6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89

Resubmissions

25/08/2026, 14:20

260825-rnpesshe556

25/08/2026, 14:05

260825-rd8qpaaq315

Analysis

user interaction
yes
max time kernel
95s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
suspect_39C5C774.exe
Size 992KB
Sample260825-rd8qpaaq31
SHA256 6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89
MD5 3e87d95ba32e19c565247bad5d810ca3
SHA1 39c5c7743559a7d1d82e491cfc23d63f95f2fad6
SHA512 6a60c509de7a7753d9edc58cec9e9a43259de6091b127085bc95865b561646ccfebcc6898b5d93ce22671c3dc7a4b938b55ae66b56dfddc1a1c52ff2ecea8538
SSDEEP 12288:23hYgc2p2CM0bPdbo3KglweiAgGAhfub29Op/tV:23rMkcrlweiAgGkuso
TLSH
T1A2258E6DA6AC01E5C57AD07CCA438A1AF6F13C5503259BCB01E0866E7F27BF81A3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1552	chrome.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5908	ipconfig.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
7404	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4532	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe
Token: 33	4532	mmc.exe
Token: SeIncBasePriorityPrivilege	4532	mmc.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4264	firefox.exe
4264	firefox.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4264	firefox.exe
4264	firefox.exe
4088	chrome.exe
4264	firefox.exe
4088	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4572	suspect_39C5C774.exe
4532	mmc.exe
4532	mmc.exe
2780	suspect_39C5C774.exe
4264	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 6092	4572	suspect_39C5C774.exe	89
PID 6092 wrote to memory of 2780	6092	cmd.exe	92
PID 2780 wrote to memory of 5356	2780	suspect_39C5C774.exe	93
PID 5356 wrote to memory of 4364	5356	cmd.exe	94
PID 4364 wrote to memory of 5908	4364	cmd.exe	95
PID 2644 wrote to memory of 4264	2644	firefox.exe	105
PID 2644 wrote to memory of 4264	2644	firefox.exe	105
PID 4264 wrote to memory of 2368	4264	firefox.exe	106
PID 4264 wrote to memory of 2368	4264	firefox.exe	106
PID 4264 wrote to memory of 2368	4264	firefox.exe	106
PID 4264 wrote to memory of 5260	4264	firefox.exe	107
PID 4264 wrote to memory of 5260	4264	firefox.exe	107
PID 4264 wrote to memory of 5260	4264	firefox.exe	107
PID 4264 wrote to memory of 5260	4264	firefox.exe	107
PID 4088 wrote to memory of 3380	4088	chrome.exe	109
PID 4088 wrote to memory of 1552	4088	chrome.exe	110
PID 4088 wrote to memory of 856	4088	chrome.exe	111
PID 4088 wrote to memory of 856	4088	chrome.exe	111
PID 4088 wrote to memory of 3028	4088	chrome.exe	112
PID 4088 wrote to memory of 3028	4088	chrome.exe	112
PID 4088 wrote to memory of 1628	4088	chrome.exe	114
PID 4088 wrote to memory of 1628	4088	chrome.exe	114
PID 4088 wrote to memory of 3080	4088	chrome.exe	115
PID 4088 wrote to memory of 3080	4088	chrome.exe	115
PID 4264 wrote to memory of 4380	4264	firefox.exe	116
PID 4264 wrote to memory of 4380	4264	firefox.exe	116
PID 4264 wrote to memory of 4380	4264	firefox.exe	116
PID 4264 wrote to memory of 4380	4264	firefox.exe	116
PID 4264 wrote to memory of 4808	4264	firefox.exe	117
PID 4264 wrote to memory of 4808	4264	firefox.exe	117
PID 4264 wrote to memory of 4808	4264	firefox.exe	117
PID 4088 wrote to memory of 5688	4088	chrome.exe	118
PID 4088 wrote to memory of 5688	4088	chrome.exe	118
PID 4088 wrote to memory of 3548	4088	chrome.exe	119
PID 4088 wrote to memory of 3548	4088	chrome.exe	119
PID 4264 wrote to memory of 2928	4264	firefox.exe	120
PID 4264 wrote to memory of 2928	4264	firefox.exe	120
PID 4264 wrote to memory of 2928	4264	firefox.exe	120
PID 4264 wrote to memory of 2928	4264	firefox.exe	120
PID 4264 wrote to memory of 6892	4264	firefox.exe	121
PID 4264 wrote to memory of 6892	4264	firefox.exe	121
PID 4264 wrote to memory of 6892	4264	firefox.exe	121
PID 4264 wrote to memory of 6892	4264	firefox.exe	121
PID 4264 wrote to memory of 6908	4264	firefox.exe	122
PID 4264 wrote to memory of 6908	4264	firefox.exe	122
PID 4264 wrote to memory of 6908	4264	firefox.exe	122
PID 4264 wrote to memory of 6908	4264	firefox.exe	122
PID 4264 wrote to memory of 6932	4264	firefox.exe	123
PID 4264 wrote to memory of 6932	4264	firefox.exe	123
PID 4264 wrote to memory of 6932	4264	firefox.exe	123
PID 4264 wrote to memory of 6932	4264	firefox.exe	123
PID 4264 wrote to memory of 6956	4264	firefox.exe	124
PID 4264 wrote to memory of 6956	4264	firefox.exe	124
PID 4264 wrote to memory of 6956	4264	firefox.exe	124
PID 4264 wrote to memory of 6956	4264	firefox.exe	124
PID 4264 wrote to memory of 1436	4264	firefox.exe	125
PID 4264 wrote to memory of 1436	4264	firefox.exe	125
PID 4264 wrote to memory of 1436	4264	firefox.exe	125
PID 4264 wrote to memory of 1436	4264	firefox.exe	125
PID 4264 wrote to memory of 2960	4264	firefox.exe	126
PID 4264 wrote to memory of 2960	4264	firefox.exe	126
PID 4264 wrote to memory of 2960	4264	firefox.exe	126
PID 4264 wrote to memory of 2960	4264	firefox.exe	126
PID 4264 wrote to memory of 6152	4264	firefox.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\suspect_39C5C774.exe
"C:\Users\Admin\AppData\Local\Temp\suspect_39C5C774.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Users\Admin\AppData\Local\Temp\suspect_39C5C774.exe
    suspect_39C5C774.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4364
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig
        6⤵
        Gathers network information
        
