010b6fa39f761c1444233c206b2c4434428a75ff9d0583bcb84b12e2804340db

Analysis

max time kernel
1799s
max time network
1789s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

moon.exe
Size

423KB
MD5

b1c7d8102bcab505d2fdec27282767f3
SHA1

4f3496b126eabcd57335e2a315d59bdd2e043c89
SHA256

010b6fa39f761c1444233c206b2c4434428a75ff9d0583bcb84b12e2804340db
SHA512

c1da6810dbcf11b582f80820f55279258a5779eb420ec5a19b9da04a3d90dc37febb841e50d54be55b2fc447d77fd8f775a1e6f5ac7e8e10acb35bbbf8ce6748
SSDEEP

6144:YeghbOV4Asvo/Z+wo6TmTIHnqgKIuTi5gTaWnLLDt1dbWAOaKapXFWbcFSU:YeKbOV4A3ho9IKNti5gT/wUzzWTU

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
6052	moon.exe
1880	moon.exe
5924	moon.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\moon.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	moon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	moon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	moon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31150067"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2564998304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C47D0F09-BBE6-11EF-B319-D2BD7E71DA05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0367f99f34fdb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31150067"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a78199f34fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013f787289f1be14e87be8dc204ff715d000000000200000000001066000000010000200000001cc3109632f81e5778f32495079fc18f350fea7e6ff56fbd06ec96884589dce0000000000e800000000200002000000046c265d50adb434a37804843c3944bdb9234e0b889a4c696a36f3d88620a958720000000b6f40e01668af5733a979e0cac926db07a205d52da53fb3bfc397a5113a460f2400000008729bb8e1131a7067315bf4fedb62083686a8d4ae3d85d717721df8c72bc029f777e68f008a17f84ec184738a895b21ea7177cd95c46b01bd9366c83a4fb2365	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2564998304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000013f787289f1be14e87be8dc204ff715d0000000002000000000010660000000100002000000084cb166cba61d81fd22b814fa3d8cdc0ee335a93f7d47439540b163b578aa9ae000000000e8000000002000020000000f01000864778785e631a38de70c620ed468776d2d051e6ea8de72788d45d14e820000000d50fe07d55df0c4eae2f5acdc598a2869426b19ea40875fcf2573630c4ffc1c840000000b7d1f465a90436b79137273813a1fefdba6c5cd67ee2c56522756e121de5fa6519081c3e47f855bde9976667433c9e140baa1a767a22d0345365414049bef7a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\moon.exe:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2916	moon.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe
Token: SeDebugPrivilege	3068	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3432	iexplore.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3068	firefox.exe
3432	iexplore.exe
3432	iexplore.exe
4948	IEXPLORE.EXE
4948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 1100 wrote to memory of 3068	1100	firefox.exe	109
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5036	3068	firefox.exe	110
PID 3068 wrote to memory of 5064	3068	firefox.exe	111
PID 3068 wrote to memory of 5064	3068	firefox.exe	111
PID 3068 wrote to memory of 5064	3068	firefox.exe	111
PID 3068 wrote to memory of 5064	3068	firefox.exe	111
PID 3068 wrote to memory of 5064	3068	firefox.exe	111
PID 3068 wrote to memory of 5064	3068	firefox.exe	111
PID 3068 wrote to memory of 5064	3068	firefox.exe	111
PID 3068 wrote to memory of 5064	3068	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\moon.exe
"C:\Users\Admin\AppData\Local\Temp\moon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1148

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {876aea89-5187-42ed-8717-e2387119fe2e} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" gpu
    3⤵
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82c2d386-e241-4860-94ca-5d5b9306d4d5} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" socket
    3⤵
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3136 -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 3196 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49a59c75-b223-4ebd-a2ad-bc2315ac64ec} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:3496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4052 -childID 2 -isForBrowser -prefsHandle 4040 -prefMapHandle 4036 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60c953b2-1d3a-4d8c-88a2-9d3897811df0} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4752 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4808 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40ba2935-1d68-4a68-8d83-315d7546b636} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" utility
    3⤵
    - Checks processor information in registry
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5204 -childID 3 -isForBrowser -prefsHandle 5196 -prefMapHandle 4776 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3a93c1e-78cc-4185-9daa-a16f225f1066} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:5692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 4 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6671369-5bc8-424d-bef9-7cd1f0af33fd} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 5 -isForBrowser -prefsHandle 5620 -prefMapHandle 5616 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ff3259c-273e-493a-a5a0-4bb3b498e3cc} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:5716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2628 -childID 6 -isForBrowser -prefsHandle 4372 -prefMapHandle 3512 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a64c510c-b03e-4077-9e12-a5badfed68c0} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6276 -childID 7 -isForBrowser -prefsHandle 6320 -prefMapHandle 6216 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0dc9895f-ac85-470c-9d2e-4b0b6fe81881} 3068 "\\.\pipe\gecko-crash-server-pipe.3068" tab
    3⤵
    PID:3628

