79590917d077f280f1d2bc0c83b83a5cbb80edd70a808d979fbe9
SSDEEP 192:J9wGhwD+W4hWkca8LxydkeR+u71Di7ZMAAUYX01k9z3Aw1AHXPmiR:fW4hWkcaGAD71m7ZMgYR9zR6HX9R
TLSH
T1F2A21A8346E4AA0BFACF1B7112F9D7DB3B3817C21ED0A4668152A4483A87354FE1753E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\api-ms-win-crt-utility-l1-1-0.dll
Size 22KB
SHA256 88ce66919d551efa7a0430f1188b558c41532c363258c1f07a05e2b67d603208
MD5 247ac49d3254ce48890026811cc66023
SHA1 dd911c8d14dc561a787be943bfeb344cfa88d6fe
SHA512 66edbe05bcecab615af7930a245ad5085b5a9a7e520ca08abc06ba164df98d7d8368904e865ffe44391e9ef2e7f42122603a0e9e6411c77eb5f7ad0152020081
SSDEEP 192:h/fHQdurW4hWOVoca8LxydkeR+hSoA6XHBcxX01k9z3AciEwWtQ:h/f9W4hWOKcaGAa9A4SxR9zxftQ
TLSH
T1A1A23AC34BBCA542FAAB5F7096E4EB837C3C6BC25D40866641A1F54428A7791FF2123D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\base_library.zip
Size 1.3MB
SHA256 40480eb221586c6cb35840a4ec94ce2c447a99ef1d092659f1b3fd678479ea94
MD5 8d87238ddd4c73074a43aa52f04fa1ed
SHA1 44aebec30a562fdf8b27113e2319a1bca7e920f4
SHA512 cd91f998f2bec9a7b60776e4b9d70b1dcbedf9bb809faa547f7b52d615f9d8169c794625ceb847b825c635b05348006eb55d4450c2911b8d454dca0a08b066b0
SSDEEP 24576:uQeOdP2m2dfXEuUF69dnSX3llblLO3RpylBM:u/suUF69dG3QRIBM
TLSH
T130552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\libcrypto-3.dll
Size 5.0MB
SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
MD5 7e8a8461fcd43c82841a99a2054711f1
SHA1 a931808c56e3a117795491965cb3f679cdc05886
SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
TLSH
T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\libssl-3.dll
Size 776KB
SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
MD5 299335af4f92df8a446d5f98d6e9cfc4
SHA1 75ddcd4863ffde24d22914946ce4e085722dcdbe
SHA512 2da67c01775d71122e6bb951b7e5e7462e8725f79b513551478cd262dae2d97e108427241d13f4fd6ef1d35b739d34fb9c999ca4a6d50271ceda8e0c3dab313c
SSDEEP 12288:8VJ6zW/kDXMeI0niRBRKZk60STGaFc4rldFe9XbC:JDXMeI0iRBRKZN08GaFFe9XbC
TLSH
T1D3F44CADB37C05DDD8B6C17986934623E3B6F4162330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\pydantic-2.13.1.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\pyexpat.pyd
Size 213KB
SHA256 05530afc9cbfe68c28c052eec159b852e731316007e1f52e0a31412e4eda07f9
MD5 85913240677e6a75f3dbd5b548e824ec
SHA1 21904e9603cbb4eaea1af1d32a9efae984a5344e
SHA512 aa3429a87d6928fdb27dd0a607ad1f2a901ffde7e2b744079e03b82889bfe6305dd260d617143281c636203aca469b8cb62e8ba4ad76f6383496ac06b9ac7558
SSDEEP 6144:+H/PKxsukBnL1G1QA/3t1sYJsaoYC5mx:+KxsukB41QwOwx
TLSH
T1A1247D9BB265C1E6D853C13CE6968B13DAB1B86203909BCF52C4DA7C9F2B3513B29315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\python3.dll
Size 72KB
SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
MD5 33282f049faffb54e4b5604f18bcb4f7
SHA1 3406bdbd09a8968816f303f5c6e8e220a9336807
SHA512 6a8754ed4a24748d60002f2a02c0cc193a4d2185edba7c834572a6815b1aa1bea4733708460dbd2780cc3a6c856ce8aba0d2f55cd1a65c164599267784e0d2a6
SSDEEP 768:PQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKI1:ebTrnXngXMjMIAG0Yy7NsR9/fIbHgv
TLSH
T110734B5E6B54F8A2D6F629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\python314.dll
Size 6.5MB
SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
MD5 e823b990ba85afa143b799c291058dce
SHA1 3e53a71a5c72c3011bee19a792a6552a0d702671
SHA512 fc9b0a6795993e1c4519622726647c33c415a9aa9983daa52d1f9f371c58fb74067599052f5b9c25f5acc08ed15021221dc524543a4de87b5705bba145a1b622
SSDEEP 98304:6PEfNNEwwP1Fyh4NIyDB7Qfo7wavAHDMiEuGC:tfXEwM1Eh4ayDpji1
TLSH
T180669E26737401A5D9BB8035CA074647DBB1BC00AB30D34B59A47ADA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Conakry

