fantom | 3ab3833e31e4083026421c641304369acfd31b957b78af81f3c6ef4968ef0e15

Resubmissions

10-02-2023 06:39

230210-helg4seh7z 7

10-02-2023 06:32

230210-ha293aef3t 7

09-02-2023 15:12

230209-slhd5shb4y 10

Analysis

max time kernel
1780s
max time network
1774s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2023 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xyeta.exe
Size

84KB
MD5

9d15a3b314600b4c08682b0202700ee7
SHA1

208e79cdb96328d5929248bb8a4dd622cf0684d1
SHA256

3ab3833e31e4083026421c641304369acfd31b957b78af81f3c6ef4968ef0e15
SHA512

9916397b782aaafa68eb6a781ea9a0db27f914035dd586142c818ccbd7e69036896767bedba97489d5100de262a554cf14bcdf4a24edda2c5d37217b265398d3
SSDEEP

1536:vpeW2JCTz5eDMn1Wi8N36flDRdHOjN0O02SHU00wCpEbE1PDai41lkgD:xH2JCTz5mmYoDRdHOB0O3d00wiEY134D

Score

10^/10

fantom evasion ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>cDO2IkVAnS57P4+qhh5SqVORfsCg7dVxp7ceKW+/Q9FaHBWZRNSok9eTkSFNvPlUEzh4cqflwhBrKqyxoU52gndS7PlyJyP7si+Q5id6LEEpx0fFSkrlBerbX5g/gOZo8t1mt649OwD2lbZrmpqmOcJRQK1hG+yUsM1z4Bw4SiztiZ52C1JMwNtWuxqyYHdkh5mvZVPOJhUsrZV59BJDYrBYkufgiQ6V2fH9mz030t1MIiM7o1TQQGgy7fj41rg5gBP3FVFf9ZYDliQ75mCYPI+fhIKxpINTKkGilrkbpA81akvtKV9G/9UF+zdmi+bgihN0h27/VMyvVUTQ+epu3A==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Extracted

Path

C:\odt\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ewGGZmpmyxE5Qu8DHa7XFFZoFib7zUzu3eILvvGwElmS2BOb+e/5YmZmsnlI/FcwyGk2dZzj3hPmP2VPW1hNkC6OlUQ40WZoGwsK96GDd0oS0RCuir37Pp5lqIrPeVAtLzqDHFjwZr++kC4ZMUQ5PttJ3pElRsyfpS+0TdA1bB/21841qoZcJxAo4IDXus81ie26h/yMm7/e5GhmB8/X/yEBnS/36U2mmHuQ7mZHcYGPhKUbUd7ctIhU7MMHVCiWcxZasqTgywjWgWF3bsjHgzBX4KN/IqFauZR2x2MF2JRwl9V3FSlTO9kzhgCIF6aEDlCJ+meUb6aLnmGTYwoDJg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Drops file in Drivers directory 34 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\BackupSync.raw => C:\Users\Admin\Pictures\BackupSync.raw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\FindUnprotect.png => C:\Users\Admin\Pictures\FindUnprotect.png.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\SkipEnter.crw => C:\Users\Admin\Pictures\SkipEnter.crw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\SkipEnter.crw => C:\Users\Admin\Pictures\SkipEnter.crw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\StopEnable.crw => C:\Users\Admin\Pictures\StopEnable.crw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\StopEnable.crw => C:\Users\Admin\Pictures\StopEnable.crw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\BackupSync.raw => C:\Users\Admin\Pictures\BackupSync.raw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\FindUnprotect.png => C:\Users\Admin\Pictures\FindUnprotect.png.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\SplitConvertFrom.crw => C:\Users\Admin\Pictures\SplitConvertFrom.crw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\SplitConvertFrom.crw => C:\Users\Admin\Pictures\SplitConvertFrom.crw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\WatchCheckpoint.raw => C:\Users\Admin\Pictures\WatchCheckpoint.raw.fantom	Fantom.exe
File renamed	C:\Users\Admin\Pictures\WatchCheckpoint.raw => C:\Users\Admin\Pictures\WatchCheckpoint.raw.fantom	Fantom.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Fantom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Fantom.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Executes dropped EXE 6 IoCs