C:\Users\Admin\Downloads\moon.exe
"C:\Users\Admin\Downloads\moon.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6052

C:\Users\Admin\Downloads\moon.exe
"C:\Users\Admin\Downloads\moon.exe"
1⤵
- Executes dropped EXE
PID:1880

C:\Users\Admin\Downloads\moon.exe
"C:\Users\Admin\Downloads\moon.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:3964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\EnterSend.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3432 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
7b7a53f2ea45dee9acfe1adc9014e324

SHA1
ecb3fae44917a9687c3c2a483ce97417c3a49639

SHA256
315d05edfb3320f83cf57df558f2c5fd21c95b3a2b4861342a3fcb8aa3d78dad

SHA512
1eb1da94cbb45b6432ea06a5cd6681b0670c4892c044163a04afcb710a5bc437f45cb381d496e400721bdede8db42babfce623c8a345cffae808e4b190702ac8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\7B3517DD0088CB493E43CA8924C574A4EB6AFD11

Filesize
12KB

MD5
4cbed74fba1df5626898e267fa687a92

SHA1
645ceafa13366428610710672f4ae251f4d82cd0

SHA256
ed67733d25f276958e31225b9f2a3e8561a74b493a8b68b73f0b3e96cf47d7c4

SHA512
717ba15f623ee1b5e24368c5b19eb8a1aa0f3f5f6659a904b49f3be4c163adead85e3e6a94d84c08f87d269b37a4d0fa57de4bd6885f2ec4aec3aebcebc2dc1d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\7B3517DD0088CB493E43CA8924C574A4EB6AFD11

Filesize
12KB

MD5
cc9c5a3b5e995de98641bb337236f7d2

SHA1
f09b2d3df01807a83110c7278c21b026aca9d679

SHA256
e07be85ef6298c1532af12f629149222c19deb4d1dd9b6d699b5a0bc9510c89b

SHA512
d5cff7a8f3d0126eba69dfd70aa206fea37aef681c0ae03e13775ee09e4043a7a96cb3562d40b344722f340cfa85283dce5c1408941a2eec4c7f5b382eee8395

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\967478B2C844BEE01C54A408349E8370781EDA3E

Filesize
56KB

MD5
f6af3eb6b04d1f439c387b0d8e3d943f

SHA1
8d2b8d8929dec4a59bf516732e9a9ac51b876782

SHA256
d27d2540a89cf900204d34d843d516034454f998199ef00e9918ceba1e541abc

SHA512
b72bb40209e8a4f3cdbff1b87a3361f9582dcfc088824234f1fafe72261692caca7a1b26b8ba4192dc745bf657cb08915cd0b9e374d2eecb3880af59a141cd1d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q346521PUSHZHHY37BFN.temp

Filesize
9KB

MD5
b57d81a7df9437acaa673a1f03a07ae7

SHA1
6338c9de67b82efe538105271d0d8dcb34c2d96b

SHA256
2fc95dc2c23cac4883b335f19b4d9cd402cb34359b7851edcdb5ccf3dd6e15e6

SHA512
9e4935538369629e4d729d75319b6454585ef09e9805697a90ae6bab1dffed8ba8991814d37ebe1b4b5d602689931a207015590ebc8ae17ce3bc08ca52ef8df2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
6KB

MD5
2db5cc39b5791f4d6ac01db30bfd76af

SHA1
eea4bc694049cd2675c194d04a232250d10c203d

SHA256
21d1515ff9a511c0b13b1baa2f2ed393b51c32e1984697c7a605141c9d5f5c55

SHA512
878f839f48991012eee30c7bb5c8b63153fabfd89b9140cb40f64304611ef566bd8a58db94ab63f6a442faa88f6ca5588401eb09d90cc58d04dc89397f5f41ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
8KB

MD5
60a40eddc321c4dffa69fe165b9b2200

SHA1
6fae6cdcc844cdfe5dcee5cd7eb3dda12bef848f

SHA256
dd5f7b308f8aedb83c36dd283ced113437678b1b8615cc70ce85b6029f12a641

SHA512
4a9fe347574bc267aea42440777cfb70145c914424c920286b1b98f0e3281df26f1829b2026b522529de1f47313991cb6cdad75ebc28b82867f1a3706c94e841