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Africa\Conakry
Size 130B
SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
MD5 796a57137d718e4fa3db8ef611f18e61
SHA1 23f0868c618aee82234605f5a0002356042e9349
SHA512 64a8de7d9e2e612a6e9438f2de598b11fecc5252052d92278c96dd6019abe7465e11c995e009dfbc76362080217e9df9091114bdbd1431828842348390cb997b
TLSH
T15FC00289B7080942C45063B90D8723A8DF15C009D53153B338187208CCAA9D42E145C5
MD5 SHA1 SHA512 TLSH

Submit Download

Djibouti

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Africa\Djibouti
Size 191B
SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
MD5 fe54394a3dcf951bad3c293980109dd2
SHA1 4650b524081009959e8487ed97c07a331c13fd2d
SHA512 fe4cf1dd66ae0739f1051be91d729efebde5459967bbe41adbdd3330d84d167a7f8db6d4974225cb75e3b2d207480dfb3862f2b1dda717f33b9c11d33dcac418
TLSH
T105C02B886B10D0B0F08148348EF30606DE51C3B8032200F37C0C281003740602A460E0
MD5 SHA1 SHA512 TLSH

Submit Download

Kigali

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Africa\Kigali
Size 131B
SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
MD5 9c92339423e915befec45cc4752a75ce
SHA1 d336e337b0cafc1205ba041fac447b8ae3074dbe
SHA512 e5a3a1ab74a2620743964583ab960be126448ed013b57393eca6b397ac020de0be5763b6d40443b1976e0d3e6a533e8c46123fcb0428e5e233b076cf9ba69667
TLSH
T1D5C02200F30C882AC00003FA0BAF0300AC0BC200CB0022B328203008CCCA0802E003C0
MD5 SHA1 SHA512 TLSH

Submit Download

Lagos

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Africa\Lagos
Size 180B
SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
MD5 89de77d185e9a76612bd5f9fb043a9c2
SHA1 0c58600cb28c94c8642dedb01ac1c3ce84ee9acf
SHA512 e2fb974fa770639d56edc5f267306be7ee9b00b9b214a06739c0dad0403903d8432e1c7b9d4322a8c9c31bd1faa8083e262f9d851c29562883ca3933e01d018c
TLSH
T14FC012C073B00497CA50773C0FA32AD3DE018914CAAA37EB2954158C09790D07AAB9E8
MD5 SHA1 SHA512 TLSH

Submit Download

Curacao

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\America\Curacao
Size 177B
SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
MD5 92d3b867243120ea811c24c038e5b053
SHA1 ade39dfb24b20a67d3ac8cc7f59d364904934174
SHA512 1eee8298dffa70049439884f269f90c0babcc8e94c5ccb595f12c8cfe3ad12d52b2d82a5853d0ff4a0e4d6069458cc1517b7535278b2fdef145e024e3531daad
TLSH
T15AC01205BB415584E2E177B503F703D7CE1C80048C00DEABF907369508B88503FB0C80
MD5 SHA1 SHA512 TLSH