pid	Process
3880	Xyeta.exe
4624	Xyeta.exe
5068	Fantom.exe
4492	Fantom.exe
4052	WindowsUpdate.exe
4560	WindowsUpdate.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4904-132-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/4904-134-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x000700000002300c-135.dat	upx
behavioral1/files/0x000700000002300c-136.dat	upx
behavioral1/memory/3880-137-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/files/0x000700000002300c-138.dat	upx
behavioral1/memory/4624-139-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pt-BR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ru-RU\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\wbem\xml\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_05ca2a1836c16cab\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Configuration\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_43b149b35876b241\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\icsxml\cmnicfg.xml	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\oobe\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mvumis.inf_amd64_f0f4d0c799bb854a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_e0c209c891e162a4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\Volume\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\hu-HU\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_d9886a7bbe9e55ca\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\F12\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\spp\tokens\ppdlic\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDiagnostics\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Com\dmp\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_6e00e835fbceac58\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvpci.inf_amd64_86afbe8940682d27\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\license.rtf	Fantom.exe
File created	C:\Windows\System32\LogFiles\Scm\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Speech\Common\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ja\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_36a71a022d8bb0bb\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\MUI\0407\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migration\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0019\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\winrm\0407\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\F12\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xboxgipsynthetic.inf_amd64_9aa94bcf077169a1\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\_Default\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\XPSViewer\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\F12\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\MUI\0C0A\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\Amd64\V3HostingFilter-pipelineconfig.xml	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\MUI\0C0A\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	Fantom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W2.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main.css	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\Magic_Select_remove_tool.mp4	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-150.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-300.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-100.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-white_scale-125.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d7.png	Fantom.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-125.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-250.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-400.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\WidevineCdm\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	Fantom.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\selector.js	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\Locales\et.pak	Fantom.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png	Fantom.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\104.0.1293.47\Locales\hi.pak	Fantom.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\104.0.1293.47\Locales\pt-PT.pak	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-60_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-400.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-64.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter_18.svg	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js	Fantom.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_32x32x32.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.contrast-white_scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\winsdkfb\Images\fb_blank_profile_portrait.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-125.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Tented\TentDialogDesktop_456x100.png	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\ui-strings.js	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\WideTile.scale-125.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-150.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js	Fantom.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\AppListIcon.scale-100.png	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.1081_none_491d51c316b5ea8f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\fr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..yer-wmasf.resources_31bf3856ad364e35_10.0.19041.1_es-es_10ae8adad3957c87\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit.resources_31bf3856ad364e35_10.0.19041.1_it-it_f0b8088810c6e7b3\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\401-5.htm	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..ybinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6564c0404f86525b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..o-multi-dimensional_31bf3856ad364e35_10.0.19041.264_none_06dd36143934319c\r\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallPersistSqlState.sql	Fantom.exe
File created	C:\Windows\WinSxS\amd64_hyperv-devicevirtualizationlib_31bf3856ad364e35_10.0.19041.928_none_674d75f41b8bea75\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-directx-dxcore_31bf3856ad364e35_10.0.19041.546_none_91c1e5175f56d3e8\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz.resources_31bf3856ad364e35_10.0.19041.1_it-it_fbf03556a3e6914e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..injoinaug.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf8a02b27245a8e5\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.207_none_504b6becabbef9fe\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_intelta.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_d7328170ccccefe4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_10.0.19041.844_none_f0057f8e491b65d4\r\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-bits-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_4a00b6a9f80f250e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.1_none_484e61e96e69ac70\Digimarc-Logo.png	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Dtc.PowerShell.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_hyperv-vmiccore.resources_31bf3856ad364e35_10.0.19041.1_en-us_88722442c64ecdec\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..cy-script.resources_31bf3856ad364e35_10.0.19041.1_en-us_efbcdb1b276fb5d3\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_sv-se_4dea1aaae0491f58\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_appinstallerprompt-desktop_31bf3856ad364e35_10.0.19041.746_none_e9f37908346a0479\r\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mixedreality-runtime_31bf3856ad364e35_10.0.19041.746_none_77381cf1325f70b8\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-photoacquire.resources_31bf3856ad364e35_10.0.19041.1_it-it_c8b69cfab86bd47d\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\AppSetting.ascx	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ttiledata.resources_31bf3856ad364e35_10.0.19041.1_de-de_09ef339ce66330fb\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dfsui_31bf3856ad364e35_10.0.19041.1_none_1a05ba7cd0c12501\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-msxml30.resources_31bf3856ad364e35_10.0.19041.1_en-us_fa04999b1a8b896b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1023_zh-cn_db09494379cbda0a\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\CellularToast.scale-200_contrast-white.png	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\500-17.htm	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wsp-spaces.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7f8e4d377a00d132\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_system.data.linq.resources_b77a5c561934e089_4.0.15805.0_ja-jp_458c29ade7f2a139\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_10.0.19041.1266_none_d2c44506a9944821\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-gdi-painting_31bf3856ad364e35_10.0.19041.264_none_554d78fd7aed69f7\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\daytonaOptOut.js	Fantom.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-memoryanalyzer_31bf3856ad364e35_11.0.19041.746_none_8889db5dc377e286\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-0001041f_31bf3856ad364e35_10.0.19041.1_none_622705e81b6b28cd\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.19041.1_it-it_dae95f98d0ad8a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dot3-netsh-helper_31bf3856ad364e35_10.0.19041.1266_none_59c1923bada98290\r\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-coremessaging_31bf3856ad364e35_10.0.19041.264_none_2564746a4269470b\r\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dcom-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_a0d49c02285d725f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_hu-hu_a68f88f6543bf18e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\commonPlugin.css	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.1_none_dc5648407c9fbfeb\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-comdlg32_31bf3856ad364e35_10.0.19041.1_none_75f6c9777965dc1b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..shandlers.resources_31bf3856ad364e35_10.0.19041.1_es-es_1ad3b756ea9952d9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-srumon-velocity_31bf3856ad364e35_10.0.19041.746_none_8ede0718a30179ff\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_scunknown.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_356e1ef56c62043c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00010c00_31bf3856ad364e35_10.0.19041.1_none_4a63a6922aa5c1ab\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..ergrouppolicysnapin_31bf3856ad364e35_10.0.19041.746_none_ddef0350f40a7408\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..artup-cpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_87a37679cdac9330\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.19041.746_none_f0af1fb998f15a35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\InboxFodMetadataCache\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\OfflineTabs.html	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..pp-ux-dlg.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_0bce0776bdefcd14\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0001105f_31bf3856ad364e35_10.0.19041.1_none_57c32f61e71683eb\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ining-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_43a98ca6667f0342\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winsetupui_31bf3856ad364e35_10.0.19041.746_none_3d057843247a13ec\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00020422_31bf3856ad364e35_10.0.19041.1_none_ee35bdd11ccf743b\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2240	4904	WerFault.exe	74
2464	3880	WerFault.exe	110
1508	4624	WerFault.exe	114

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	firefox.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Xyeta.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Fantom.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4492	Fantom.exe
5068	Fantom.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	firefox.exe
Token: SeDebugPrivilege	4292	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	5068	Fantom.exe
Token: SeDebugPrivilege	4492	Fantom.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
4292	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 1372 wrote to memory of 4292	1372	firefox.exe	93
PID 4292 wrote to memory of 1848	4292	firefox.exe	94
PID 4292 wrote to memory of 1848	4292	firefox.exe	94
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 456	4292	firefox.exe	98
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99
PID 4292 wrote to memory of 4744	4292	firefox.exe	99

C:\Users\Admin\AppData\Local\Temp\Xyeta.exe
"C:\Users\Admin\AppData\Local\Temp\Xyeta.exe"
1⤵
PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 448
  2⤵
  - Program crash
  PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4904 -ip 4904
1⤵
PID:3036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4308