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
11KB

MD5
532c208a451cce82d6fe447b1e207f03

SHA1
4ac807317574bc9f99975ae23f6f377733578271

SHA256
1bda575b3c53e5726141e2e0d6ac610e14e740a79c1021cfebe14da8d90b8dbc

SHA512
ad9ca511c91eddc47fee56a57bbd0c84c09672fd34b7767ebe581cb31f672029be7f34c6b00365fd81fb5b59cda2c38a95510b27fefb7b03b803bb58cf42d57c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
11KB

MD5
1d868ce9a9d38d609c62f56d5830e2cd

SHA1
a052ba326d9deec09b6a03cc51fc7c9bad6f618e

SHA256
d69fc6679c0e3cda94fa2f3b53b1713ae9d50799ca1fcf5633005cf7577f62c0

SHA512
035e60b0b8912f379bbb52933a1ed992c05126e1b6a9ae88067b6cd91fe33460df90e42cf9d8eff2eeafa0769f61db44a8395a80218ebb758a6642a7746c1522

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\bookmarkbackups\bookmarks-2024-12-16_11_0dYJilnRbTPf8ChZMtb1FQ==.jsonlz4

Filesize
1005B

MD5
336df4886474cd5ec4a4eb3a44da6dda

SHA1
ec52bf0091ce5b0df4c1ebe5ab5b465d82c49281

SHA256
8c1c352caceb2738dd16ab151a5dbd7c3521613a243ce4cbc2d7292321c26e16

SHA512
20a9590db6267c5f74993d9339526345c2b113b31cb2fd9ad98ec448c7501dc6eaec7e5f811c6ab24e08b61353f636d99734960df8bd862088eba4e1ded4ce75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
7f9d789f749185a5495e6664d58adf96

SHA1
9cc07825580bc3d44548f83a43594d9080a5cbef

SHA256
341e5b0a6ec9adf6aefe864e983f179a611f9e562b081c41f64785be742a0b90

SHA512
ac766c23903bfcc35c66870cc257fef5bbe7f596a3b0b133bd12f7375f1d57dfaa1a759215aea81a4abfb87a02193f57aefbbf77d204b08bc0f99abcb0a47978

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
36KB

MD5
1a8dd11ebbb558f584b91f2ed0b74e88

SHA1
536fd374e47eb0a2ee1c44f053c3840a95ee2c35

SHA256
5a1f4352d9cefb7948cee576fa7c130748c39647a00612737171c69065da6859

SHA512
dd77345f858b8522960642358a1e08e02c297e7d1372bc095b84091567f295c42370bf9d7a7ef76a2908bbbb6320270d745a930ebe5d3802af3f316561da086a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\1a6c9faa-eb4c-4a10-b623-dd1b8a7502ca

Filesize
671B

MD5
0c2def992c7090c825727f69e856cd01

SHA1
a89a8bfd8f81489c36f7348c4720882e37ef1be5

SHA256
cbefd3542401be56183faf2ec4da5a838974b0adeb1a30d5bbc443a3e98b3af6

SHA512
bd4f487dfd24a00f53c3b824cd9460b91261179559dcf99383104061b104368e64979c5c5adfc7081512cb3d0c54afc51cdbcfd2656505396f9c8cfaae178824

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\83477125-9175-4efb-8db2-b57ba98bd73d

Filesize
982B

MD5
c8c9e44b24d76de04fae38c238919ee3

SHA1
287930ad606a86a46b0761d3acd0abbd450871b5

SHA256
d91b7b5a4aacb961d3903b1386f6f63a15f39d68b81c979015a62619ca2b6eac

SHA512
50675a872a04c6ecc36de76d737fc9f7e96e292de2a3f6033e65b3897e4a3de26a83cd8a428edb39f6dcfde64e720d2596ab8ca32d6ec596d2363d55053d2e01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\bdb98460-677f-4f23-97f8-f4faba45b867

Filesize
26KB

MD5
eb5e912b8c0c24d48696292eec8891e6

SHA1
849c35038d53af3aee0dce92aa0e0d247836aad0

SHA256
ca802802527a41b2505eae7652d597da0b5f75034733a02c44b8971815d6db4f

SHA512
00d2bd16d9917f4f6595301ee73101068b45fcc5a66b76907b4a8178b073714208064f62ffd0de93ffd3e88bea3ecda09025d8aa63490569ce6df3c739ed06d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
11KB

MD5
7d0d1e3721152d7772ae09a7296cbd8c

SHA1
8e0de15394085c6f38fc28b517b0d6508e4b1e1e

SHA256
8e96314950578f1f1e175806630a184eadc8b9f990c7a8b1d299a606eb4a3185

SHA512
63699933e5a3179d732b561ebbab01b9e406ad81a647adf94d29b61110b63619904e7db01dfa6ae1ded3162b653f5a3ec9c59cdb99236bb0ba7bb28d9d5407a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
12KB