Submit Download

Toronto

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\America\Toronto
Size 1KB
SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
MD5 3fa8a9428d799763fa7ea205c02deb93
SHA1 222b74b3605024b3d9ed133a3a7419986adcc977
SHA512 107a4dbb64107f781e3ed17b505baea28d4ca6683c2b49d146dda41c28ca3f9c307809ed938e4152011e199a7be6913de6f7b78cafe8ef300dc3034397945238
TLSH
T1143183969418B8DFDF0145B90560C03CCB6431C30B2B91C6C74D67402578F5D89A5DF6
MD5 SHA1 SHA512 TLSH

Submit Download

EST

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\EST
Size 149B
SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
MD5 595e67b4c97fda031a90e5ef80813e7d
SHA1 7194eb1a70c1acc1749c19617601595d910b9744
SHA512 27925a87379552403a0960c2ec191994610bc05b2d67fb1fbbeeb6086a16091bdc69449bce3426b31a2775f3845ed8cc07d1882f8b3b4e63f437775a2eea5d76
TLSH
T1C3C01214B7480A16C55132BA2A410100CC044300A12202B36C4C231804585C26630182
MD5 SHA1 SHA512 TLSH

Submit Download

GMT0

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Etc\GMT0
Size 111B
SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
MD5 e7577ad74319a942781e7153a97d7690
SHA1 91d9c2bf1cbb44214a808e923469d2153b3f9a3f
SHA512 b4bc0ddba238fcab00c99987ea7bd5d5fa15967eceba6a2455ecd1d81679b4c76182b5a9e10c004b55dc98abc68ce0912d4f42547b24a22b0f5f0f90117e2b55
MD5 SHA1 SHA512

Submit Download

London

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Europe\London
Size 1KB
SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
MD5 d111147703d04769072d1b824d0ddc0c
SHA1 0c99c01cad245400194d78f9023bd92ee511fbb1
SHA512 21502d194dfd89ac66f3df6610cb7725936f69faafb6597d4c22cec9d5e40965d05dd7111de9089bc119ec2b701fea664d3cb291b20ae04d59bcbd79e681d07a
TLSH
T17631710B85868B0AD0FC277A3AF3A3056D584588D3AE8161F4ECC3E896FA3095D6D8C0
MD5 SHA1 SHA512 TLSH

Submit Download

Oslo

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Europe\Oslo
Size 705B
SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
MD5 2577d6d2ba90616ca47c8ee8d9fbca20
SHA1 e8f7079796d21c70589f90d7682f730ed236afd4
SHA512 f228ca1ef2756f955566513d7480d779b10b74a8780f2c3f1768730a1a9ae54c5ac44890d0690b59df70c4194a414f276f59bb29389f6fa29719cb06cb946ceb
TLSH
T15E0120325142CA46D19C20F5077468D30F45168D4B9C02FF5739D12B77F03901D420D0
MD5 SHA1 SHA512 TLSH

Submit Download

Skopje

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Europe\Skopje
Size 478B
SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
MD5 a4ac1780d547f4e4c41cab4c6cf1d76d
SHA1 9033138c20102912b7078149abc940ea83268587
SHA512 7fd5c4598f9d61a3888b4831b0c256ac8c07a5ae28123f969549ae3085a77fece562a09805c44eab7973765d850f6c58f9fcf42582bdd7fd0cdba6cd3d432469
TLSH
T175F0267651228F48D11C94BA1718A91B4FA4530ECB8C03B226A9A91E527CBE4EE060E4
MD5 SHA1 SHA512 TLSH

Submit Download

MET

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\MET
Size 1KB
SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
MD5 7a350885dea1ebe1bf630eb4254e9abc
SHA1 5036277ce20a4d75d228cf82a07ed8e56c22e197
SHA512 524ed4fb0c158a1d526dd9071df7111fb78940d468e964bf63ba5418f9b551ec28c38fa1dc2711415aa31f926d8729eac63d6b1e2946b7942ce822f09d00c5ae
TLSH
T18B11001AA1138BFAF86C74B53A605DC24745368C98BF516DD52C53E951B4F5499024F0
MD5 SHA1 SHA512 TLSH

