hxxp://bhd-prestamos[.]web[.]app

Analysis

max time kernel
288s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2023, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bhd-prestamos.web.app

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EE93609C-2EF3-4BC5-82B3-394BA4B54651}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5D64B882-CA28-49AA-89A1-42AE6D815BA8}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2BB873C2-A983-4E87-B464-D17E7176CEB5}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{272C269A-B831-481A-98A8-17C9EBEE57BD}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EBA2F93F-70BF-4301-BC50-0D0E08387DC3}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A110A313-C33B-4B3A-B0F7-4EEC97B80AC9}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{580F3044-D584-4AA8-8B58-3C2D6C2123BF}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{AF22A069-9722-453B-9CD5-440C04F5C88D}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	SnippingTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	SnippingTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	SnippingTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2532	SnippingTool.exe
4908	firefox.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe
Token: SeDebugPrivilege	4908	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
2532	SnippingTool.exe
2532	SnippingTool.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe
4908	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4968 wrote to memory of 4908	4968	firefox.exe	84
PID 4908 wrote to memory of 4748	4908	firefox.exe	85
PID 4908 wrote to memory of 4748	4908	firefox.exe	85
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4256	4908	firefox.exe	86
PID 4908 wrote to memory of 4100	4908	firefox.exe	87
PID 4908 wrote to memory of 4100	4908	firefox.exe	87
PID 4908 wrote to memory of 4100	4908	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" http://bhd-prestamos.web.app
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" http://bhd-prestamos.web.app
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.0.677390137\224605071" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3dce6363-2d90-4d3c-a099-3f35bd5be7d3} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 1932 2aa2a416558 gpu
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.1.1921264051\808247160" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64716482-18db-426d-822f-f8e106313872} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 2440 2aa2893c858 socket
    3⤵
    PID:4256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.2.176539641\668737066" -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 3236 -prefsLen 21789 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {505f4666-ff80-4a35-9978-90f3fea97640} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 2988 2aa2d231558 tab
    3⤵
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.3.2051386184\1146846417" -childID 2 -isForBrowser -prefsHandle 4028 -prefMapHandle 4024 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bc87d02-2fe3-4f17-b9f7-e70bd055721d} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 4040 2aa1c45c758 tab
    3⤵
    PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.4.112529191\1707789217" -childID 3 -isForBrowser -prefsHandle 4740 -prefMapHandle 4760 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f57a0df-07df-4b9b-947b-418a58961c31} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 4768 2aa2f982258 tab
    3⤵
    PID:492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.5.1781088625\2022652670" -childID 4 -isForBrowser -prefsHandle 5032 -prefMapHandle 5028 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dcba24c-baa2-45fc-b5d8-2fdc41a7b4e5} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 5040 2aa2fc8fb58 tab
    3⤵
    PID:3196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.7.1230452294\149821267" -childID 6 -isForBrowser -prefsHandle 5372 -prefMapHandle 5376 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c700e6e-7e4d-4281-acda-c322fba2fd9b} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 5364 2aa3013be58 tab
    3⤵
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.6.532986484\604639749" -childID 5 -isForBrowser -prefsHandle 5048 -prefMapHandle 5160 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fb20900-f4d7-457b-b1d8-7dd07ebb0aa3} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 5040 2aa3013b858 tab
    3⤵
    PID:400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.8.1265562501\1707391452" -childID 7 -isForBrowser -prefsHandle 4924 -prefMapHandle 5592 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc40fe14-a4e5-4201-a532-3c34d1b28fa3} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 3000 2aa2d260158 tab
    3⤵
    PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.9.935155513\2090516241" -childID 8 -isForBrowser -prefsHandle 3108 -prefMapHandle 3068 -prefsLen 30386 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbfb3f40-00cd-4399-a25b-c5bf84138b3d} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 5828 2aa2c1e4258 tab
    3⤵
    PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4908.10.363488436\1062478705" -childID 9 -isForBrowser -prefsHandle 6964 -prefMapHandle 6968 -prefsLen 30395 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ac72410-f627-4bcd-8332-6b952e46281b} 4908 "\\.\pipe\gecko-crash-server-pipe.4908" 6948 2aa349f8958 tab
    3⤵
    PID:5396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:5368