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4292.0.1158322910\154361786" -parentBuildID 20200403170909 -prefsHandle 1676 -prefMapHandle 1640 -prefsLen 1 -prefMapSize 219989 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4292 "\\.\pipe\gecko-crash-server-pipe.4292" 1764 gpu
    3⤵
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4292.3.645694441\2099525973" -childID 1 -isForBrowser -prefsHandle 2416 -prefMapHandle 2220 -prefsLen 112 -prefMapSize 219989 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4292 "\\.\pipe\gecko-crash-server-pipe.4292" 2476 tab
    3⤵
    PID:456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4292.13.1288037786\1996684361" -childID 2 -isForBrowser -prefsHandle 2468 -prefMapHandle 2460 -prefsLen 6894 -prefMapSize 219989 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4292 "\\.\pipe\gecko-crash-server-pipe.4292" 3636 tab
    3⤵
    PID:4744

C:\Users\Admin\Downloads\Xyeta.exe
"C:\Users\Admin\Downloads\Xyeta.exe"
1⤵
- Executes dropped EXE
PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 452
  2⤵
  - Program crash
  PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3880 -ip 3880
1⤵
PID:3520

C:\Users\Admin\Downloads\Xyeta.exe
"C:\Users\Admin\Downloads\Xyeta.exe"
1⤵
- Executes dropped EXE
PID:4624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 424
  2⤵
  - Program crash
  PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4624 -ip 4624
1⤵
PID:4948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1700
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3812.0.966685473\767694998" -parentBuildID 20200403170909 -prefsHandle 1620 -prefMapHandle 1404 -prefsLen 1 -prefMapSize 220522 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3812 "\\.\pipe\gecko-crash-server-pipe.3812" 1692 gpu
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3812.3.1555850880\1678731024" -childID 1 -isForBrowser -prefsHandle 2508 -prefMapHandle 2504 -prefsLen 353 -prefMapSize 220522 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3812 "\\.\pipe\gecko-crash-server-pipe.3812" 2520 tab
    3⤵
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3812.13.335739435\181448858" -childID 2 -isForBrowser -prefsHandle 3784 -prefMapHandle 3780 -prefsLen 6509 -prefMapSize 220522 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3812 "\\.\pipe\gecko-crash-server-pipe.3812" 3792 tab
    3⤵
    PID:2356

C:\Users\Admin\Downloads\Fantom.exe
"C:\Users\Admin\Downloads\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4560

C:\Users\Admin\Downloads\Fantom.exe
"C:\Users\Admin\Downloads\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\047E88F017748A97FFBC527350DC6218D1422741

Filesize
13KB

MD5
d295a08e055a021c24e5400aa73e6751

SHA1
c1c41df819cc91f333d57edfa7d7ea23b8b94faa

SHA256
b1667d32df8e333e7a5c3853cf37a771a620122463187df2cdf98bfa857f8869

SHA512
c8aefafeec3c0a396dd6b3690bddc54a48752b93c76e9b7d9ea57fb6d5fc581ed5d4433a67e978ed0d215de358ce88ea97cf44af11a91586ee7f16055a52393a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\0F42786CA0CD9EF54461CF4D92000B9DA772480E

Filesize
44KB

MD5
64b2810492a5899521c600c01b75ef65

SHA1
f11e395a3444ba94d4938df3d3a3428c9e52ad6f

SHA256
9d438aa2f295c85181c703b62bfffd70ffa1a16e94d75a5c23939bf421d5125e

SHA512
c05fb26e7ae379a5e51b0e76e6b5b2e40a9f93a4e676c5b357500ef30b4b857efb88a7a19679b89a373db7214a6a08424c0e19da020b5936864b19f75e415860

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\1BE89213906421E1634CADEC055D3FABCB9F48E0

Filesize
53KB

MD5
c5e4d15565f9c081eb373c5e67bb08f6

SHA1
31b92618557cd6eb5de6b65d5cbead51c4b56e33

SHA256
285a905883104343ff49d76c1e94179770e62752d542160da4080a270ddad243

SHA512
68f158af8040cd7019e67fd5d777bfcf40a2a6eb0bc71d2c4968a569d12f390a9009a8476afb38d9ae9c4e11dd1edd8bbc42fc24e5fe435a9ad33e481b772eeb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\1CC4090A1C622E2A5E457C9F7FF1A0201AA93C6D

Filesize
13KB

MD5
2c1334f4bd40314d3af91ce2d03e75ef

SHA1
dcf3020c55dfd8004c932964c1cd7f3e21d717ba

SHA256
53a53d51fe137c2ef9256466f4ea77ac45589c15ac50b86a4717dc66c6253cb5

SHA512
e135c1337a8a2bb080bf3732eb59829df0c9e5036e115726d25540de2779393d283245115fef00399f77903df6391bdaf3f1ff676417e90972a40f9da30b5720

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\3D6B0A4FD4978CF42263A84A7578000560B057B2

Filesize
13KB

MD5
b517e2dbfacc6f956de666072a34fb1d

SHA1
6ef386bc8e1165896dc51e2d950a2496467257ba

SHA256
8ac7ab785761b6a00c8541568d50048bff061b712ab1d1242f2984883864d931

SHA512
e5138217ca67a5df2d89a3161314804bed7337ce5efd6e0553bea139a6e1773ceae26f93b594914cae5dd2eab801fa6c1e2db4b269e5f1980dc41d75041db804

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\4903E7ABE348ED39D98D1C844FB81A906D5ECA16

Filesize
9KB

MD5
482a25378eb7f51ba58109b3f7f0acf5

SHA1
e31a0189f8521cb5ff98033c8fff413bdbd1bcda

SHA256
4bdfc7484ee53c77ab7eb8a6eba544384909fae2906f51e9756209b5aad17b13

SHA512
b08beb7fea8b887fabe1931350f4a1510a4913e0636f727cc6838f0808f5b56a2ad5bce5d11fba95ffd2349cfb1383bcca19c1dbefb05aa0c1102c0fcf5a42f7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\6475B8A39AE7694A15A2CF8F1268EA202F206455

Filesize
12KB

MD5
33e3ee89ca8722399e451311f8f62623

SHA1
41b807a4c4689b7a99dc2dbda14cccde63b0feab

SHA256
1c6bf30a56647db0b44d6b625f5cdcf537f55212e0eef479e43bdf7719402bd1

SHA512
dcb9efb15f50e5ec95da7f072d1c02287282837442d63d414d5b189c69fe782455e3efff6d79c00c7ab8f239057d2f8973e329f3ffd3a75bcfc7f0c526699a85

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\6821E9CBF356E5AF0915FC4EE5E8BFAFD81B699B