Submit Download

PRC

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\PRC
Size 393B
SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
MD5 dff9cd919f10d25842d1381cdff9f7f7
SHA1 2aa2d896e8dde7bc74cb502cd8bff5a2a19b511f
SHA512 c6f4ef7e4961d9f5ae353a5a54d5263fea784255884f7c18728e05806d7c80247a2af5d9999d805f40b0cc86a580a3e2e81135fdd49d62876a15e1ab50e148b7
TLSH
T1EBE0C20C52681DCAD3ADF3FA265589A68B01E1838F52159B1446AA0DA57FB9618180F0
MD5 SHA1 SHA512 TLSH

Submit Download

Wallis

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Pacific\Wallis
Size 134B
SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
MD5 ba8d62a6ed66f462087e00ad76f7354d
SHA1 584a5063b3f9c2c1159cebea8ea2813e105f3173
SHA512 9c5dba4f7c71d5c753895cbfdb01e18b9195f7aad971948eb8e8817b7aca9b7531ca250cdce0e01a5b97ba42c1c9049fd93a2f1ed886ef9779a54babd969f761
TLSH
T146C00280F71818D3C455577E058F17949D57D6418D0287B7398A34CDFD983916B288D0
MD5 SHA1 SHA512 TLSH

Submit Download

Yap

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\Pacific\Yap
Size 154B
SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
MD5 bcf8aa818432d7ae244087c7306bcb23
SHA1 5a91d56826d9fc9bc84c408c581a12127690ed11
SHA512 d5721c5bf8e1df68fbe2c83bb5cd1edea331f8be7f2a7ef7a6c45f1c656857f2f981adb2c82d8b380c88b1ddea6abb20d692c45403f9562448908637d70fa221
TLSH
T10AC0120162E70C0AC660023505494793DD48D50180062BDB24041199F47D78136000C2
MD5 SHA1 SHA512 TLSH

Submit Download

UCT

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\UCT
Size 111B
SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
MD5 51d8a0e68892ebf0854a1b4250ffb26b
SHA1 b3ea2db080cd92273d70a8795d1f6378ac1d2b74
SHA512 4d0def0cd33012754835b27078d64141503c8762e7fb0f74ac669b8e2768deeba14900feef6174f65b1c3dd2ea0ce9a73bba499275c1c75bcae91cd266262b78
MD5 SHA1 SHA512

Submit Download

Mountain

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\tzdata\zoneinfo\US\Mountain
Size 1KB
SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
MD5 c1b9655d5b1ce7fbc9ac213e921acc88
SHA1 064be7292142a188c73bf9438d382002c373c342
SHA512 2a188d7bcc48acc17b229e50e136b55dbc59058ae9be6ef217238cd1b6c0a59817954ab98817d2e2ff836a6f7d7461be5850ad73a9096d7a14ce9fd8c2a3c29a
TLSH
T1961120C9AAE1B575E15D543047B3D0800CAC48855F0FC98F20BEB52A8EF6B5936741A9
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w2moaapa.xnz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w2moaapa.xnz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dc38cd61-53b5-41cb-b77a-ffd246ffebd5.tmp