        PID:5908

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3180

C:\Windows\system32\CredentialEnrollmentManager.exe
C:\Windows\system32\CredentialEnrollmentManager.exe
1⤵
PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 26983 -prefMapHandle 1940 -prefMapSize 270110 -ipcHandle 2012 -initialChannelId {b81b8d39-85d3-44d6-b449-899016dbb045} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2392 -prefsLen 27019 -prefMapHandle 2396 -prefMapSize 270110 -ipcHandle 2404 -initialChannelId {f3566078-26e8-42d9-b561-4a1dec3aad7d} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3920 -prefsLen 27209 -prefMapHandle 3924 -prefMapSize 270110 -jsInitHandle 3928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {2f5353d4-a33a-4f54-afb4-edf7625bf5f4} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4140 -prefsLen 27209 -prefMapHandle 4144 -prefMapSize 270110 -ipcHandle 4160 -initialChannelId {3f4fa42a-b005-464b-9587-b040bf86cf88} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4544 -prefsLen 34829 -prefMapHandle 4548 -prefMapSize 270110 -jsInitHandle 4552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2636 -initialChannelId {81c28704-a2fe-456c-877e-c0ca88aea991} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4980 -prefsLen 34971 -prefMapHandle 5044 -prefMapSize 270110 -ipcHandle 5128 -initialChannelId {12bc0b4d-dfcc-4dee-a893-5f217e1bd7f3} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32876 -prefMapHandle 5272 -prefMapSize 270110 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {919a9e38-2a06-41f0-b54d-8e34cc90e81a} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5308 -prefsLen 32876 -prefMapHandle 5312 -prefMapSize 270110 -jsInitHandle 5316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {17e596a4-0736-4d23-862a-b1b547a60b1e} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5776 -prefsLen 32928 -prefMapHandle 5780 -prefMapSize 270110 -jsInitHandle 5784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {fe5c12c1-3005-49d7-bb7c-123e10964079} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4664 -prefsLen 32928 -prefMapHandle 4668 -prefMapSize 270110 -jsInitHandle 6056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4920 -initialChannelId {912c3611-8625-40c2-8477-e6a0ff80c1c4} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6056 -prefsLen 32928 -prefMapHandle 4668 -prefMapSize 270110 -jsInitHandle 4664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4580 -initialChannelId {9e6463db-e8ce-42c5-84a1-3871e61921c6} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32928 -prefMapHandle 5568 -prefMapSize 270110 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {10027e7d-a9aa-47ef-a9dd-64d8b953a112} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    PID:6152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32928 -prefMapHandle 5380 -prefMapSize 270110 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {ee5486d7-d8f1-4c4b-a2eb-9119abdf9386} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    PID:6236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5744 -prefsLen 32928 -prefMapHandle 5676 -prefMapSize 270110 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2344 -initialChannelId {78ca7229-6d11-49bc-8316-4a92585add48} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    PID:6300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32928 -prefMapHandle 5772 -prefMapSize 270110 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4568 -initialChannelId {1550c8a2-181f-457e-be4e-7ca79605a6f9} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    PID:6308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6244 -prefsLen 32928 -prefMapHandle 6248 -prefMapSize 270110 -jsInitHandle 6252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6260 -initialChannelId {c27e49e8-f262-4d46-b70c-e7924656ab3b} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    PID:6324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6364 -prefsLen 32928 -prefMapHandle 6368 -prefMapSize 270110 -jsInitHandle 6372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5960 -initialChannelId {956e4556-72ad-4ca9-89bd-4fc6692bf134} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    PID:6340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6580 -prefsLen 32928 -prefMapHandle 6584 -prefMapSize 270110 -jsInitHandle 6588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6368 -initialChannelId {e7a38654-dc98-4c81-80e7-afed4d566a0c} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    PID:6352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6704 -prefsLen 32928 -prefMapHandle 6708 -prefMapSize 270110 -jsInitHandle 6712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6716 -initialChannelId {4cedc4d6-65fd-4364-8aa0-2ffac10db79b} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    PID:6404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6888 -prefsLen 32928 -prefMapHandle 6892 -prefMapSize 270110 -jsInitHandle 6896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6904 -initialChannelId {8b1fe50b-2e9f-41da-b9c3-7ed2cccd48af} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    PID:6412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7076 -prefsLen 32928 -prefMapHandle 7080 -prefMapSize 270110 -jsInitHandle 7084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7092 -initialChannelId {de016bf8-eb82-4bab-810b-bf44a4b2b0b4} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    PID:6416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7268 -prefsLen 32928 -prefMapHandle 7272 -prefMapSize 270110 -jsInitHandle 7276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7284 -initialChannelId {1934da9a-1a62-41a5-b00f-02b59f1f7e3d} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    PID:6432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7456 -prefsLen 32928 -prefMapHandle 7460 -prefMapSize 270110 -jsInitHandle 7464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7472 -initialChannelId {86524ad0-ebd7-43d0-8c10-a51eefc61e81} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    PID:6436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7644 -prefsLen 32928 -prefMapHandle 7648 -prefMapSize 270110 -jsInitHandle 7652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7660 -initialChannelId {1a988f2c-37e9-425f-a42a-2e759c80885c} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    PID:6456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7832 -prefsLen 32928 -prefMapHandle 7836 -prefMapSize 270110 -jsInitHandle 7840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7848 -initialChannelId {2e2f97ee-472a-45d2-abbe-363e8eaf48fa} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    PID:6464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7956 -prefsLen 32928 -prefMapHandle 7960 -prefMapSize 270110 -jsInitHandle 7964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7972 -initialChannelId {f20ec47f-dbaa-4685-b8dc-10bc4b6f63a1} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    PID:6480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8144 -prefsLen 32928 -prefMapHandle 8148 -prefMapSize 270110 -jsInitHandle 8152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8160 -initialChannelId {229cc875-67ab-42dd-a0a7-6c3e39063edd} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    PID:6488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8340 -prefsLen 32928 -prefMapHandle 8344 -prefMapSize 270110 -jsInitHandle 8348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8356 -initialChannelId {2e64d56e-c9de-434b-b781-ae47d72088ca} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    PID:6508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8552 -prefsLen 32928 -prefMapHandle 8556 -prefMapSize 270110 -jsInitHandle 8560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8568 -initialChannelId {345bcf24-9a13-4d92-85a3-62b4678fed12} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    PID:6568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8740 -prefsLen 32928 -prefMapHandle 8744 -prefMapSize 270110 -jsInitHandle 8748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8756 -initialChannelId {4f526380-6229-4db1-9e06-ab2405c31a9e} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    PID:6552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6008 -prefsLen 32928 -prefMapHandle 5996 -prefMapSize 270110 -jsInitHandle 5984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9020 -initialChannelId {b523637e-1aea-4774-8055-49581b16d86e} -parentPid 4264 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4264" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    PID:6856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xac,0x138,0x7ff8955ec728,0x7ff8955ec734,0x7ff8955ec740
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,5345654100277536300,13377517316378221014,524288 --field-trial-handle=1892,i,3678595795065356851,18275818399165220870,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,12981661940122846929,444714657667919378,262144 --field-trial-handle=1892,i,3678595795065356851,18275818399165220870,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,11682717942329443994,1197473904304282,524288 --field-trial-handle=1892,i,3678595795065356851,18275818399165220870,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,1253034709627554821,5635174035998676642,2097152 --field-trial-handle=1892,i,3678595795065356851,18275818399165220870,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,13585028585956907637,15587641221212110534,2097152 --field-trial-handle=1892,i,3678595795065356851,18275818399165220870,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4580,i,544418395180465529,242931894251053759,2097152 --field-trial-handle=1892,i,3678595795065356851,18275818399165220870,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,18359648496213989765,14488160483490604448,524288 --field-trial-handle=1892,i,3678595795065356851,18275818399165220870,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:3548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2928