MD5
bb30e6c1c3a57811eccffe03e231e22b

SHA1
3565c1042c6155382bb9ab66406d638282bc8d07

SHA256
73c4ca97032930e99ab8d0dbf1933aad669bba770b7443722639635a2b2c91ba

SHA512
c7ccce2aef8c3e7a1e688b194ea2e2eddf45f5504445c736ccaf3e3bac71de1d144de1372149112f371fc9e9b33c3f0e2f9e07cb6574f601fbe519c9c7bc00d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
10KB

MD5
f2f0cef29a0a0a9c042bef354fdb4ba7

SHA1
cde3f4e6be8e7450d62ef2881b6b93e36612c012

SHA256
6ee5084521ab2551dea49b2bb3012ba92ba980339ad783868c257d3c67882daa

SHA512
9bd6b827aaccdb44a44806da2908289af070e5d82d5a1f81cdff453e7eda66a66601395fb61b7c81f8af7cac2e326e52e7cfcfd652b4d34dabb48de589f29fdb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
3f2efcc504908bae10fcb5b719750c46

SHA1
63265257f17b89f57c4fc8cf9642224788d9c508

SHA256
a19a9b327319beefbae4ed0fff52ceadb416e6e7bf8ffd59d83ef50a0a4cdc77

SHA512
6c0b1126e9e016e089cb81839717acd04098cf31e837ee09d0ac60e51a954aa948f1d133e6a421c4932dae3a75e561314aee16f006b9b60ecd1822de8248c2eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
a3e67ebca2a460ea400b82630544bcc0

SHA1
99fe9810863734b3009b5290a14547ddeadde827

SHA256
0346ec2a77e1ff2aa3f458cfe794318fe19bc003f7f7c82b58c983eedb7edb63

SHA512
68713ffffb591a30b8d038c682afd054e2a6f3d33ebd0a72814b628b4eda64a18a15b8f1c0746a87d923d5a9b472164df9869e0b8e7699c2f8bac7a43af8b5ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
aab4f1461c66614c1ea4eaac6d4bc7f7

SHA1
4272e898b1856625ec2cb640372246cff3e9eca5

SHA256
34589b0f400a64ec0716e50e8c2f9943762a36e1ccefdfa31483530c94debd3a

SHA512
0396918146404d77ab2f3a83709bedbdbeca6e0a3215d0b598f8d332e6b4facbdfd54b51eb866299905fed3ba521bfe2a401c386862b4d1d08fe9ff68552c7b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
79e40fed76d99ee084d42caba9515464

SHA1
ca72d14d7f1125ea8123d4de8ca397460f80df9b

SHA256
c39fb996371992dcced8221e03edc8d96b660fe9c0c66bd439674aacddd95c9a

SHA512
12245b01860ecdaa88fde30d5fbf64c0f1c7f440ee9b59ea217caa7a16621ded89eda85a4892d025896ed3f21353b08eeec826ecc25049e08d0a05cc80d39483

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
c8658d528b61ed9929394157042cb3fd

SHA1
2ec7c04b527d7548e99364cc5961a96da9e101bb

SHA256
03a2feab3cb746ef0d084cf56392ac589b2944355bd94797a7eb7953e36b06c6

SHA512
77a751113031620febe193f539f781c49d82fefb158c54c17ea7854dae12f64766edcf5af143ae48848c492c3ecc10372dc9b9865d49b45c7844b0a6ca17efcd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
600KB

MD5
fae2c17a007169d997fb5f94a6f40599

SHA1
cfae1e079c3ac592b503ced789d98031847dd24a

SHA256
7f718781e4a32884e052292deea240140507701575da8c459a2f97d6498fd241

SHA512
92a64b7aafa81f8cc01afc2960bc5c47197e3c1398bcaa65a8ef2bae8ff3bdd25fbaedbe00f1291bd4eff1b191beedf4303327334dffac7225bb65335bc8e8a2

Download Submit
C:\Users\Admin\Downloads\moon.exe

Filesize
423KB

MD5
b1c7d8102bcab505d2fdec27282767f3

SHA1
4f3496b126eabcd57335e2a315d59bdd2e043c89

SHA256
010b6fa39f761c1444233c206b2c4434428a75ff9d0583bcb84b12e2804340db

SHA512
c1da6810dbcf11b582f80820f55279258a5779eb420ec5a19b9da04a3d90dc37febb841e50d54be55b2fc447d77fd8f775a1e6f5ac7e8e10acb35bbbf8ce6748

Download Submit