Filesize
14KB

MD5
a7dabec8e737424ebe4f7a39d2bdf5ef

SHA1
322cb0ba785cf0d283a34e2e6bbf866ffc885ef9

SHA256
6dd6c2ae223de1cf72433cf1d68371051773c83d58e28b9c57ad951964bc0ad9

SHA512
0db1f600164e2cb282113dc9d009782f618ef7730d22d484f61f81bb19b211029b611ba3bd9ada6bb1326df35d5892e40688c54cb198905fb207d4aba7476b80

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\6AC9BD0802E051FCD579CC69A96979DE29682F3D

Filesize
259B

MD5
e29036277cd617ad47793d70f8fb3c21

SHA1
d50c282275950e0bca8b1a14d42c7e0be96b2e7d

SHA256
a95500b387ad13fb92019ae23d94182ac12102f95dc6031313de9594a937d49e

SHA512
0d30a5c4b3c64d8c83d78375226bab2b846e54d19a4195bcc9a5dc9b63124d49a0d1da9b4c21c2d7673b527a505702e56e1d84ff0f79bdd361527139bd45c3f8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\6D4934FE31BFAF4563C9C133D9CEB4B986FB5CA0

Filesize
15KB

MD5
933bf1bd9b19ee9ba8519be8154e8eb1

SHA1
24b42b2608101195444657a1cd69e43578df60bc

SHA256
2dbfadf037e99e5b41559f240c5bb0758c8adda8be47d3a4c4a307d554d45418

SHA512
ab75f49c88e054d8af87f7c2d1d29c3c8b56d603ae0c1347cc3d2111306d6ee4966a0ea68dc96ab672f498c3b77e7258c8ff61cfd474ab27a7b23d66b7c0bbd3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\7A4E3BD3CEAB9AF7551500C4AE5EADB45F6EF95B

Filesize
15KB

MD5
4d0a38539e18d284f7966762dc838f23

SHA1
1da3c93f12cf64901aa51865762cb70c43cd2f34

SHA256
6ecb1ec88964930b7e7c6fd26cd227a19edc05e2977b62cc5882915fabfc75c2

SHA512
3e97c488607639ec612f131ca2d66059f1ce1f0de5405e905d5a3d9b1ab79331a70fced232b9c67349666a09f2ce1fdd97bd057ff6d12b511693fadb618024b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\864DFE12C7E78761C14F064AD9CDD6707AFAB8B8

Filesize
16KB

MD5
2f64642b466d8736341539a31f613694

SHA1
314dc9d77063b222bb366455610be2a1befbcf01

SHA256
5b5e2a6fcbffef1463b93cec6c9325d0a856fdcf46ed0b2cb54ca025b274d5b6

SHA512
974f070d08f4c55f8c86de6783bef46d3eb19ff0152e7407bfcc9d666acfdc9480aa335951760b2a52fa3feab08bf134b0f6ebb7b9a52e5d008e3ab4d5c5fbe9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\9472FB0E9EC6D9565DF4760304D30A77B3C2854B

Filesize
13KB

MD5
6f506162159f0f2952c73daba5e66dd9

SHA1
67c0ad7f82ee95de0498ff910dfa0797b7e07c7a

SHA256
3c16ab9738893b5c777f512995adbb622c5b2419f6f65e659355022b663b8a7c

SHA512
c70a253d3d04629276e25452152495dab2f13333b5a441ef3ca73ca19029b04af2a804898a63d1893a6084ec6bb08dee729b880875f7a878b02752b78e7a3214

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\A26FF877FE0FB983129B4DC06399A0DE95A398A7

Filesize
21KB

MD5
3ee6793d3b3c9bdd404e0d545c3f98b1

SHA1
78060d574bdd886b20b131f61f070090940bea3b

SHA256
094170f42e0dc0a7921764312be07a459da1921b0188b49be85c890ecc249ede

SHA512
8fdc41573c494b4eee0d361cdabb5d8dea4e297ecf4d0c2607803d2e20149fb734d70232ff489639c3e47a788b658d114ad3b1130435289325191a6f640223f1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\AA593602E7A64146554677C74A8938015E3DB304

Filesize
40KB

MD5
24a3fa3a7a62c8f3c55df746d689a9d5

SHA1
a017bc26002f8d1f6d7a45ec65d4be037d487f9e

SHA256
5debdc36c563982de6ab8fe5e13df41d771bd2fe1d586daddb940b0b0987d823

SHA512
825920f25d4b7753c111a8fe1090d09df1c8c2fdc38e06e1d4c4700557e1e10ad8be9299264f5b265212a8cd8861ee152ae562a0afe464d078d52077c8c3b41e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\B35B26626F29DA857D788AB265CBACD07D9C9D80

Filesize
13KB

MD5
2af19eb25dd2affaab65f7453fecef76

SHA1
4a03296d267516df9b771f05e151845631e1d1f3

SHA256
1d340451928660f889ec7fe06a852a0e9ff5c682862aca8b8317ef3ff1f762e3

SHA512
3305ee7e59053661d5149b7bfdd711379897f74ba50aa621a3896810db6816af00b26173d6da9851d6469954d2d47fb2c2b7c62023e8606cc8ec84b9d7b9ba2c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\BAE8DD448C4AADC47702C9034B838B2FB3A1365B

Filesize
14KB

MD5
2c1562dd32291bac2342e03a8208be42

SHA1
82d9d8076311fd4fa4b71aacd94491711b90a8ae

SHA256
fe53b98b565c561f7957349f5c7eace9019e929c02fa2b78929a9801fbbd3cd9

SHA512
b2dff864b7fe386416b027823996175e9579a2201909856774152e1492ec16bd784ce8a5f58c176312eefd5fafa1cf9f4d81fc987704d33e710241c02b7fbae1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\BED8997268544C4202FB6C0E8FE619E4D43EF60E

Filesize
9KB

MD5
f6f856dd67104fd2bf239dc83cb53a71

SHA1
e7c01c6264043d8a0d2ddd436cca42ff7a00a0d9

SHA256
1058e23a759609bc4d977cfdb942d0e1b3e8d30438e5649b06eb13ff743e5788

SHA512
bb946e2f20e76d25d8125fabb7c17d5d9e8adde425a490f6379fd158b175ee1d01d46c9c5df82068eed9ff0c6e3490202b099a59720bb326727a688d6a9dc71d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\D267CB43EEDB24FD03280AF7B77A5B35BD5DFCD5