C:\Windows\system32\SnippingTool.exe
"C:\Windows\system32\SnippingTool.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
7600c462c42aecf7b0b06d8b3392ed0c

SHA1
926e6d80c8b37bf7ab4040b99422ec5dca1ebbe6

SHA256
c03ad7c39297ae0952fb8387c347a628c70cf742b3db5d732b17c6ea8d2feefe

SHA512
d22bc2466eb29ff368b756de23a62c4d2e8397058aec5633067e3640a0728778150f107fd56a81b94beed572f4c6d5de6eb82877c5264039ccf01e765ebf9ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
7600c462c42aecf7b0b06d8b3392ed0c

SHA1
926e6d80c8b37bf7ab4040b99422ec5dca1ebbe6

SHA256
c03ad7c39297ae0952fb8387c347a628c70cf742b3db5d732b17c6ea8d2feefe

SHA512
d22bc2466eb29ff368b756de23a62c4d2e8397058aec5633067e3640a0728778150f107fd56a81b94beed572f4c6d5de6eb82877c5264039ccf01e765ebf9ab2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\activity-stream.discovery_stream.json.tmp

Filesize
153KB

MD5
02d188619b02bcabc736fe505d3b36d5

SHA1
2ff5fe11596a6055701d313dd7d0f6caea35c882

SHA256
83b22b7414d854e64c4adfc464963cd1b286020d4cb291609fd740efcf907ae4

SHA512
16de25ab6d35975295e92f679e049f8c1cd336aa84e6fb75c8287a682a1b85770667eba37c4b73321d5d60d57ac5b5e2720d786ae4c4e287ff1555c008e1596f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yndo74ei.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0

Filesize
14KB

MD5
60301788e3210cb9db7c5c3afe9598e8

SHA1
4a5e0e95ca6ade808a3243c162b7ebc568063633

SHA256
b49635782e2b25aaac6f4ed861d921653a0c4cd38154c90b4e20bb847489b4aa

SHA512
cacc64334885c813d00f59eeb9e43636f6f6229887fe95beaa02ba4627f0b9f15e0995cba5f0b9843ce726de0047548dad35d0a6a217aaca2ee46eec53390b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
748537376551931798293d4ccafa6c57

SHA1
dae6e246caa0aa545cf7e75ffb34c1405b97c091

SHA256
49d89a0c213217ad1e9f83f7cb05c11668e36c733ac6580130e4f7c24bc580b3

SHA512
0924f9c95aa3480481f8aea7007d94539f3e12b961b9955cae604b2224ff9ebab9b6d9dc7f757ec4e3672753ec40b0b7aa54ed1a7bfd16246d9342e4dd133ba5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
8KB

MD5
587e22b94ece3f8fdf330cc51e25c1eb

SHA1
fa9961c0edc2918bde6fd21380a12211265e9259

SHA256
8a7429bc518e60adc716c4823544d1e42b1b7350752a607ea705262c0cabe547

SHA512
0c75ae56d904805b478f0f7814364f309898bcac8dc16bea3befd365dc49abf1fcd9a7e38747e09a48db7e0f654db722412e553c94fbf8f8490f24bdc621f042

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\prefs-1.js

Filesize
10KB

MD5
8980df5b33902e7e1bdf0cd6ef1ae0aa

SHA1
4fb46e25d3faf42fdebe7a30e3127b4fb66d48a8

SHA256
a6aeee748e35b551bc3a5194bd7e22a6614264ba29f0d20732031f96ef219775

SHA512
4f5a13630a52fd9bc256dd8a02ab0f8b27c41b4769f8a733e2eef413bfb82deeac9d3eda4afa3860c8850709469ab98b1828b6ab596d8531dd1d3ff6636f2dbd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\prefs-1.js

Filesize
7KB

MD5
f0f4f05528aa8f241c88cd7032cc5ec8

SHA1
7251f6649fcdedc9de59011225bb1e25657f3333

SHA256
7cf4a031ad328b9889a7e5d98d7058153215a5365a5f386b3325e441d2ac1c3b

SHA512
4007d82135b61874aeee349bfc55515dd76e21be58ab61c0ca1775f95539c7d97f1bd23873c954b42f75c621647cfcfed01b11696ca80c26148b1d545881b9ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\prefs-1.js