Path C:\Users\Admin\AppData\Local\Temp\dc38cd61-53b5-41cb-b77a-ffd246ffebd5.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6092_196199165\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 f767cd56e27f36d430f7b9b4cfc2b4a3d50e7a0f2815bebf86845f1947627694
MD5 d9d2c32e1333ad9b76835109f9c54b08
SHA1 dbbf97561e9308279784e2875ca02176b4b613c2
SHA512 e6cf4e370b53f0d9804b49f0e5d8facaa2cf4e15808dd61193799e54b36a6d087e98ee783c8f30f53c8ecf1313d35b5abf88ca8c5e850cdf9bc0e3a8c0505136
TLSH
T17961D65CF629863FE845423ADCA65B411F343446A8AF3F2A35AC614E1E5B2CD378D03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7d72ad89356b6bd11712ad02b4cf3a2fe851620fcdacd1fb6b0028e388a14f64
MD5 d285791b25dfe86a237575afffc33d04
SHA1 b2c85ff4ff7fc4a913bb1a63572858e76cada6e5
SHA512 a8b6ba84c968c0611a12e985cc892ef6feaa98679b8fd3d3662fb00daef058e5ff5b597e6d7eac5d6f6711500fe5fd01d06765cb457b346675d35c6490c6570e
SSDEEP 192:AOv5zboPeZCWyj1cs1d66JozGzgCl6mc0dz:rboWZCWyjbd66JozGzgC1jd
TLSH
T1CBE11168E629863FC805037BDDA52F514F3A398B984E3F1935DD61182C5B2CE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fa82c965804c6b51a30c314d79c838fc219dd994f9566e9d634d59c4705ab65c
MD5 8751dccb5db125d32caec28c1b3d29d7
SHA1 e6ca2c31758bcc714999260efec32fca3435e8d2
SHA512 21feea17d3a1896d918c60994bb6b23d739622f7846bd7ba0af3c2eda4885f63299197200f9552ad4d734a9128767da9ccae1e91d23bafe00eef1b9ad8e286af
SSDEEP 192:YOv5zboPebCWyj1cs1d66JozGzgCl6mc0dP:jboWbCWyjbd66JozGzgC1j1
TLSH
T1F6E11E64EA28863FC805033BDDA52B514F3A394B984E3F1935DD62182C5B2DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4a7c9ad99012652f24ea5bd95b495778695e9892f8f4385b86ef47c353a4b3f9
MD5 fdbc1d0a65b76d528824b8a710cad6fd
SHA1 e77a0c6d6b7e30dc52f53811cbffbab598f3be9b
SHA512 d52cc0b3cff8888931e8243132385c690185d608a5531932e716a110d83e9a5e9f1566c675f64df0cae3c607487d1686eefcfd8110289612e7bca8384062ad7d
TLSH
T15D213A9C39B88D7A598BF25C7551029E53518B0B08871C438E52EF8DCEC1AE9326E47E
MD5 SHA1 SHA512 TLSH

Submit Download

1ca38263-e3f5-4148-a95e-ddb778370334

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\1ca38263-e3f5-4148-a95e-ddb778370334
Size 235B
SHA256 33622b808a1f670929d647fb1b33fae3196d017b414fe7562990cef9d02f71c4
MD5 b0af00561725f4a3ac910554ef241d0b
SHA1 bc81b1d3e626e58a7ce3fbe450726ee8ef4ccdf6
SHA512 0ccda64ef7d6cf88962e508d32f684783c7fb5d1f0b0edcd655372c3faae72a999a308698036ccf7d9e7f46c8e8aab28c69b30912f84ed15293e86ae1fafeb8f
TLSH
T185D0978494C8332D1C000F1BF8F078C630844C3314649820A56245B48DBDECC02A291A
MD5 SHA1 SHA512 TLSH

Submit Download

1f429405-fbc1-488b-bc47-cee7cc51700b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\1f429405-fbc1-488b-bc47-cee7cc51700b
Size 15KB
SHA256 1d11d5bd8dfa0082134423b8a6e5d6a6d7441c80ac4c5acbfe9e9d6d5f13a243
MD5 a268dfe25551dda72426bd8578ee2413
SHA1 a832018e229ba6e01342c70689a1e7c7595648ae
SHA512 e03816936530b68b883d6c68c8fe60e6f0aada942efcb24fda8d73486018fd9b8f8ab7f3c696b1d2c59bf15f107009a642a651141313051b901e133f456102ac
SSDEEP 192:svkfHj1zBTMcVnlBCI0uzgHDrp2w9RAAp6/hkLzxeZicR9bCRpylXsoleD:UkfRA3kwA2+hKleZicR9bCRpoPlu
TLSH
T1DF72DA5A5820557A8251E36898FCBFC3E5F638CF4C019FCA9BE47E086DDE06D512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f8ff535-80ab-4d22-a9b7-772342ab9322