Filesize
13KB

MD5
43a3f58f94c49ee7f0fec6fd2b4fb495

SHA1
85982b4b62d6297d63b4dac4cbeaa39ab3a40811

SHA256
740c4ef0831af0e877887ba77f673c300198bf0ec9afca290d5f91dae290af64

SHA512
6d0d58bfc62e7f5ec46522c2a6aefab267afb99d2e6a80cb153d860c9defb9ef7d98edd1a4cae15c2898255c784daa49bf572b12ce169855bd61446a03c85c18

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\D36343BDC7530BDE61CC46A506D7F0AAE6D8E241

Filesize
13KB

MD5
b1e8ccd5ba13d739902ecaee3471176a

SHA1
ce675f483e53330a1cde602e17e669c8f3c1e8d4

SHA256
d6b7f364d60b38f4e0a94296be679585454cd9fce5df241907043861c77ebf20

SHA512
77cbc3e7c52180f9f55d2d46d0aab30740be0d04fde5fa68648ccd556f161b284a91831c723362fe1e171cb52e98857969b334d26671b8fa3074dcb0fb8ea1c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\E99540554062D5E1F37692E2F9EBFA88EDAD8791

Filesize
14KB

MD5
8b8531de8b3753726dfd7125d60f034a

SHA1
f887ec9eba399dd852f0cb0f50fe68038ce7ea71

SHA256
93acf23f6c667a1ea7cc68897b491c66a50dce81fc1505d030e163c2c44ac284

SHA512
9b220fb10d8807562d9d5bcbae2f6e703289129163d90344a821c89f7ef46a1521dff30bd3439fd29456c8c09d917bffe566a7e4ad480ff32237e75d00e4b751

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\cache2\entries\ED07F042F4253F704BFC7070ADB92A3EDC4588A0

Filesize
8KB

MD5
8a0fdcb86d14d40f886b3732459b7e50

SHA1
53676e8d11cbe3baf14b549b951a0fd1a34f5169

SHA256
5d8f4ba0e264d7c509139e52970022b8dc6c19e8ff29611b5547411131662665

SHA512
7f1b32375c663434f6bd03fc07a9c37d59d4d27a3a6c6adfa70733b7f5f059cae95f5a0b7a6d065f080bf1708d55d66fbc6a62879de6d3f8f1220540ee3c0ed3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\ads-track-digest256.vlpset

Filesize
51KB

MD5
6c3605de4e50f585c2dad2819d138112

SHA1
4c647f39e09f9a3f16c982febbcca061ffa42652

SHA256
1983aa1c36d96d197aa522d6347f0ab6a62234294964f1d5889600c2ca6605d0

SHA512
b619f4fa7138b90ea92064fa9e614e978b014257a59a71738d2fd2382988d395c1d9d7aa362e90abe5acf82dbe786f860bdeff65684db16ab5b42ebd5f47fc44

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\allow-flashallow-digest256.vlpset

Filesize
69B

MD5
de0d88480c24350c59e1e9a3583de0d1

SHA1
4e3c279344cb37deb5e893ab24770982de135789

SHA256
01ba9f0b913e04ed10bd7166796483dd4f72005f249d6ee68b12117be4b5d3c7

SHA512
f627c69598baa9bc60b036cea03fdadc8b4cc424ef8cdf93614275a336de05a60961f5e77553226c99c29ec2932272ae994327a4da77d75d2464f6722cb700aa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\analytics-track-digest256.vlpset

Filesize
9KB

MD5
2b077f437067b52d00d4280df1b248a5

SHA1
19c10d8bdf159b9e53db9855d1d97a658d92c994

SHA256
a8cb2ff713acaba0b4612c5bfece51a5e5d436a739c0455a3731d1ef8e0eae12

SHA512
ba03b93b68e5cc0de34f890d7d112a1df0a17dcb451bd9c0761e087260fe9b3cb2afda9efb0b9d075cb722b77a859ca0b27c570a6db62a08b2fa9d30a04d00d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\base-cryptomining-track-digest256.vlpset

Filesize
2KB

MD5
f45cb33dfea35013b6d5951f464a7841

SHA1
21c9d73636871aafe063797059078fe2373d1233

SHA256
498ab828f2dff25b45deed474bebdbcfadac63a1cbba2e393162ab54bbc9f2e1

SHA512
88ff2955d709d53fe248b88beb3f6bc31a485c17c80c5ddb8ea91abf46b0a43bcaf7f357ea4ac09dfb1d7988f8b7b1034ded15c2861d9de01719c131cf72a27c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\base-fingerprinting-track-digest256.vlpset

Filesize
2KB

MD5
cb73b8baffcd07ff5d1df58f8477370b

SHA1
3bdda94d12aea19a659c3b4035d0e613e18ca202

SHA256
1e063a0cbc2d947925265cabbbb0da6721b7e05361b1171316fca37e906226fa

SHA512
f5004c43ba0b5b48fae0c45c5f61c2a608a4ca3c61362cf27c51da7335597f9862f6c5a04e137bba16e92f3523e1009b5ca2542f52d478f56b946cebf2140712

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\block-flash-digest256.vlpset

Filesize
6KB

MD5
130b9ac2beec5ada274561105d81ae36

SHA1
85a4785b34bb151da41bc0dfed380cceb7a29983

SHA256
7d99fec08182a5b95d18d1569edaa2c60c2aafbd15a56d8882f22f3b395e6460

SHA512
cbf32630bfe48fe6dd0e815f2e9752ca75c066bdfb5f12941f3278883b0530f1736b2d179801afc7ab4680be6ca9976c6e2e3705147d95503ef32cf730194631

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\block-flashsubdoc-digest256.vlpset

Filesize
71KB

MD5
40165280ff1345b5241ec2a9d1da2af0

SHA1
c49f9172a6bba2dc4e91fa97defd161d9e87773e

SHA256
f80bdd5341d8b1ee946e344e258ef2d35c3c0bb6b13eb7b3e6a77467dfa8b97f

SHA512
b5ec96e5f786de54976de804491aaf01bd79dd48d81ec81e1a9d32157881b0e7690d3608ee18e60e4381291a1c179999f40e0b98f9483519084da268b4904c8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\content-track-digest256.vlpset

Filesize
15KB

MD5
9f355ca06a2c5eed2b13ab75dd4ca3d3

SHA1
16a014268d85c8b1cd476da2cfcf7aef79d5218c

SHA256
039695d5ea6e79797e1b2acb4aa95bcbbe3f4c53970abf28c68aef2b13f1a95e

SHA512
ace6b46c28c25ce5d87162566a882cf99b4a2512ac5fd9f0168ff9936d316af8652e775ebce8b1fc8b95d33844425da3a4832348115ead078d7b78a0b369b78f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\except-flash-digest256.vlpset

Filesize
101B

MD5
c2994d388f8780c87d35c352d9582985

SHA1
b4e9ecdf3ecce53f072b7ce9e695ffcc17ea9f76

SHA256
7ed09f7d2bd632f70077a4ae4f2bd2f3fb654b03cd72652f51678b0c7d027f25

SHA512
60edd83f6e0ff782ab251579e0f3c113d3d5fff7ba7f3a8900cd4fd6bc7271921445e94b53073129db9529f0210750615318348307db650fd11ffaedaeb7bd15

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\except-flashallow-digest256.vlpset

Filesize
69B

MD5
7194b6bff691a056852a51e2e06ce8fe

SHA1
0adb901d9e202ee31ce6a8131ff15e5ecca834f7

SHA256
cbe2dc6abfe25bead60f4dfaf419fc0f441ff8a8dd4a2febf5553be1cbd90c49

SHA512
b0d8240050a25b2ab754e8f260361298d0017e3a938e965a34b6db072380cb6167c4fa5e0c2293b46b1135207ce9242ce1441b77af8b07a3212a49000e8bbd36

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\except-flashsubdoc-digest256.vlpset

Filesize
133B

MD5
0c0d67875bd75a0227c02dd8529ba01a

SHA1
2b12efb5e31bdac680b6283e2585eeea096fe73c

SHA256
614be0169ec36e67223eb9645a98da66dbfde5dfbb89bb064f428aaeabdd9d97

SHA512
8fb01246c4b7b4a2cf0379f931e0cd3ea5a32781078efdc4c4a5ac3bc496697957f6d15a0b6daaf562e48bd1b1ffbafe0583c59962689b030c4c5543cf8e2ce5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\google-trackwhite-digest256.vlpset

Filesize
1.4MB

MD5
e54e5b84194eee15e64d2a03f1136bb7

SHA1
308413c74a49af1a575bc6f64fea33f9ad2f220d

SHA256
07707b589be3dba3bb0bdac67760a2b180ea3531e9d7976b73e4c1d8df9dbb1e

SHA512
f3bae1816db808c69871bd1a059236bf57982e90da5706adcc3359a200f1ec2c529be516be629fbdb5e7da8c3ea80000815d99c8c2c347440cacd9237bddd3b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\mozstd-trackwhite-digest256.vlpset

Filesize
293KB

MD5
dbd7544bf04db52719348298521f4ed4

SHA1
ab838a83ae023aadba87bcae62093e874393a0e6

SHA256
f87c0e78f812bf39363b1974ed20175e907cd6114173db31e1c7243f4d515dfd

SHA512
0ef0ba0a594bb019133a133b9edb73901e804c845a66d427686f32a48c9d1ba665623d3fcd10018c2415202fd3f722aa23420598ce892444b4574c108ce4d6e4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\social-track-digest256.vlpset

Filesize
2KB

MD5
399e146c7c24fb3a69525f748f6742ab

SHA1
5a19c6f96244a65ec44af582956a9085407768a0

SHA256
11bddd57f215cf440ef5e41385a618123658be38b03097b547a9ac5220db425e

SHA512
3d280f40d78b0ef1b76fb8210f1d59edc5412208058d7f9448e14ff11c4e717505735c161979e2f84c4ccbcf4c4fa13ff3e8200b27ee2bb96e8d1180fca62e5e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\social-tracking-protection-facebook-digest256.vlpset

Filesize
485B

MD5
c6e5d0e5cc6cabbb446b625d9a14f3ef

SHA1
2d46657ed7ddb6f4c295b90aea7c477f2560d4f4

SHA256
de974099351ab8e3b4945d3fae34a2d8bf43407921800719256cf29139f516e7

SHA512
6e30e2adc27654d3052fbdaa8c4bf6d2ea41687bea67cc80c412c0d07a6174211e633a1aace5629444ba9ab0289af9f56651b5ab9061bcbb820b04debe175098

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\social-tracking-protection-linkedin-digest256.vlpset

Filesize
165B

MD5
e28d310df430e7b6d95d9c912fa94e2f

SHA1
6c54ae3b421f47b73260751c44584d4b1effbb16

SHA256
0f6bd075711185f73238b0cd030f84a6fa9ddc17d341a669aadd07b806a86626

SHA512
1dc3c42fd79042eb9d17746a6f5c3e46d3bcbf36bda2143b380a02519771c39870cef4e8031e29191505c125c52a73e20c8167e1c26c3458fd9b7c89f231f0ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\safebrowsing\social-tracking-protection-twitter-digest256.vlpset

Filesize
261B

MD5
dafe2c58eba7740af1a2bad64cef0f54

SHA1
f10d56c4c9d035744f46ed60690d7eab35952c27

SHA256
16093715575f4b5990d69d92459156f5843134a22135ff93185fbf109d64423d

SHA512
5e6e65b2e357e6dabb163496135b0269f4e6f19f230e2f5f51f17c18b3462280f83e48d621747aeb88eca016906acc9d6c05664b3f5d20ac6d90ba0aca41ba4c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\startupCache\scriptCache-child.bin

Filesize
712KB

MD5
a0844b205fe2b49f341dfc2671dcb2b7

SHA1
dd43eba44543ad99cc62785343e0e2766f14e6ce

SHA256
d4e9139bd06009c45ea680461b835de6d1d8438363a1a09b28943c30866c4ab1

SHA512
4123a1e151602d312e507216ae081e538e59a85660e9b3d6997189f7008a573bc6609abfd0d67857797e066ce25d50470efe1332d32d6a7ff492101c1025d90a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\startupCache\scriptCache.bin

Filesize
6.7MB

MD5
f55ba4b862f15d883a909f9d7ab40939

SHA1
3392f96dd5be0fa4163f90dfb18e94c3ff8d958a

SHA256
eda1d318be1db58cc2375865c4a1284ef1753207f8945cf6d580fb7126e9d3d0

SHA512
f7864e3878a8cb181c0a86f88565cf3cf6ffab8bf8bc4d1381442db0884ea5fe196f6151c0ae395c4a4d2647256f0e7e0dd308c4ba2ea2d0084a5dee55b442b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\startupCache\startupCache.8.little

Filesize
1.7MB

MD5
0287dee24b22fd319797382edac68afc

SHA1
3615f65f0581d196e21a69985d0e49a3aec0d891

SHA256
6d7c087d38f93696a917dd45b3bbd2242b77b07867b384e10576737a6e51eeb2

SHA512
50fbce65692028607af343a50cb5bfdcd94e24a0047a682f857182f8fd9f80031944b2c1994123a3ec398ef261df120ed1dd4d0e5555fe6d726619e30bce0709

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6wx89zth.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
50908d1c13b886bbf1631f57adac8978

SHA1
5ec62d289164ea178215f844c6fab3381b8fea4b

SHA256
4106dc58c88941df1815ec226313596676bb5e31468e31ebd98b947a2e926172

SHA512
584df965228f6bf903733a95e5f260506d100d7339627c9a8cf8124c751b9f61030be01d9c0ef44e3eb12e376b9e85cd8c24ebb4ac2f5073bee5228e97938c0f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6WX89Z~1.DEF\cert9.db

Filesize
224KB

MD5
182f18c2483a35701f3fd40bfc153811

SHA1
c395f8475a7ac724bdd3d1f0d7c185f5992cccd1

SHA256
3a830fb28022ddb19acab5835dd6af3f94799a961693dd48047ccd63ea50b033

SHA512
413f134954f2fabeb7da4c60289409b3d64dafc62501d875ba45cb5e9fa83585a1e9774a954484e2061b823f1c1ff3be057dd8a1e2b70f54e7d2bbf9a5c12bfa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\SiteSecurityServiceState.txt

Filesize
832B

MD5
03f490681cd3c4eca48ba50dbb16a911

SHA1
32b4920e7deec8e13e683b6675112f0f22954808

SHA256
ac0adbac725efaf93563970001d4b707ffc459260da5c0c3352ac071638aa62e

SHA512
8ac0c3da0845fe27dca82c4fc388e52abdc2a27ec408c3e49b04d5252da9b4e63a6a1b1796931705b7e857fc0d90fc661f438a431a0083691102f134c2593172

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\addonStartup.json.lz4

Filesize
1KB

MD5
bc4bd0071af0574fe57b6756f0b26071

SHA1
dfc6af6b87b58391f67679a24c28495503f9e75d

SHA256
2f0cb964330decccb1375985d126d6cd2fec171e344cdd6e21026fa9459d8ad3

SHA512
9cd3f9140a3beca18114253556281c48e0a2401d8e7bb01b518a0615caf6a1f4a8cece627c00caaf9cb3f7cf3a57a224ec5233682b5b3f8e933619b85488551d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\cookies.sqlite

Filesize
512KB

MD5
9e33a6dcade71356373ac2e14fae49f8

SHA1
ac2c2172af44bd3ad72ba24a79af0a00c610123b

SHA256
b371204151bfd532846622baf526dce83e95eae02a068e2d428e37c4d17e8d55

SHA512
074e855ee8812051c289d7c5423c254459523f713aaeed1b5352f1041a7f9d3525d2fb7ed947758d17fe76532728c8354506bcd27757dd14ead508adbb9e42ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\favicons.sqlite

Filesize
5.0MB

MD5
d6a85b089ac84dffcef0083d9e275370

SHA1
9a560b0a291a88a039e2c70de73f52fecaf79a15

SHA256
7a082e6af0808b4a3a150329f6a6996cb5aac433228da16f7dd584bbdc12c3ee

SHA512
029d87eafb86250e24a712808a3ce1e8ad2ae6a7e27584c66e08f74c8bdfcbd094f025084406a239c51b54fda4458115912f485c362b67b5c994eac2130f0de9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\permissions.sqlite

Filesize
96KB

MD5
bef7569c29432a4a5f8afae106b329a0

SHA1
99ac679ce93fb11c7d08e9485abe10e571b6d3ec

SHA256
71f80038b5f5ccb0127e5a68e465b7f4e3dfc5b2ad8ccafdf82fc828ec1e24a4

SHA512
bdfe3f1b8b2208e85f566072be27b371e9f838f11b31d538cb1e5d4691e938f652fc9debc5b1dcc0e7cda5c77d29293c07492e4725b7fefcc33fae438e43577b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\places.sqlite

Filesize
5.0MB

MD5
705693f90f57b7ab9c3cdada93b0f9ba

SHA1
53c9d2541692db2186ea48a8261fc4cef682ce66

SHA256
c7f80a5294476449a0bc2d6aa59b2497dc86f1d7c0b414fe0b5defabc0e74f6f

SHA512
05e6350658aa5fdf7aa3efd233ab2286795586ab08e42bd814ba7f13c28bebcd87af2111084f54459a92b9c0792d7a6467097a09b8e84171ffc4da0b8d90a488

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\prefs.js

Filesize
7KB

MD5
a1068a27c71feeca604768bc5d52395d

SHA1
3dc1474f2c097af3ca61243de974bcf02f4f26de

SHA256
30ceccb038d1e442b0dbe12f086c23529d0104a707a2983784dfc7cb6847cf2a

SHA512
ad53fc44796ed3157669f540987f8cdfe6d927e2febc53cf1ce356c381765f9e3b7f721e9a4d1c32527c9350ca60785834097707c2075ad02f10b5589220a83a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\protections.sqlite

Filesize
64KB

MD5
4dc8479224410a964fcc7226e43b2d24

SHA1
eb170e3a4aea4022de266e6eeb76ed72d3bcdd73

SHA256
5cc787bbb0151471c3c11f69478aa4e37af09dc30a136a618e97f8663611ef2b

SHA512
7d6859c6bd278cb57bf144515b99b349a6dfe39073fb2807bbd6897eed6df68424574cccabea3c0707b47d00a31c4c700e07dd7bb101ca7729ad3cfd2b08c069

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\search.json.mozlz4

Filesize
2KB

MD5
48450034d91df9d004abf0611876ec37

SHA1
d94a8f5d6700803c66af887bff256b54b56af0ab

SHA256
9367e0a001d25567bb718f388bcdd21661fb340508dab77360e86b704f92c809

SHA512
11ea9019041d1178259f6c2f0e78fb3d2b8204f1e20a54a5b652c5a3509ccbbaee27aa1ca298d8cb05baaad1e7ef58534ae78bffeb635782d9fa267d005309f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
2d5247722926996a15dc5803695ec58e

SHA1
b85d700a9f86a2508a20b85eb981478968a5ff86

SHA256
e748ae4db1623f9371816d9d1a1d146d6663d5dc5e938f229570a6b82149e9c1

SHA512
ffaf1198c1be5c4b3c2b3a7a2f89f71dcb47ed8f7d8de3366a2b151a5888c9102a9ccc01d18e8202b87fab533ffe20b8ac24be1db9834e4d0c81ad9622ee766a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
72KB

MD5
72ac0242e71d628d409005b9a32ce9f9

SHA1
07b9cc9d78df36e0c9d89a6ad3bd7c0e239eb777

SHA256
6bcb6bf4a85c9ba497e96fc9cbeeb1e2fc04d80d907c00bad8d2ee752f1f049b

SHA512
a99d135f440925fec5fbb037ead719f2d261150223e1efeb825342f8ab8c1cd322993dfa0431c6041114722537fe70fe448830c708afbe0d729e8ef57b006795

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.1MB

MD5
739003759e50bde4e23b81047167ba11

SHA1
bf2e3859af766a9f492adbda77652b1209b4de42

SHA256
412a019fad60a35beee84a6597df6ec1e5392da071ca04ce97a6a23e7af641ad

SHA512
ad1af7c8d17328c41d06301010caf30572c3daffdbc1fe22a018762c0d509c9f143cc767065915f78a33a593735ec2597ea36560ca1b2d194e571fdcf5b22c1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\webappsstore.sqlite

Filesize
96KB

MD5
8336e4267720f9971f2c369031c67be3

SHA1
eac677711d1348f1d644c8b72d13438fac3ee0a1

SHA256
32e807f99615ed670ade4b35c9778ee2f3a501506a387c35b635c9d9b680c70e

SHA512
7cd5720230ba528ada86416dee933b6e4821bdb372912dec0ac90be6dcb069b17bbff5c8147bb9a97846416cc91432434e5806fe504b014c83afad35f8c47bac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6wx89zth.default-release\xulstore.json

Filesize
141B

MD5
fcc0a4014782f3927e71baeddd2dfe68

SHA1
af19885e5f719a6485066c6317361c6858d70fe4

SHA256
a4e0791db84036961904babe1a29dcf3698bdcd8b92389dda01c699f2ee52ecd

SHA512
338fbd72c9c4e657feb9ae548601e1bd1da1c4e1ec9b7e475b34fec1feace6af6161404cc91a2babe8d6aa758a460975d859d92915d6297f48e866a5653acbc8

Download Submit
C:\Users\Admin\Downloads\Xyeta.exe

Filesize
84KB

MD5
9d15a3b314600b4c08682b0202700ee7

SHA1
208e79cdb96328d5929248bb8a4dd622cf0684d1

SHA256
3ab3833e31e4083026421c641304369acfd31b957b78af81f3c6ef4968ef0e15

SHA512
9916397b782aaafa68eb6a781ea9a0db27f914035dd586142c818ccbd7e69036896767bedba97489d5100de262a554cf14bcdf4a24edda2c5d37217b265398d3

Download Submit
C:\Users\Admin\Downloads\Xyeta.exe

Filesize
84KB

MD5
9d15a3b314600b4c08682b0202700ee7

SHA1
208e79cdb96328d5929248bb8a4dd622cf0684d1

SHA256
3ab3833e31e4083026421c641304369acfd31b957b78af81f3c6ef4968ef0e15

SHA512
9916397b782aaafa68eb6a781ea9a0db27f914035dd586142c818ccbd7e69036896767bedba97489d5100de262a554cf14bcdf4a24edda2c5d37217b265398d3

Download Submit
C:\Users\Admin\Downloads\Xyeta.exe

Filesize
84KB

MD5
9d15a3b314600b4c08682b0202700ee7

SHA1
208e79cdb96328d5929248bb8a4dd622cf0684d1

SHA256
3ab3833e31e4083026421c641304369acfd31b957b78af81f3c6ef4968ef0e15

SHA512
9916397b782aaafa68eb6a781ea9a0db27f914035dd586142c818ccbd7e69036896767bedba97489d5100de262a554cf14bcdf4a24edda2c5d37217b265398d3

Download Submit
memory/3880-137-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4052-207-0x00007FFD68E90000-0x00007FFD69951000-memory.dmp

Filesize
10.8MB

Download
memory/4052-205-0x00007FFD68E90000-0x00007FFD69951000-memory.dmp

Filesize
10.8MB

Download
memory/4052-204-0x0000000000790000-0x000000000079C000-memory.dmp

Filesize
48KB

Download
memory/4492-201-0x00000000051F0000-0x00000000051FA000-memory.dmp

Filesize
40KB

Download
memory/4560-206-0x00007FFD68E90000-0x00007FFD69951000-memory.dmp

Filesize
10.8MB

Download
memory/4560-208-0x00007FFD68E90000-0x00007FFD69951000-memory.dmp

Filesize
10.8MB

Download
memory/4624-139-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4904-132-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4904-133-0x0000000000B70000-0x0000000000B73000-memory.dmp

Filesize
12KB

Download
memory/4904-134-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/5068-200-0x0000000005180000-0x0000000005212000-memory.dmp

Filesize
584KB

Download
memory/5068-199-0x0000000004BD0000-0x0000000005174000-memory.dmp

Filesize
5.6MB

Download