Filesize
8KB

MD5
386669c700ce8cb555ce98d88693c662

SHA1
0eb9bc34d1e5fd3950240c07a4c272ba73408b1d

SHA256
12752096e2352a5fda28100de8e5671d6885765fbd213115000656fe92944f8c

SHA512
7cc5b660e551148625193921ae3a0fcd012f38047eb106bc68f255b7c38c305a5535874a1a90f6b0601ea1b4f786f30b9f24c68c37f1b42cdb3b3e4e28852f65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\prefs-1.js

Filesize
6KB

MD5
5092c9b252dd8588f42fff6db840c679

SHA1
6c09d41ec3e8ba43a2abed6ee36013c992d72b8a

SHA256
792aade0affc42e0e64466b8689d6cf45727db15bcf6d307d39ee000b6cd33d3

SHA512
e82194dcfd9826811596c1f59e3563a2eb1b1f3ebcb544680dcac908294002dffbd61bda0a780c7706ad21fd001fee9fd7263d6c92cd184e5e05c101c4e08e4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
3e510cf7d6572023981bf0b7712f8dca

SHA1
8b0e04db5b750355ef79af79261b4085d321e84e

SHA256
57db1ec49cc2f50c9d49a010d88bf973ef347da4f9c99d4f6a582be94b21a586

SHA512
e265b79787adfe4f51c987ef18b329e328fee55539455f30c7693b9e5d19f94628ffc05ec40a2288e1c4fa0e5583bbfb839c2fe245540c1653b665accfbfabdf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
6cf32ad44e3ea279fa2e7e416f2a61d8

SHA1
db57aa308a5e6fba77224e025366c6756f1198f4

SHA256
4eba76b862fc3af6c44df755cd1cc6086056c0b833979c81296e233d0082278d

SHA512
a30079f54c90c7520822337adaa6e398233e2b2d7770bcd7243f821a9553b090fec40f77314a1171b1b3563929baf9458c10339744894ddc3bee7f563a5ba60e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
c0d5ab90676b693bc7d7b7eba3ff59ce

SHA1
07aaaa3b8b993e9a9fd8f8bb3b2d4ae0a78a9480

SHA256
6433621b9ddf5d06675f34f226466963209184b420d2033d3cb8249bcfe514e0

SHA512
2813400ff3a624fd9ba18a731d9e254bfa0309045b2fb10228a551ac433ac5256e88ab0553a5edd6c43d4bc1c146e97317647c14ed935e3904a34bc6e735a84a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
7196f6fea4b2bf1702717d2ecfa4ee07

SHA1
7eb2013c413d9189731a5695a6c116c2394e46fb

SHA256
33be2dee5bf14e5324370766c3aa34f0122ba97d5ba2fbc996ed4adf637d9500

SHA512
34cf3b0006ce7fc25847d9aa4d9c9051935409c29f24e16138649b7bb705f8ccb0652744004d8056b35081e4d04717a5b5dd037c0ccc33f4cd83fb406b25ca21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
683947bde6867b99e4788abc1b64e4fc

SHA1
72cbc7b821271418f678fd8cff69ebd2178fa7c1

SHA256
1eb7f0d32b0fa7a398beaba1d92e87980e185736f25cfd41e54fa10cb41df456

SHA512
2f25081f85d5a866f5774f69abd8cb4d47dffa90dc57ce4ad4bae096587b819c284e3c8c154bd71e9ab0282719ac2dd9bf54ff5a2f5e9efda91495e7c362aa20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
0b6fb25b9957af5c240cf1c7e540de67

SHA1
b6f0af22779ce41a8a29fa9f01e50ab20250043a

SHA256
18b0b648b74f9b16ae8e488ba4e2fbab2f943123ffaa3d0d795693798aa41b42

SHA512
04bd1e6159457dd5b11d1930cdf307c0e70499562bcaef323c38bd8a64f38b3f168d5ec2c1fb0dc36fa166abd220b22aee4b7122c09610d033eeedcf3bfddb0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
da54fa20895d945dd58af0f6b6130782

SHA1
191fb0967bbde146c1ed61618fcd89e0b8ad9491

SHA256
820e4324243f01b86ad853f867fe030e207dd097ca8395b4546ec3c567fac933

SHA512
31dffd8af79b06baff529c43872ab0ab1e9b656aacec098fa6330ba206e4f9e46f40958ef57f0f07fcb7efc97aeb8b4b782fb9dfdb1e3030dfc60f5f4d0bda4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
20050b6f268d296ade01b3e8649a645c