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\2f8ff535-80ab-4d22-a9b7-772342ab9322
Size 2KB
SHA256 bd4ce72b29bcd2c6e7b91e8f2d402adaeb79c71c14c7dc6f9ea44b7a319b652f
MD5 abb8779d82413bfde7d69186ebc5d2f7
SHA1 6c1f11b9c3cd0005775e34eb80656cfa7bb86909
SHA512 fe2f5bf0206b2bf83be34fc759da24eeaf7b3ddd17e4879f8c9b76cc600989dc13afbb44d9103e9bdfb5717c411a0901277cd3eec169e1275bb3dec84ba73c87
TLSH
T18341001C75788CB78DDBE19CD881338E57A14A1210C668832EA2DF0C8CDA799236B46B
MD5 SHA1 SHA512 TLSH

Submit Download

4a746c8f-8c7a-41ae-b0e9-3ff0d7939a70

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\4a746c8f-8c7a-41ae-b0e9-3ff0d7939a70
Size 883B
SHA256 199dbb90a27d67f3a296924b36e0bd58b5e27394afff17ba09a35b5171c3fec2
MD5 0ab3cb9d47f4f03c369992917b40c8d7
SHA1 c223e38258133ce42c368cc6de6e1bf677aebdd4
SHA512 163fbba9cd4f25b3f18013f6e0e99ba51737226e8f927838b2ee1ad8c9160ccd9bd7c791399be73df249e5709a1a65b39775cf7fa62cf1a1ca39212f48443d88
TLSH
T1FE110042D534B9B2CC69924B899277128FF8652390CA55183DE14B244C7E71EA36670B
MD5 SHA1 SHA512 TLSH

Submit Download

95c63887-c1e3-418d-9c21-b2427a989813

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\95c63887-c1e3-418d-9c21-b2427a989813
Size 886B
SHA256 25e621512ddfb1bbbc09971f0a5e7013cbdbb9749d752250311809afba669702
MD5 70c3ce8961782b4c25c74c331db160af
SHA1 3dcb2c78d1ecf8c35af11dd95720cdb1aa4602c8
SHA512 a59f5e1422083083bb450deca465e21b212b5daf7b4b56b76b3c9be6f6705e1bb66cf3ddd9474027b0acc65a82f79bf35206aba8d051534bf704eb4e8184b642
TLSH
T1031163488A30B9B2CD6AE247AAE07742CFF47113D0CA58087DD00B180CEE65EA36770B
MD5 SHA1 SHA512 TLSH