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\MeasureFind.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:7404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1022B
SHA256 a9cd8f0ad0b1c22cdd5b01416ea3b3fb37553d6fdbf9d2a1ff2c2d84dc1af6e5
MD5 dc3e8441f7d2274e6081a9aba0dd2d8f
SHA1 159a0ff5e0685a61171e42c5b30447b88143fdec
SHA512 69dfb70465d7f83d9bdeb4fb6b189b9b445eca30c5d7953d1ccd2d9bda1fc0c11aecb8d1f37fd783ee96c868d96248384309f046a46442a278e7b088e601cf5e
TLSH
T187118CFB83B4957E8A0082E4AB15AF1FCE7A0525131C3C6684E86E2B83E2871D10069F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 1bad6238c78ce7c63f5e500326b1da030e08131e9b36216c94233582920ae306
MD5 e0b7a92ca8471d3adc18544825298d4b
SHA1 f60dcf5da9f7ba5b92432dd3942cd72a44926841
SHA512 ea1cb9fbba84bc220f3b4b086b5048eaaa930fc5d1226c02785e58cb7b1861830c4d982d2e3d6fd8e4c3b354a62352c31f75e8daef8b117459b7eeee3fa5eb25
TLSH
T180E0C6339A38B0B3CCA8C0AF9E09B800F8B4F431018008E4CE2AC32CF0964EB1F02053
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 e70ab7dd5806585e0969a007d7fbc258ed62d639214db69202d34da408ad17c6
MD5 0fde926dd97eb7760d397a1940390a69
SHA1 da6e7c77a9a13a00a7db2c4d57acaaea7473fbd9
SHA512 22be97b534662bce7c22c24f995809b185f4b4b149b41def385f22dc6347e312ceb92b04d5651d723e3b9abdbfc0de4598036f64cbccf3999deef7e2574b5b6f
SSDEEP 192:HRRhCiQv7hAPRp2l98Hsb+WNnfl02UZgDPyIsnAUgR:HRRhDMAXauwd02+g3R
TLSH
T19E22731EB91869BB5DCBD22AFA317763E3F5102225D42E84E7FC8A2C15E79CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6ed45a92f49a64da5d1c121ade4809d8032cf7d16958350a99a4bfc307be59ef
MD5 263a3706fdffec930dde011293c1997b
SHA1 1c5ebcd4ed150f017e34e34bbf7104d6bf35ac30
SHA512 52ff5ef2dd8fd31bfae2e5791c830ecb3d2d27461068c00c32e52c20f35a7aaba412df76830adc9e5cef5f4a89305e6ed9ab90badff929de22bd4332e414c452
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5NHDlB6eGyvkonsob1v4a:MC0HJm5FHuPgXDUDFbW8nsobZ
TLSH
T121A13AB1A4AD4CB75AB7D645F8822A83DEA4A2276991FF84D9DD5E0C00F30D81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c14f53bc3cf70cb68988cf2115e2a09a2c18e8abfd2c260040e0c93f99d4b597
MD5 b6790ad59e55e624ed1926c90d95f768
SHA1 6e1b9f331daa79c63c97e5fe0140861b8c138830
SHA512 a8ad0d341c4c6eeb6ff4772edda1c5253144e2e77d8adfff17e6b09499976dd4896773d07af7b10050d7e204d8c77da96604acdf0959356626c246a7321d7110
SSDEEP 96:5mC6ad+oJm4V0FH+pqf+HBKyo2tmfSl8h4otok5NqDlB6KGyvkfFl65zrtf4GdCN:YCFHJm5FHuPgRiUDCbCzFl6hl4GdCUS
TLSH
T1C2C109B1B86C6CB30AF7D642F5432983CEA462675989AE94DAE94F0C01F74DD2342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8b68672d9e3d7dec638247e46ff17b1c8f5a63631f20d372c9e3ba86f94e48f4
MD5 90be4dd672c533fb59264e1739dcdf15
SHA1 06365f778243e578fe96827a7aef79f0e1c4ed83
SHA512 f33f5a09743cfd4887a005a336d4b0f5deb09f28caa726ec2f738c173c1068002bec90702635599c5a1a68e5077f7543742733b56a9e886ce55ed957982c9314
SSDEEP 192:+v1d66JoztdzgCl6mc0diOv5zbo79Z4hyjy6mm:Wd66Joz/zgC1jnbopZ4hyjTt
TLSH
T15EE11EA8E629863BC814027BCDA51B410F39389AD88E3F19319D21582D5B2DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e9ea59c411ab1d3a6cb78ab89644586bfdd97a0586dbd00d66c3d4b6780a1431
MD5 6c8f63918f4fd511ed3a17da9519ca10
SHA1 7c11190362fbc99a47b0ca711f70eea6bc5b1e11
SHA512 c5361a1d95eafe15397a34715978b92bf873ddc671a88445e56d6f3bcbcfa820606266d98fb1cbf2db588b92d424f703cb542062dbcaca2f6773a53e3beeca93
TLSH
T17C115B5C3AB88D6A9C8BE2ADB050118F53514E1B184B1C438D12FF8CCDC1ADA326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

6be1d4cd-c6c7-4966-8fa1-61b2ca810bad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\6be1d4cd-c6c7-4966-8fa1-61b2ca810bad
Size 2KB
SHA256 0b63d46e029edccdaaa0dc014e6441a722a95ebee18c11005cfefc8cf0e60ec4
MD5 e16ae6b7778d3231fa686efb430e7501
SHA1 34c383fbbb8b1fc28271aa3cb8969de5159a43d3
SHA512 25a61c63d84a232d6b84be1bf9e5fb3d46eadfafbd9e702d4927ec4e248568cedc83908cf9366bead8e182f5742f1fa7d265cc470615ab2aa9e6d69c7dbffa2d
TLSH
T13841445C35745D769CDAE35DE442328A93E0991740C21C836E51DF088D9229E776B42B
MD5 SHA1 SHA512 TLSH

Submit Download

8c180fc3-bfbb-4c88-917f-eac0d5aeb7a5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\8c180fc3-bfbb-4c88-917f-eac0d5aeb7a5
Size 883B
SHA256 f1ebcd9532642713b044f5986ec058a81ce3fd7db9bc42b745a8383ecd5b145f
MD5 237abbcb71858a281e3cbc983a9f4768
SHA1 58e265b4cd1966b26da951ce2fc9bc8ff96074b4
SHA512 d6bbe537b23339b25d3a16860119a376945d8c4cf9cf4179ec41badaf3d8c888ae157f316046512eedbb85b7c02c04a8fe6d11c11f27698393ae2130905659ce
TLSH
T16511C094F631BAB3CC7C925BC595370287E8B42380C656143DA55E140EAA51BF7AA24B
MD5 SHA1 SHA512 TLSH

Submit Download

8cf74792-00a1-4557-9786-f2e14b34482e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\8cf74792-00a1-4557-9786-f2e14b34482e
Size 235B
SHA256 0e7310bb97c22ac6e2d1e62bd481ceaecaff8cb873412adc4a99b080fb532ce7
MD5 00358841e96bc5dbbf856c1263fbf07c
SHA1 37f4ae7b975467c409041a197524b6ae6acb1600
SHA512 f66a10bfdb7afc0b4f51e66174454ea92a9ae7839098441fd51f5fe6ae1c4a2dd70684f23263e43de722dec8b569bcadcd6fc5d0c1a9a0873262ad3a4b3c17bf
TLSH
T182D097906C982BAC08042F03F0B1A9C630848C3718F8B8219D5045B49DF9AC50111A2A
MD5 SHA1 SHA512 TLSH

Submit Download

aed6909b-0517-42da-a201-855b4c5fdebd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\aed6909b-0517-42da-a201-855b4c5fdebd
Size 886B
SHA256 875915e3a5c41148ac45d3d43392bd543d8552b9872f58a2c8e2d5eb3aff0d71
MD5 a18e4ecdfbd16d5ea5f465ab2edf3f91
SHA1 e8176f7f75a9befa3d52cbc2c9001911dcbe6311
SHA512 f821db552c8a8d14e7b9a32023461f9d2cbbf883f47a667c4da6ed2f117f05a081b3fc015e44f5e42f71bdbb1c0ff45f7ad05129636a5952259694b52e728898
TLSH
T1F6110095DA71BAF3CCBC929BC5D0774287D07033C0C62E147D941B180EEA11EE79A207
MD5 SHA1 SHA512 TLSH

Submit Download

c4d3e9d2-75d4-4b34-9cf1-042a161d6455

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\c4d3e9d2-75d4-4b34-9cf1-042a161d6455
Size 15KB
SHA256 cfcc6998744c01dff0fa0d5a8b2d85412c26c646fbe0ea6a5a36549f93236d7a
MD5 0bcc5c8b946384c4bb85ff0346ecbc4a
SHA1 8b3354d0870958cd94bc71d258173bf1eec0119a
SHA512 7619acda6340e3d97a36045b17e69c64727441d87a6b3a4dd7ac764709ec29df0808dee22422725c330078c521e54d41d651c0e33a7440936b5696840626a9ca
SSDEEP 192:svnJQPBQGK2r7RzxfbgXlDZuL9q09RGpyLjV6Ti8+WFJiAPA12fBcMb/qnSn+9N:WkBQGxr7RlfbgVDZLqetPLfBqS4
TLSH
T19A62DA566430497E8691E368D8E97FC3E2F618CB8C019FC9DBE47E0869EE06E5127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5ed997d-e3d2-46b3-bdbb-6388cd4935de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\c5ed997d-e3d2-46b3-bdbb-6388cd4935de
Size 235B
SHA256 ae82037b6c689cfba02824b62b384b4858622db594a57ecec4f2c3d1493413de
MD5 e0453a575f41d84107477b9ff9bd29e6
SHA1 e021422984f42c51d51b88ac83c50f0307c9ce10
SHA512 ee1837a5d3bf48bec7e99c536fcef949eaa48940b3f7a21ede88fe71505a01ad62342a366efc0b502dea6c2a7b9650a6235297d301b3b8e4bc50157a1fa8a61a
TLSH
T180D0978428886B2C0C200F43B0A079D236858C336471A8208EA103B4CEFEAC4826280B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 761e8b86fca5970c940ed404c7ef178c41357879f0c53f41101408b9b11cf53e
MD5 12d8de308f1a934a780d2d511b102a55
SHA1 50814a2a72f0a9281d84c0d9f18b6f99f4e5fb76
SHA512 109f31b7a8f9cecd8baafb1cc927f3552c9578e398f048cbe7cf7e58ac9ff5b6a007554a4099a98ca38cd9f7049fdf05aaa99ee9f611cef5091cb8df5d2c45a4
SSDEEP 96:xH+UTUQqGqsfK1zStSSlvdv9jMnAHdA0ScSqBw8828L4cnEVgR:ArRsfKwSSfdA0ScDBw88W+
TLSH
T13EE12F785408CBBF74B6777CAC6488716AB2413B7BBF68D650B954C4014CF3842E9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4532-0-0x00007FF895D5F000-0x00007FF895D60000-memory.dmp

Download

memory/4532-17-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-15-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-14-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-13-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-12-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-11-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-10-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-9-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-8-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-7-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-6-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-5-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-4-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-3-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-2-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download

memory/4532-1-0x00007FF895BD0000-0x00007FF896574000-memory.dmp

Download