SHA1
8c8726d1b22c3b1c76e9e3aaffa2ae9007443893

SHA256
e6ebaa354787eaf0ae0bc70c0aa7a069f38aa8faf29bde285676e22e82f48d54

SHA512
5702b0155ad77d7adbfeedc2019642f2ca372ebea6ababdd4bf7627991dea0b2f3a0b49cf04511ca119519ddecfc121abe199976ae4c08c26159ac30f246129d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
e1a21168908a9963fe9ff8acb11d5e6e

SHA1
652caff9113cba2469ee42d446fe60093bc2e9e2

SHA256
70fdefd828fc8bf3440fb3326de576569cfda1b74c53b4369e69e4578aa53f4f

SHA512
4f18944e8d2bb8e3739b77f7564bf0a56baeb1f1de99dfb793a15129bc213801572b0bc0d9daac956c25f5db709751d3f46243235697deea81799837101ace70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
d4c411a0ba8199926a794328bdd9b1a9

SHA1
76fed0704869019da7018f8c84a4ee03bd6dce63

SHA256
34787b3d140fe83607ad3063b7a4b625f9464925f35b5e77b4e6191857aa3a23

SHA512
aa0c8f3a54d83f00d22e613f6ca394fc52ae01a89bd4d4af6ef4fe8c01105431d689ffaa88ae276d3edd19b8fdedf521f6fd510628520849a8eade9c7830309b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
ddc6f1587543ad0ae4e75d979cc728c2

SHA1
d57f83bb53cc99f909dc020a4024a6f79b7c0d42

SHA256
d9ba5d94e505cf173f477737fa007c037685bfd58d9181189641bc3b97643c86

SHA512
2e7a11463d41687b863416cad3ea58a05c3b9b06ad1ce939a20238120e58bdaaaf362a270a46c45526b3f3e3457c39ff57e6945e835feb8ca32dbdadd1d3e164

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
7509adbaf6ef70dc49220b7990870093

SHA1
e96d38fcf38472a1fabe63110e22bb790075eb42

SHA256
e09dba2ea0601625496f433595035d5fe17da8dee3e58c72c459796b6aceffa2

SHA512
be8ee851c76f7e0edae5926ec0627ad5ca4667f2245ec97b47930611ae0c35e09aa2c6fb92eba58132e7d8bdfe4f9223af05dce47b4c905903c245830c59d07c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
4689d23ad2fa82054724d6a4a6e9fa5b

SHA1
130d7542ac556b9cf847ea1d85b5ebd90b2c57f3

SHA256
440e893167d15e58699702d2c5fe52141e6ed91f26f167008b71a5b8d446c95b

SHA512
c6cb85a016e28280444ba217a2f6e4d040eca076dcb0e0aca401293d55714caf87b1882fce9471d85a0dd8b20a3edc93dc7ea95c1cd92fdf32ebfbf86497bcc2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
ae1448d3b3c96f50f183e592811ee8fb

SHA1
60196af78e22c67ba00c66fd12f7ae91923718f7

SHA256
d9d6a8959de38421c28473350a6628bb061190bffc571e59f016422bed28d1f5

SHA512
618b23fab5225f1a2c17878430d6eda14ef439676134d0f2f49a55b5926a1c52505e4f7ea14f96f4788bc8894ec019dd0368b174f7af5d9343eef2593f4f7c57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d4931488f5e0fb59721aaec427da25b3

SHA1
20e370e0c379c9baac04a05500eb631d6be27fd5

SHA256
4c6be6865b3f6e701309c57e0e386be013a66cfa417a12b84d7a1778ae7b8e66

SHA512
fe2c47e906f1c69599eb49891f6d5e2ad854727afa8c27680dd83ca8f45d6d81cb7544a1cf58d052b44db4ce3e58a813c43f58592604646db15686b293827e41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
76KB

MD5
d7ce5b0bd871b403f49ab5b08661faae

SHA1
5022b0dd87ae92c50533f678c59bb8535ef5c7f0

SHA256
54c95890a782ac13272e5c9b69ee7596389998329d95b9bdab5e3e6b561777dc

SHA512
b28362489efe997b13619c21be3bf678d971d4d592783fac51630ea8b510ca108de059eef198e936d81c6e227253054a3dd07a84f482b96c59d076ef50d8aeef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\storage\default\https+++bhd-prestamos.web.app\cache\morgue\128\{21fb74f9-b86f-4fd9-8d4e-dad0a7435f80}.final

Filesize
3KB

MD5
6885dbad2c79d81799047c8c90a6571f

SHA1
35420d57e565307012ed141d08a8ea5d5e5ca9d7

SHA256
e338dab06c54526d1520dda97007fdf9ef432ed687aaa21f2cb5e5784bbfc189

SHA512
a8ad48c1afd5637a7e74ccbb41d7701f873f7adcf2f4be84a14d13f777d31119c9b96169baa01ac798e354c4d77afc4271e793cdfe65e9bc444a9e84085932a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\storage\default\https+++bhd-prestamos.web.app\cache\morgue\128\{e1ea6fd7-6c9c-4b5d-ac36-4ee339079d80}.final

Filesize
220B

MD5
24e6830b7f077c56825d2bbe9ce734e9

SHA1
dcb7df45c3bffa198bd2bd6e3973cfefdcfe6b6d

SHA256
d4792c7d1ee3fd5b8b4f64ff8595a20e3d51661567722646347f06aec4574fcb

SHA512
bead741dd8bb4ce3030ab35a3d4c474a900b5078678bb6ae607cc334342df10c5de19a5d81f97d547e18d93ec46ef2283271646c23959243de19793aedb91278

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\storage\default\https+++bhd-prestamos.web.app\cache\morgue\144\{8d0bcf38-96d6-4e65-9b2f-a1da9c806690}.final

Filesize
150B

MD5
7625718db4f2946a0726b2ceb8641b81

SHA1
68e0562b6e7175958f88c73310b3e665b9d0e648

SHA256
cd9a8052714a6e2a96f5267e1735b40a9850b94dcef90524bc2654caeb9b229f

SHA512
87e85cce6ab40bc283712180dd6ee0ca12f49aecaccec7a7c221c504992cbd4841e229a1ec02ee3ba347bfaeb3e03e0b902aa0ea689b6d9128e6f673c8897876

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\storage\default\https+++bhd-prestamos.web.app\cache\morgue\39\{397d157a-bdd5-46b7-ae9e-201abdadba27}.final

Filesize
1KB

MD5
b6664517a29eb6112abd139d29bdf39a

SHA1
b25a4e245139d6792494c591d113a931d14e5423

SHA256
a3160646e14279042187c0d8c9b2b6681f88fcb7e8bc32d7b40d60745da010df

SHA512
a4f28522cbb9d45b96f755125dc99f12c1d904bbc0ce8aa429f63b6cc21cddb8be38b1e672a180a9a3d3925346153612024b69c2c9ca70fe0058f1fd930a82f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yndo74ei.default-release\storage\default\https+++bhd-prestamos.web.app\cache\morgue\68\{06533353-0f7b-4554-a23d-96206872d244}.final

Filesize
1.1MB

MD5
3869bfeecb9c83ca1a4857a83e8e6796

SHA1
e330915ba8d4aa9eb5342688ca851906ab9a862a

SHA256
c1abd6ce802707e202a6e2551dbb9d1d5b64adef5a1107912649c4e0791f535d

SHA512
244654d0a020c70ed25ff754a832cd1da7f5b89438edf713afe97f40a6091e9b15f73ae70984d2418c2e5705fd3bd4e3fe88dce91538d71dd49bce023a84448e

Download Submit
C:\Users\Admin\Pictures\Capture.PNG

Filesize
275KB

MD5
f64735b72b2b1a5bc15d9a0d2e28713d

SHA1
a7bf3a6e5f4560734cfa9c58949b0608e8f8670a

SHA256
7ff4811b5192ca8129d35fc14653e7e97c149c4e9629e41c4ab49d6d8b7fc4dc

SHA512
6e026460355e5606355787f989437ad0b133d71253ea9c11ba4dba1112461d1fd565603430542d275a0e62d42401ef3b817d1309297e84dba025324414395a4f

Download Submit