Submit Download

e8480cb0-369a-4235-8b0d-d386756e099d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\e8480cb0-369a-4235-8b0d-d386756e099d
Size 235B
SHA256 475ff6078492bdcabf6e649dceb3ed57d6da565281d3a12b522b7643d82db01b
MD5 46f743d992482b778ef5d120e67b9816
SHA1 47b38686c5a733949d388113a2d975ef86c97bfc
SHA512 b3b8d9e6b42b12714ea4c40f36056ef30ef7a37d0ad08c171c236c07a65f72e4995278b39e8120472732f1b3aad99c804253dd17db6eec8cb85fd0a3885a3ae0
TLSH
T1A4D097802898771C08041F06B0F16CC230948C3720749810CA5285B8A9FAEC80222946
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 09528e79ad4992e40d6e44025bae5cf0227290399c4b62da105da880c2292c16
MD5 2ddcdd551bec8faa1bdcd4d85437b890
SHA1 12340fc855c1f2ee75e7317d73b2e37537032003
SHA512 070bae11d4a4a78050b74f91abf034253c586c6c942a7d54b47a154a7c2e62117dfdfca77ed5dfd8415e587756950fb7c0c64aaf5b02c0ab41ace5b94053ca43
SSDEEP 96:xHgUTUPDqGqnfL4cObzSHfSSladv9jJn3H8RNBw88n8L4cnF4C:yfORnfL4c5fSSi8HBw88u
TLSH
T10DE10F789508CB7F64B6776CAC6888715AB2423BBBBF68C750B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 d2eb91d6abadc20d0a73d99ce1e6ebc16e700a3a648f8f5803395b0dc142c713
MD5 e717fb500306a3e86b5174f655727899
SHA1 b7e6c1cd8d2dd64f85917ff959020ec6c0fb488f
SHA512 f8ea529254042bdb9f48a0c70cada6cf397fc954dc9a9034d03d9979dc128cbece97c0e1939e4e92d54a8213d93023ab6520c3ff1de06b0cf12ea19175a10092
SSDEEP 96:xHgUTUPDqGqnfL4c1zSHfSSladv9jJn3H8RNBw88n8L4cnFpC:yfORnfL4cqfSSi8HBw885
TLSH
T1C7E11F789508CB7F64B6776CAC6888715AB2423B77BF68C750B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 fec74cad300ad67251c62d36049654b6e32e5348bf940ce6cee2e33196c92717
MD5 1f7de5c01337d4ce66686cb8467611e6
SHA1 a07da1ba41a3e8859aa6733d6b7a9f1c3bf4911e
SHA512 eee8db385c58bcfa012c99690323dc6debf6aad714faec60948d2235594817e7a933e411edb321e63eabcbce93ec58117f5be2687f8c70a08c58f096efd793c7
SSDEEP 96:xHgUTUPDqGqnfLLy1zSRESSladv9jCn3H8RNBw88n8L4cnFpC:yfORnfLLyUESS98HBw885
TLSH
T100E12F789508CBBF64B6776CAC6888716AB2013B77BF68C750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2192-3001-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3101-0x00000244B9240000-0x00000244B9241000-memory.dmp

Download

memory/2192-2889-0x00000244A8D90000-0x00000244A8DA0000-memory.dmp

Download

memory/2192-2905-0x00000244A8E90000-0x00000244A8EA0000-memory.dmp

Download

memory/2192-2958-0x00000244B9200000-0x00000244B9201000-memory.dmp

Download

memory/2192-3119-0x00000244B92A0000-0x00000244B92A1000-memory.dmp

Download

memory/2192-3120-0x00000244B92A0000-0x00000244B92A1000-memory.dmp

Download

memory/2192-2963-0x00000244B9210000-0x00000244B9211000-memory.dmp

Download

memory/2192-2964-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-2971-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-2994-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3000-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-2998-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3003-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3004-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-2999-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3006-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3007-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3008-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3012-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3026-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3080-0x00000244B9240000-0x00000244B9241000-memory.dmp

Download

memory/2192-3102-0x00000244B9350000-0x00000244B9351000-memory.dmp

Download

memory/2192-2953-0x00000244B90C0000-0x00000244B90C1000-memory.dmp

Download

memory/2192-3025-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3009-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3005-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-3002-0x00000244B9230000-0x00000244B9231000-memory.dmp

Download

memory/2192-2962-0x00000244B9210000-0x00000244B9211000-memory.dmp

Download

memory/2192-2960-0x00000244B9200000-0x00000244B9201000-memory.dmp

Download

memory/2192-2961-0x00000244B9210000-0x00000244B9211000-memory.dmp

Download

memory/2600-4394-0x00007FF628B70000-0x00007FF628BCC000-memory.dmp

Download

memory/3412-3173-0x000001EF21E00000-0x000001EF21F00000-memory.dmp

Download

memory/3412-3178-0x000001EF22F70000-0x000001EF22F90000-memory.dmp

Download

memory/3412-3213-0x000001EF232C0000-0x000001EF232E0000-memory.dmp

Download

memory/3412-3195-0x000001EF22F30000-0x000001EF22F50000-memory.dmp

Download

memory/4304-2371-0x0000022F434A0000-0x0000022F434C2000-memory.dmp

Download

memory/5368-4286-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4296-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4295-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4294-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4292-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4291-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4297-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4293-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4287-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

memory/5368-4285-0x00000138AA850000-0x00000138AA851000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads