7a71b69c439fefdedcd95f14b3fe30e1f0703fafbdee1bd6c9da51d2c32caae3

Analysis

user interaction
yes
max time kernel
1019s
max time network
1020s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spirit tweaks v1.exe
Size 308KB
Sample260416-mfdacacy4n
SHA256 7a71b69c439fefdedcd95f14b3fe30e1f0703fafbdee1bd6c9da51d2c32caae3
MD5 8917dc00fe5f0bf7a4f4a20fc0bddc5c
SHA1 7d38be680ed118f9537b2a573f3c6e4dcf710f06
SHA512 b299b48b2a17b50428f34e1cdd5d4dab8313885469f7dab5fa6ee40e046dc3066cf74472204a860879bc2ae6efd2f3eef762cf1fe51ef70bd43d6dc994977684
SSDEEP 6144:zBlkZvaF4NTBVyWMZc1scQyIiDXJF6JVptNAazRYI:zoSWNT7ydJYH6J7t7H
TLSH
T19F64AF290FEB895AC29219B90AF0D17EF67881401B19D763C7F42C57BF24EC8BA6C1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 4 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	api.gofile.io
18	api.gofile.io
32	api.gofile.io
62	api.gofile.io

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spirit tweaks v1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spirit tweaks v1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spirit tweaks v1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spirit tweaks v1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spirit tweaks v1.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe
Token: SeDebugPrivilege	1064	firefox.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1064	firefox.exe
1064	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe
1064	firefox.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3732	2344	Spirit tweaks v1.exe	93
PID 3732 wrote to memory of 4628	3732	cmd.exe	94
PID 3732 wrote to memory of 3912	3732	cmd.exe	95
PID 3732 wrote to memory of 216	3732	cmd.exe	96
PID 3128 wrote to memory of 1064	3128	firefox.exe	100
PID 3128 wrote to memory of 1064	3128	firefox.exe	100
PID 1064 wrote to memory of 1560	1064	firefox.exe	101
PID 1064 wrote to memory of 1560	1064	firefox.exe	101
PID 1064 wrote to memory of 1560	1064	firefox.exe	101
PID 1064 wrote to memory of 4652	1064	firefox.exe	102
PID 1064 wrote to memory of 4652	1064	firefox.exe	102
PID 1064 wrote to memory of 4652	1064	firefox.exe	102
PID 1064 wrote to memory of 4652	1064	firefox.exe	102
PID 1064 wrote to memory of 1584	1064	firefox.exe	103
PID 1064 wrote to memory of 1584	1064	firefox.exe	103
PID 1064 wrote to memory of 1584	1064	firefox.exe	103
PID 1064 wrote to memory of 1584	1064	firefox.exe	103
PID 1064 wrote to memory of 6124	1064	firefox.exe	104
PID 1064 wrote to memory of 6124	1064	firefox.exe	104
PID 1064 wrote to memory of 6124	1064	firefox.exe	104
PID 1064 wrote to memory of 5244	1064	firefox.exe	105
PID 1064 wrote to memory of 5244	1064	firefox.exe	105
PID 1064 wrote to memory of 5244	1064	firefox.exe	105
PID 1064 wrote to memory of 5244	1064	firefox.exe	105
PID 1064 wrote to memory of 2992	1064	firefox.exe	106
PID 1064 wrote to memory of 2992	1064	firefox.exe	106
PID 1064 wrote to memory of 2992	1064	firefox.exe	106
PID 1064 wrote to memory of 2992	1064	firefox.exe	106
PID 1064 wrote to memory of 2756	1064	firefox.exe	107
PID 1064 wrote to memory of 2756	1064	firefox.exe	107
PID 1064 wrote to memory of 2756	1064	firefox.exe	107
PID 1064 wrote to memory of 2756	1064	firefox.exe	107
PID 1064 wrote to memory of 964	1064	firefox.exe	108
PID 1064 wrote to memory of 964	1064	firefox.exe	108
PID 1064 wrote to memory of 964	1064	firefox.exe	108
PID 1064 wrote to memory of 964	1064	firefox.exe	108
PID 1064 wrote to memory of 5744	1064	firefox.exe	109
PID 1064 wrote to memory of 5744	1064	firefox.exe	109
PID 1064 wrote to memory of 5744	1064	firefox.exe	109
PID 1064 wrote to memory of 5744	1064	firefox.exe	109
PID 1064 wrote to memory of 828	1064	firefox.exe	110
PID 1064 wrote to memory of 828	1064	firefox.exe	110
PID 1064 wrote to memory of 828	1064	firefox.exe	110
PID 1064 wrote to memory of 828	1064	firefox.exe	110
PID 1064 wrote to memory of 5176	1064	firefox.exe	111
PID 1064 wrote to memory of 5176	1064	firefox.exe	111
PID 1064 wrote to memory of 5176	1064	firefox.exe	111
PID 1064 wrote to memory of 5176	1064	firefox.exe	111
PID 2636 wrote to memory of 1716	2636	Spirit tweaks v1.exe	118
PID 1716 wrote to memory of 3968	1716	cmd.exe	119
PID 1716 wrote to memory of 712	1716	cmd.exe	120
PID 1716 wrote to memory of 4968	1716	cmd.exe	121
PID 3392 wrote to memory of 4072	3392	Spirit tweaks v1.exe	124
PID 4072 wrote to memory of 5516	4072	cmd.exe	125
PID 4072 wrote to memory of 5876	4072	cmd.exe	126
PID 4072 wrote to memory of 4320	4072	cmd.exe	127
PID 3512 wrote to memory of 664	3512	cmd.exe	130
PID 3512 wrote to memory of 6052	3512	cmd.exe	131
PID 3512 wrote to memory of 480	3512	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe
"C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:828

C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe
"C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8A83.tmp\8A84.tmp\8A85.bat "C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4628
- - C:\Windows\system32\reg.exe
    Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
    3⤵
    - UAC bypass
    PID:3912
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
    3⤵
    PID:216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {87c04eb4-489b-408a-b155-90f591032959} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {b08f21b1-fc22-4da2-bcb3-0150a0fb7320} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27323 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {da7b9557-b8e3-480a-a317-f3bd1f2d68cc} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27323 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 3824 -initialChannelId {5712f28f-59a5-4221-9eae-550fd0e4a97d} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2916 -prefsLen 34822 -prefMapHandle 2560 -prefMapSize 270279 -jsInitHandle 2744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2548 -initialChannelId {8faf621b-25bf-40ca-8ebd-67af5267d328} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5028 -prefsLen 35010 -prefMapHandle 5032 -prefMapSize 270279 -ipcHandle 5040 -initialChannelId {e8ef4f10-732f-44eb-b4c9-01f201281489} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 33031 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {fa98ace6-7dc8-430d-b699-906b38e35b2b} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5884 -prefsLen 33031 -prefMapHandle 5888 -prefMapSize 270279 -jsInitHandle 5892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5900 -initialChannelId {78cc2603-4c6f-4e2e-be25-ea34eb3e3ca9} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6096 -prefsLen 33031 -prefMapHandle 6100 -prefMapSize 270279 -jsInitHandle 6104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6112 -initialChannelId {6174532d-b1c6-481c-8301-901a5bcb5370} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6312 -prefsLen 33071 -prefMapHandle 6316 -prefMapSize 270279 -jsInitHandle 6320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {8623b6f2-fcc2-492b-998b-6008c8a09207} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 33071 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {ae12be4f-ca4c-4813-9a07-1bf8150207be} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5176

C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe
"C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2936

C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe
"C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EEDA.tmp\EEDB.tmp\EEDC.bat "C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3968
- - C:\Windows\system32\reg.exe
    Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
    3⤵
    - UAC bypass
    PID:712
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
    3⤵
    PID:4968

C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe
"C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2E65.tmp\2E66.tmp\2E67.bat "C:\Users\Admin\AppData\Local\Temp\Spirit tweaks v1.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5516
- - C:\Windows\system32\reg.exe
    Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
    3⤵
    - UAC bypass
    PID:5876
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
    3⤵
    PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2E65.tmp\2E66.tmp\2E67.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:664
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:6052
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 01d384a2cb4366029aeec80f88b9eb0b758a0b3284df4be51de1ea02b0cff452
MD5 a448555fa93b58f57c53e36075aac67e
SHA1 9549ff1cd8d964e2c89d68c43d0bc2d7cc767377
SHA512 9a61703907c10224df7b84e5fcac70e61037718683ff130c8dd8aa573a4d7dd95a6055f3025a4a679919b15de913d75c13af93075adb92ce6b31cfe3e3a53e3f
SSDEEP 768:Dya8eDSbV9PxP3xniyMKNK0+lbUyo11R1A6LnzqKfF714Fl9OGy6p:+ajuDZ3MOK0U4yo11RFPqK9R4Fl9Fy6p
TLSH
T11E73F8A3E2A872BB1FA56BC71C0B755B52D64195F38502C9FDEEC91C80CD690023E6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 098426999760a12bf01c17cba7cf138fb73a134e423aa9366c7bb648b620928a
MD5 6a2c4b43889301b8685b34bcb16d63e1
SHA1 a194fa53d66b647ff98332bc4755ed33e9ce5286
SHA512 d32164cbd1ed844db168bb05d6457660e97037e863b96b35219d4e374ff35b66adf90c94f3b4ae7791fed0d85b37d4f37b2ba9662a7c4f25f8e1aea50f9f3a66
SSDEEP 384:HbaFrLiO024Y5Fuhw+5EL1pPsac4j0lpDII+ma5a5:7aAZY5FuK+5EB9sac4ID8L5s5
TLSH
T1FC528E7EAF0138BA1A27D2D4D8ED5218CE04E6BBEEE3D05605143845CA847B9B4F54DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_arts_and_entertainment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
Size 67KB
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915
SSDEEP 1536:X0A993SJAA1p1MxQm6UjfvidqqishTLaq/HU0Y6bxdgRYeHk2OxFW:EA993SiAv+F6UjHiddpLrAGS/GFW
TLSH
T17F63839547EF4AF1A2CEF9A40CA708936FF551F52BD2229C1BD1908897B5FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_autos_and_vehicles.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
Size 44KB
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd
SSDEEP 768:x6/Mifb8i0x9bnuv97xrsEcgcs19DSr1euz5vciyxYZlhCU:x6pfExluv9NncNsb2r1lR6YZlsU
TLSH
T1062384A2A3EF4AF292CAF5E508A70C935F7662F51BC3309C07C1558C53BDEB504D6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_beauty_and_fitness.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
Size 33KB
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c
SSDEEP 768:I+ij0TAXOc2OuXvdCDF4FmthuYb495/SvSEtEYNZQytSYfT2TDkEF4JRe9VUwCJd:I+ij0aOc21XvdQF4Fmthug495/SvSd4J
TLSH
T167F273A553EF4AF3A2CAF99448BB08D75B7501F42BD3309C0BD1954C57BDEB404E6A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_blogging_resources_and_services.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
Size 33KB
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217
SSDEEP 768:0aXqUUKuXcV9gAJYQjhAlF803mM4xRdOROo4ZParFJoLNUz73:0aXqjKuXw9gAJYQjyB3mtxRkco4Zyr37
TLSH
T18AF252A143EF4AF2A6CAFA9508B708D35B3551F52BC3319C0BD2954C57BDFB508D2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_books_and_literature.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
Size 67KB
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea
SSDEEP 1536:fFj1H+dLa2mqJTVj0+bFkXfRwVSND7uEZz6YDqa9eLGRQssw2A2:Nj1edLa2XTBnbF4fRwVSxuEzT0iRQT
TLSH
T1D463659147EF4AF1A2CAF9940C6B08976FF551F42BD2229C4BD1918897B6FB010F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_business_and_industrial.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
Size 45KB
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9
SSDEEP 768:inUsWHNnOAvkuPPu2fYAE/ecNjBr0QOdt+RbK7QvsFe1AIKlREQTLGNfGfWeISqK:inUsWHNnrvkuPPuYLE/ecNjBr0QOdt+Q
TLSH
T1E52384A143EF4AF1A2DAF9A408EB08875FF551F52BC3319C0BD1964857B9BB410F3A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_computers_and_electronics.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
Size 45KB
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8
SSDEEP 768:6aSj2tjV9bSvFczWWepPoiKLYvmt2fNjods5cstLpIscqqWPCFOAfw3yON8afnXE:6aSj2tjV9bSvFSWR6BImt2fNzcQIcRPs
TLSH
T16F23869557EF0AF2A2CAF9940CAB08979FF552F42FD3614C0BD195485BB9EF010F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_finance.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_finance.json
Size 33KB
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a
SSDEEP 768:cieaDKbQMMvEfD4vFMLKqPYE1dRDz7teb0kz3lY80:cieqKbQMMvEfD4vFeKqPYE1dpzPkblYp
TLSH
T1B6F261A543EF09F2A6CAFD9508EB08D76FB512F52BD3219C0BD1518857B8FB504F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_food_and_drink.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
Size 67KB
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263
SSDEEP 1536:bOuA7D7UEWOGEsffwBSqW1cWINNwAnnu4p2sUSDTA1hma+36t1n:vuDoEWbEJoDCNNwG1p2fSDTAne6tx
TLSH
T19D63659143EF4AB1A6CEF9940CAB0C976FF551F82BC2628D4B9191589779FB010F3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_games.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_games.json
Size 44KB
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5
SSDEEP 768:aPlZWWBHj0sWoa2JBAyMemRwoF/GgQKP2Sgj2KxpxrXDUIsJBaU5Qk0NbrkOVlxh:MnWWBD0sWN2JBqemRwoF/DQKP2Sgj2KP
TLSH
T1392343A263EF8AF292CAF5D508B708935F35A2F51FC3218C07D1554C63BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_health.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_health.json
Size 33KB
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b
SSDEEP 768:p52SrX0UfFfol2F0Qmfw28ZVV5d1kVWWuFzVS7UpLNNpfmNzp:pYSrkUfFfol2F/uw28DV5d1kV/pUttk9
TLSH
T170F273A543EF4AF2A2DAFD9808EB0C935FB512F51BD3219C0BC1558897B9FB010F6906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_hobbies_and_leisure.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
Size 67KB
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d
SSDEEP 1536:ex2J49OJ2vESNyvm4q6FZ/jrmEn8eUvQPHqbsrEyZ0FavsBiwrq:ekJ4sJ28SNOm4qK7rx8pvQPHe0E6
TLSH
T12E63429492EF0BB1B6DEF9A40CA708976EF551F92BD1328C1F819158D7B9BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_home_and_garden.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
Size 33KB
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49
SSDEEP 768:OQUamVglKm5c3LOBRdNbtgdjdKbnWX1FV61u/oj/2WWa81l:OQUHWln5c38RdNbtgdjdKbnWX1F01u/v
TLSH
T1F0F262A553EF4DF292CEF99508AB08C7AFB512F52BC3315C0BD1959C5778AB014F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_internet_and_telecom.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
Size 67KB
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c
SSDEEP 1536:inLl7pDjTv1exoCMGh8Mnv8a0Z3b73AvW/BYCxnhFGLaJbPESGccXIdJ4XG4AL25:inL5NTv19TGh8MnveZ3bcvY5fFGL0ESS
TLSH
T1D563989543EF4AF1A2CBFA940C6B08976FF551F42BD2228D0BD1955897B9FB010F2B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_jobs_and_education.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
Size 33KB
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5
SSDEEP 768:yOloEjLuudxPXz9CIwFUwl5cw5zFpyIrf2vutr:yOloEjLuud9z9CIYd8w5zOIb2vutr
TLSH
T12EF274A543EF4AF2A2CAF99408EB08D35F7112F51BD3219C0BD1558C97BDFB514E2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_law_and_government.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
Size 68KB
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5
SSDEEP 1536:IwvZ+KSd2cFmpFGB/Sp1xAi6ZxaaF/VZhuthlV2+5pFDo/z:IOgKM2cgGB6p1xAi6ZganZ0thlR5fDw
TLSH
T1FC63639543EF4AF1A2CBF9940CAB08936FF552F52BC2228D5BD191889775FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_online_communities.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_online_communities.json
Size 67KB
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd
SSDEEP 1536:ZWJiPPEIYm4hGeujuImzVLA2Y9MMZm7nS83QFDBk2BrdICjt9EyO2B+AMwt0OwDV:FnEnThGequJtvR7S8gF1k21+C/u2c34O
TLSH
T19663769143EF4AF1A3DAF9940CAB08975EF551F92FD2228D0BD1859897B5FB010F3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_people_and_society.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
Size 45KB
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02
SSDEEP 768:7xHLNYPUAcQL9/5EGy6T21Rpuhfkqxceuj/jCPUwXF5YK4otABk3MTicb3twO:7xJYRcQL9x9y6T0RpuhVxcnj/jCPlF5U
TLSH
T1C22331A267EF8AF292CAF59508B708D39F3552F52BC3318C0BD2454C57BDEB504DAA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_pets_and_animals.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
Size 44KB
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c
SSDEEP 768:FLu2LJObDMMGynnlGGRgS3c95S6uqs8hbiiAUU+GFs8XAxr18+to4rN7:FLu2LgfMMGynlGGWS3S5S6uqs8diBUUE
TLSH
T1BB235192A3EF8AB292CAF5D908A70CD35F3592F51BC3308C07D2554C57BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_real_estate.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_real_estate.json
Size 67KB
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd
SSDEEP 1536:1HbzBc8oBPUqosGZzqWnp2HGmj2oEVK2rQoe4my08:pX3oBPlGdqWnp2H1j2okJU8
TLSH
T13F63859153EF4AF1A2CAF9940CAB08936FF551F92BD2328C1B9585989775FB010F3E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_reference.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_reference.json
Size 56KB
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe
SSDEEP 1536:CoUbONFuEIHoh/SzhzCb8RxLnIp4umt1iBfOowttMP5cRdH6Q1:CoUGFuEpSz9CWIpN21ihOhtMP6R7
TLSH
T17943539153EF4AF262CEF9A408EB08975FF551F52BD3328D0BD1815857B9EB110F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_science.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_science.json
Size 56KB
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6
SSDEEP 1536:LjYZHEpB1Uj1/uC+Kgaj+ZSftvIu46MOYwZ6pFIIP0:LMZSzUj1WC+BajtftvIu4Ep
TLSH
T12F43549153EF4AF1A2DBF9A808AB08935FF551F42BD3718D0BD195489779EB010F3A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_shopping.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_shopping.json
Size 67KB
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130
SSDEEP 1536:1vkMySD619DD3TjGVEcPtlGjsVLGNy9gvRa6a6ElLf2M3yi70rB:9WG6LDDjjQE6tlGBvRa6hxiorB
TLSH
T1F963845593EF0AB1B6CEF9A40CA708936EF551F92BD2328D1F819098D779BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_sports.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_sports.json
Size 56KB
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f
SSDEEP 1536:YwvnrcvFvtCkX5EAPqPaFg3GlEIwULrIHqBuH5qM:YwfAvgIrqPaq3GlE4Ej
TLSH
T1AA43649157EF4AF166DAF9A408AB08936FF551F92BC3328C0BD1914857B9FB110F390A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_travel.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\nb_model_build_attachment_travel.json
Size 67KB
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1
SSDEEP 1536:FNDkURt4oUTXolLQth8P2GHmB8+JEzoKGOcFhgywm3xXfKTvGHOym621Hp7JgET0:F/Rt4okQKoaaG7hPhhXCTvG4COq
TLSH
T1E363759143EF4AF1A2CAFA980CAB08935FF551F52FD2328D4BD5514897B9FB010F6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recipe_attachment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\personality-provider\recipe_attachment.json
Size 1KB
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a
TLSH
T16D41F63DB421186302E6676236DF42C4233402BE9EC17758FB88D49A5EFD5792236B2F
MD5 SHA1 SHA512 TLSH

Submit Download

8A85.bat

Path C:\Users\Admin\AppData\Local\Temp\8A83.tmp\8A84.tmp\8A85.bat
Size 47KB
SHA256 30540b780f1aeeb4948c8608ddddea30ed4e8a805d7e7acfdfebccfa73998c69
MD5 39487d4366806f78948e5bbf670c69af
SHA1 9fe43f5e6012d00ffecda3437570c8a2d4744621
SHA512 5055b550bb1de55adc32b927e2af8b106ea939a519c290a0a8d693c392003f10f5a0586a47bcf90f4ca356dc01d64de9463275208f0785ddb2899f659e5c613a
SSDEEP 768:ejxERG6CT5YgfqJfq+L7OhBxsZPcEOUPbLb:ejSG6CtqKi1vrvb
TLSH
T152231F3238110E19D806FA68B9B39C21A36572C3DC523BC1F7DE20953BBBB41D975AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeSFX.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
Size 1KB
SHA256 8df2a75bc183cd6bccf4b069477a6c3382ddc07490d39c4890a11124800ae37b
MD5 04629a08d3cdff53705422c58a54a4a8
SHA1 cf5da5b2624abb60161737486fcbf112b1f178cc
SHA512 d6fe588b7f7762e737e573dc439c5c371c6bdf958becfc12da040924eec9cb01718edc7721aa07b0ef530eec6ef1f43b5eda42671de3d9834c02428185d65f85
TLSH
T1E94178861EBF65F1270960C7A2AC7EFDE9D074173E45ADE077A592083314938DEC7602
MD5 SHA1 SHA512 TLSH

Submit Download

DefaultApps.xml

Path C:\Users\Admin\AppData\Local\Temp\DefaultApps.xml
Size 1KB
SHA256 e512d5149170e01023f8489b1c0ef18cc6e8ac8c0dbae6df4ca9a843e283a215
MD5 8c39e302e20e76adf2744c25220da36f
SHA1 8d5ea7e2e2acd35dc98f3deecbbb4536e49700bf
SHA512 17765955e7b7bb592bf0f81d705220f56e051ad0df1dc770df5e062ef4295ad79b196ab71554b37b7dc50e42ff2e0d14c25ee3053741cebbca07b607fb1aab35
TLSH
T16A318AE9FBC249F2A3576A627A41D2CC72A981AFC7EC5B04B043612E901B7BC4777057
MD5 SHA1 SHA512 TLSH

Submit Download

DefaultAppsNew.xml

Path C:\Users\Admin\AppData\Local\Temp\DefaultAppsNew.xml
Size 5KB
SHA256 5c37cd8e574cd0cde1736c60a15c180fcd5779bfb167d5e90e32eef97ec45f83
MD5 ae24bdea41713eec181ad5279d34df3c
SHA1 b3ffabca4678ddeff198ab81cfa2dc6740a13817
SHA512 a2c469f0def3214121043200d0f204e180302dde412f349d364bd82e3281aee6cf53f4814ce76ad82b0c1ff7c6532a5fb6c862a6243e556ad85aa48cebd68cdd
SSDEEP 96:/oWlCloLulNl0aOKV7lKl2cclljlplClLlslolrlJOOqDCDGf3qM:/oWlCloLulNl0aZ7lKl2cclljlplClL6
TLSH
T154C126137BFD1A49F1F22B659A7A246A0D7BBC584A3AC22D10212E0C5C71F55CC62FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JavaDeployReg.log

Path C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
Size 13KB
SHA256 49a182a3e4232bce68d5b969be6b649488d2c068c00cbd544dd9d7d9106dc534
MD5 900130fe3fd65c9142970ad1b997967b
SHA1 5d2a0610104a78b1f934558e738fd31bc2531a7b
SHA512 40e36ddf5b0d71ed0ef0f527862d43517943feb6b75a3ea5c48b55db671753432ef0ebd8dc5166a22f3e3079d637521ecb4d7e438224a6b3c8b2b5ee197c7fb9
SSDEEP 384:rnxef43gMNef43gMRqLf2axxxxxjv+n2+Z:rnxef43gMNef43gMRqLf2axxxxxa
TLSH
T15852E0E1EE1B21FF346D10D7CAA73AF25959F14AB2CB0864B386F9147914E40D9E38D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20260130_052517545.html

Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20260130_052517545.html
Size 93KB
SHA256 bb04e4890a24137cb72af9448accc86722b8b652f894c1419a668c0cebdfdd03
MD5 a2b6eeb5fe25377f86d380eee3a8138d
SHA1 e3b8152102a26891cb484c9dde1f5d343f264301
SHA512 cfae1bc52f46e9076fab4b092265d402b69737196c7599d6cadb56b5f2349f9034d37771bc4370c314ecbefe45f856e9c54c12f4f0a53c465e1784d71abd024d
SSDEEP 768:fdsOTLyUFJFEWUxFzvGT49QXBup3ZlbQJ:fdsWyUr+WUxpvGT49QfJ
TLSH
T18793A21377E84154B5F3BF4DE9B610260E78BD865C34D92C13E18A5D0A92E24ECB2FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537.log
Size 15KB
SHA256 edfd543739ffd01683bb08d635a7a68cc3f70e005e1e538356e14daeba444cdc
MD5 f087e08113297e95806cadde71c39ef9
SHA1 9159db76b0b4245f43bd8dd75dd225f9ed55912f
SHA512 96349d1a9e137657647c42d9d29c9dfb6e0d42507fd1ba7003b4d704f7586230e2f8317daee1ed5009d815836103156710d8cb2b649f73c40ddff70be257a155
SSDEEP 384:E0UVhd6oLp8OVLOVuVWanih/VSVXPVdR+4F386xVB0MNnxVR:EHc6L6gWayUXNbtHrHR
TLSH
T1D162E08B8FD9A6550E7876B5C21A7BFC8BE7751E4B8055F03BA3034D43925B4E393A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537_000_dotnet_runtime_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537_000_dotnet_runtime_6.0.27_win_x64.msi.log
Size 551KB
SHA256 40041edc819d6c0cfb4cde5dd4e9bbf7788b5c7a79e03ade32add84650f3cb12
MD5 f2138d082f0994487d55ec9ae0ae8b40
SHA1 a89e9f08b969e2b70c78977707dadfcd9e528e80
SHA512 1df7206e1f217e15bd5cd0e10f62994044b857737ea1c33f076c765305389d0c2b3eb0bb0abdd783f4dd08edbbba50ebf76fb3e08c0d741d65dc5203edf77777
SSDEEP 3072:X7qdjCEfyAZDNxX+wp5gBO4bizvrAQOuJp9Jtq1W7Plpsc0Z7GYhL86v3qUNoqsr:Ej/ES
TLSH
T105C44814ABF90215B2B3CE47EEF3841694B6FC36AD38D91C1192834D0572E05E96BB7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
Size 95KB
SHA256 d7c1ddb9d128b40aad3155286b19bd9b1ef960e93caec8412f19de21b0209551
MD5 7acdc453c6cbb8f4bf743ffa39b0bb86
SHA1 7618e35c7ffa4e95dd53b7537236c80b8c0c91da
SHA512 4855cad2e98f794f6d7be3dcc4ba1d9d96cf4c4ced80c24a85d8ff215af2aba0986de57b0f670227455f7aa43b40ac55de77c220f242efcacf3cba958e9b9c86
SSDEEP 1536:snqD3VC7eqg7P3TjGuAK6Ncp+ph5mk8sKSEqL2BLkluOitejyLyX99n:sf1jyLyX9N
TLSH
T185A3F6196FF50115B3B3DA875AF31826D6B3FD366D39C91D20C2834D01A1908AA69FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537_002_dotnet_host_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537_002_dotnet_host_6.0.27_win_x64.msi.log
Size 105KB
SHA256 7cecba0eac2d40996f67e8176abcc9196b669ab517a7f02c9ce8cf65fe7a4a86
MD5 3a3febd5a7444745843d86a7403d3d9b
SHA1 3b76af05d3e1abfe5c3e6a542f4729dd18f2ab6b
SHA512 3434559985f3ceeeef397a299017ae118574dd604b8821e141639dddc9bd35021e83325dbbfd1b6ca3f60c92868ee23711872e6b0000dd39b36ff78e4176082b
SSDEEP 1536:OYzvnzqzmyobNHLDGquSiSupIpqjAaiSUfwGLz0sHnnGujCvhhPEIDSs1sU5:OBIjCvhhPEIDSs1s+
TLSH
T194B3F52A6FF50115B3B3DA479EF3146686B3BD275D39CD0E20C2834D05A1A04E969BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260130052537_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
Size 847KB
SHA256 e6c30f71c41209f500a1c170d5532ba4051a9872d35a3e3f63f6c8cb83511c48
MD5 156bacaa92a698dea7121b7ed9028e91
SHA1 ab0ce7f9256e8aef495b649c08898f110d579540
SHA512 bc6426c8ed6934b18ce10a0ae313a1b7ca6cbae532563c3a9d0b59f1b950fad87e328db235618c73aa81793bc6898c9aecd6f2889d43392323888c151ec9040e
SSDEEP 3072:nOLNnjwAjPb2SagT6FNbkdh0DemH551ftMrPzldiv+75cT3l1aqdoSNKLan8+0Rv:OjbRHwS
TLSH
T14505E325ABF90625B3F3CF86EAF344169576F936AC38C61C1096834D09B1F04D866B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557.log
Size 15KB
SHA256 e062b95f529393ded33ae92b823f6819173a233ee5e37d447512530d97b57d1b
MD5 c6c8c23bedcb42049ca9bb3ad9da7333
SHA1 a1dbccf706d8fd6bc9acdc1673ac57c63cd0d904
SHA512 b1f49e2cf297eb60581d21b8c1c8dcafc5aed3b53bc3dbef6ee34d1a93adc6e5e452e06758ae5139d17e7dfff286df3330dddd5d84b549992e4d46957dbb12be
SSDEEP 384:clAV8n4+n/ZPc/PcMV2jKV5VYCVRph0F8Fg2cD0HMp2c1:cgSE/E+2j8PYk32nrn1
TLSH
T18762EE611FDC61402DB0B1BAC17A3EF98A97B08F566055F43BD60A9DC3924F2D38EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557_000_dotnet_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557_000_dotnet_runtime_7.0.16_win_x64.msi.log
Size 470KB
SHA256 df7b55f117c78bf46e2d826e07ce2e5756b7442a3ce9a8900015a40e2e0e20dd
MD5 28b7479eaacced65cc81c4412b93b1c6
SHA1 ab81db50a4340c3b5a2be608e54e3a88448de81c
SHA512 eee865d49939d3cae2bba2fdbbff4d25cb44aef403dd635a811304bedaf700eed51e60379c20296b04170eb9e4f62efb67096a4f622ef1d43b1f98ba8c8a2845
SSDEEP 3072:9AJij8ViY9Kk6mZoAYil9+NgZ7gkBsUOM7zYet/G3uxj9L8CIt2MlbOp3Md67clw:LjKv
TLSH
T199A41815ABF80215A2B3DE47EEF38416E476FD32AD39D51C1093834E0472E05E96BB6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
Size 95KB
SHA256 644af5b5c063044ec9ec1020431affc6d8c76c35c6bb998221eaf124606b2d4c
MD5 ff8043788bb498487d1e0a83bd6185bb
SHA1 423cc31330be37aa4f82559994cae3241d98da7e
SHA512 165e22a3375b453f79c1d0300133945da34002bb71ba4fc573eab7921d5bf0734d539ca5a59aa373448a29d27a92843cd2a733a9f480ad986fbdb6340b5552ef
SSDEEP 1536:zOSj1nYuvC2EIEHnjmesWcs2pcJPHk2u+Q4WwVmPyEkNtsMljRFTdeUg:y0EjRFTdeT
TLSH
T14FA3E6292FF45116B3B7DA879EF31462D573F9365939C50D60C3834D00B1908AAAABEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557_002_dotnet_host_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557_002_dotnet_host_7.0.16_win_x64.msi.log
Size 109KB
SHA256 57502ab19179783ee741fef9fb2e36218f18f0dc9b2ba1b0b52f80a4cfca4ca9
MD5 114bd133dee6dda42ac687ffff103d65
SHA1 a72c0fa255c6ce0634eda8620a657d7eca11967e
SHA512 ef558e55c9ce1f21475f897d61558060edbf72b6d7283eea637c2172f5efa57052b53116851ab370d17782ecd304f76fc6ec1e5eb2b28fcf2d795ec9c27ce18c
SSDEEP 1536:zdNCf/o/OLXpAxXW7+jI3JJ8BHpGoLVtVPkreYFE+f/ITdjeMKKaFCHOMYcSx:RrrjeMKKaFCHOMYcI
TLSH
T1B5B3F61A6FF85115B7B3DA879EB30416D973F9769939C80D20C3824D04B1904AA6FBEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260130052557_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
Size 852KB
SHA256 82c703b958447e6c2d669a201593116deb316aafd97d84997f643250492654e2
MD5 466b5331cd80566163b03d649bf18540
SHA1 9efe5f913eef4734ef97ead8ccefdc50e6eb927d
SHA512 0a6f11b0ddc7737d09900575b0c5dd740f4709cb426e1a9da7ecc1f9d6433305d7a519fc14b644d7161e30d716340e1423f494969df37207d86699e16549dc91
SSDEEP 3072:j6VQjOt7GgxzzbqCdxxSbk40g/b1ueNi1nPOHKqzgJQCruBf7Cihbf5/OS2Wt4Af:djK9G
TLSH
T196050624ABF80619B3F7DF46DAF34416A476F835AC39C50C1196834E09B2E05D8A7B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618.log
Size 15KB
SHA256 fd5dc50c411fdf00289a906394981222b92453c7b6033c75cfff0d51b0496710
MD5 d11760b4326b24a38daaa271f62e9696
SHA1 08f6b7c21aa9dab6569b825e1f01ac7576aaf59b
SHA512 16b598b4f9e3aeaacac4f63040cbeb0a5d13be4d07f85e61cbd8829edff2b28562d60ebc73a638af1185004e1feb3ef971a033d8c5f157ce1a570496e1f61f3c
SSDEEP 384:NAdVUMPBemQNqQNqqVL+INQ9uKf7V0VG9IVUPABXAnwtCQqPu3zs7QqO:NCuwQwca9D2YqhsfJfO
TLSH
T11D72ED659FEC61900D78B1B6C62A3EFDD7A770060B4054F8BFB2060DC79A4BAD3C9981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618_000_dotnet_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618_000_dotnet_runtime_8.0.15_win_x64.msi.log
Size 470KB
SHA256 1e454c046672eaa9d34974c8f0168407dd26fca0dacfa36ed6eb953ddc939de7
MD5 54bb6fd624faf2fa73ea62192db360eb
SHA1 4aecac1cebc98413c94724a0df5996ab2a4c68bf
SHA512 797ca3db840719104d23480b417ada94613009dc00e7f57a3afb3d643fb2852890e115d248384cbcebed084b7508d3967cc27b33451528151927323ee402a6ee
SSDEEP 3072:pvWQLCWs41QfwFMIacCdvpjlIXjA6NdA0wNIuV5enZgMbr8eezveNGmk61bTb3AJ:VjqWhm
TLSH
T189A44824AFF80215A3B39E47EEF38416A572FD31AC39D91C1182435D0572E09E976BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618_001_dotnet_hostfxr_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
Size 95KB
SHA256 fa1b478aee8be195472ecf78b43cbc49cada85cf8b409867c3d908631be04623
MD5 c8ebf14f65da7a2cf62e15a952fab51a
SHA1 7421add27b22cad6528b96a1c3e72d125bc71db9
SHA512 3205d6c72b08b0a2e21b7992bd64f361491c87ca5e0e0b0ef7099a9c2242fca953d804153bba59abbe5b48db3410025e4934ed3c1b0975181ed04974fa66b00d
SSDEEP 1536:elmKuPDVvNRP/VohtTi8nwru4mVNkMzpkpff8+G2YQe4tGvsU70JUJmrh75XSfjf:elmKuPDV4RIm0rh75XSnjHW/jQQTgYEL
TLSH
T125A3C22A6FF40185F2B3DA875EF358279973FE656935C90D20C2931D00A1908E979BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618_002_dotnet_host_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618_002_dotnet_host_8.0.15_win_x64.msi.log
Size 109KB
SHA256 064cc4d0f6df834fa37b97636f856cd1f2e60489bcf3ca25d32e3bfbafb0d7d8
MD5 822ee5783ce3986d5d58bcdbcf250270
SHA1 fd19aa5c81e7edc201169f07b9f0278618c1b14c
SHA512 ad8b0f7031bf3076d732df026875cf280630dc6f992ac5068f3cff34ad152167ed45d2242548a16b56d67ca589aa404296c688f1164a7126273ac043b5ee6d4a
SSDEEP 3072:yjPz3e0GWfMskJ1krUjW7fHkWxIK8bWyIvEj2F:hjm
TLSH
T14BB3E52B6FF40145B3B3DA879EF354179673FE616A35C90D60C2831D04A1A08E979BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260130052618_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
Size 849KB
SHA256 5b0f024a6545e6ff03aab4da6ca1ac490fe2031939dd4c3a3bff455035ad134c
MD5 a78430e11c8442b49bbac9208bab0f20
SHA1 01496c27924a14f2d9d160c0f497ad135c4a7266
SHA512 1d4b2ee1fd3fe88546645f3c0f401422a1548b9014752034da95edfbeb32c5ea0ed959988caf8ee0da32d3c2f22f94b917355b34ab7ec447cf53fe17b7fbcc0a
SSDEEP 3072:XzHxBMV7aoHHvhr4F/tAuXDPWoex0CwKBhwjvrZmXedRh+wLwJieWtfx9XvmERCY:DjZt
TLSH
T1F405D615ABF80615B3F38F47EEF38416A476BD31AC35C50C5096825D09B2E09D8B6BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WWAKKABN-20260130-0529.log

Path C:\Users\Admin\AppData\Local\Temp\WWAKKABN-20260130-0529.log
Size 56KB
SHA256 d4242ac94007f07be366acccb3be271de91f6ab7720b8b881a22bea246453612
MD5 a27c640579057e0c2f39b36c84f7a08a
SHA1 a5933a7c39fb23776184e9a111db5c008ce074d7
SHA512 320d531a1fd7e5d2ca4338f2780272a6f338d0691acb4ead8c4b61d434674b383455676f3d5833721369fbc2c6ab42c8628ce583a98eb92deeb6f4eff755fb7e
SSDEEP 1536:cW7c9BMVbYPOHWvF8fUFYeBgzxGqrihON2Byp6Tij4ilYSbC8K+PP4kfe+mo9VS0:5xyPvwYhON2EB
TLSH
T1BA43671C5EFA0265B2F7CB869AF640A69A72BD677935DD4D50D00F0E1922E01BC60F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WWAKKABN-20260130-0529a.log

Path C:\Users\Admin\AppData\Local\Temp\WWAKKABN-20260130-0529a.log
Size 179KB
SHA256 ed21e5e1e36c275c5f254409d41ab12ea6c21882c891a9fbbe97bc5bfc046be7
MD5 5802000ea7ad203b3930cd9541282a8e
SHA1 522b252e4c3cfb14ae36ae5422b9f79e5e118439
SHA512 f3119c9149b2006b6aea0f2f4366cc0eed41712595982f9b73a496b26e55cafb19f48e90ed54a201a7ba097417501b6b37287b113e77ca1a6d21010c9d465539
SSDEEP 1536:8GmFTcPYWWi/DeTuHrz+D8m+wc9bItPTHbsvNuUydlT2Z8fClY7zQ5W/cFib4uRd:kQnL3KM2lO8Qagk/e/4/WW
TLSH
T1C30477196DF90626B1B2DA869AF68423DB32BD636935CD1E50D20F4F0512D42BCA1F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aria-debug-5104.log

Path C:\Users\Admin\AppData\Local\Temp\aria-debug-5104.log
Size 470B
SHA256 84ed832d332d09ca07af6d257612f881e38181f7c531bf356ee5f18b001a4392
MD5 5e4c47adb1c96e3a01015f8acd1c068a
SHA1 8f7c212dad89108d9406e4ccbd3fbd512965697d
SHA512 40f2e3429405cc9fc3fe393f5564f3e38dc4b9729eea560f5b0b7620bc43497d545a6683086db623cf7f1c8bc1f9e0d5b6b8f0dcde9a4a90e4827c099ca4c4e1
TLSH
T1A4F09E8A4A6B4C73C30B72B3B45399E328E4D67FB3D04740951D43281087388A243C80
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 78a0406ed51ac6fe35ca6b6f81486b8dfa56a4d173bb729a7a7981fcbc5776f2
MD5 e3cab3f6f07e971a223f79411204c277
SHA1 aed8968e5280f17abda7708a7b0509170f079bcd
SHA512 cc03aac02ae5da633cb0c8c53f97e3a4fbd45de280d45c13852ed191375f5197d10b760296f76c66facae72b68165581c3b11673ff969f0525ae4a6768d8100b
TLSH
T1B44149E13635622F9BD78BC570758C942CA1F181436F5A1CAE4A4036BD5CEE0A35FBC6
MD5 SHA1 SHA512 TLSH

Submit Download

dcf973dc-c7a1-490a-9e11-41f57decaa01.tmp

Path C:\Users\Admin\AppData\Local\Temp\dcf973dc-c7a1-490a-9e11-41f57decaa01.tmp
Size 145KB
SHA256 88fd3339202fdf79ed79bfe483fcc57f322156f40cd75c47ee78efc5b203893a
MD5 fabbe8fb069e32ff7d1048cdd8871e5e
SHA1 d065636701c0c71037f44df340f4fa10c32e5ace
SHA512 8e0dc40c6afdf5bf250da1d401d9abcaf06db0577e0ad3b0ba15adc1600433dd5c354fcf54806554cfde8c1872d6a066c17313cc6da273c7b6e6b1d9d7e6d270
SSDEEP 3072:f1/GuTrhcnKXFmnvTtb44wLWklhluSMCRqVph3Wvlf9XXo:9/p5OKXcnJc4MrHRCpQVXXo
TLSH
T151E3D06C6FEACC26D51754797E54F0CBDB064F2F460A672F210A841C9A70A8D0BE19FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Size 1KB
SHA256 0ff286513e87f8b2a0cce03d4f0699f5aab1d8cae04b46089f24cd1ea1a4b4e4
MD5 30483e4051a9f33fb669ba514dc25793
SHA1 16c6e6229299e1c650f87a9bb20e9bb4097b7d28
SHA512 cc962d66358c4d4dadf930927ecac07c734aeb5de56cbbe7e0d294e63bd1beee2fb943a1191aff8f581f691b401e9d5b0317a22abbc5bbb10eea90a3911112fb
TLSH
T1FE213555C4D9F1E0C864B0B6CB4F27D1C0D6027D629621F275A48ECE130706D5EDBDC6
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredistMSI0640.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI0640.txt
Size 427KB
SHA256 d2b710d9a01cc79b633d053ffa427e20f8d916808b0f0c02a6960583665ea11a
MD5 9402a33a1fc217dbabe1e4abe7339cf1
SHA1 81b110e58e3ae7fe0417bdf9ca4e7c4f7436d183
SHA512 564e51d54e1f03b10e2f89a5cb6036ff5800f061c2a01a3a0fb2d97f47717a37652c4778194938674eba9ec0053cafb40c5782c062035696f23f73fab541fb40
SSDEEP 1536:4vwNyBSoJXS2FOFH3Np2ekarKwc3mrehI6n7lXcXTn3FbG4jufkjcQXXkGSBRdHJ:tQ2SjPNiL98W1I3
TLSH
T130948B255FF50215B2B2DB43DEF30517A833BDA6A935D94C2181830E05A2F09D97AFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistMSI065A.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI065A.txt
Size 413KB
SHA256 fa39ad460fba18b9e98f29851524ee9c6879a40ddacf30f827f1fcef602910be
MD5 e762a6631820bc07df61410078143e7a
SHA1 9575ab5d187de25a1149a5474b66d2de37c329be
SHA512 9502c88496cf63e6830bc9ea5a2932790c94d5d2750747573aa3ec2f9feab8413443f0dac9d8440d446e7dd0f380028f348528b01562472a11a1d8a569bb5a08
SSDEEP 1536:dhII0z+fgWaNFhsZ1wR87uiMWZfBV8pvbLkhjh/1DoG4UjTQqeVl5i5Zt6QYYWP2:dhIGZAjfCVBGArqXEvr2s1
TLSH
T134946A1A5EF90216B2F3DA47DDF705139837BD52A935D94C2181830D06A2E09E93EBBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI0640.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI0640.txt
Size 11KB
SHA256 8e45ed25ed5baaebdee8e68a533bfa96b9ff3908410b8ed8119ffe540da4b1ab
MD5 b2b77e9034604f749c76a96db8fca1d7
SHA1 326c2c63363007f7d18807eaba5db45effc12676
SHA512 10820cec03a42cf41ada5ccf9ab2979989b990958a9c062c5c48c4938ae2841e045fd0abb863b18ab89b8b8fb78a2a0dec8a4c61ed22b782a291281959192f3e
SSDEEP 192:svk8Fnnt+9v4pQcinCnDInCnWMgqVl5CnCn74FI86hTL8Vf:svk8Fnnt+9v4pQciCkCWMgqVl5CCspbV
TLSH
T18D32E01A67B40C05B1B3DB9EDCF75513AF32B8426A78ED4D00E1534B0AA2509F5A27BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI065A.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI065A.txt
Size 11KB
SHA256 9dc8d4a9d716ffb95d30346d72b4d0fa877532d05a3d066b816a300b79c53005
MD5 3f2a498503f80fbf32056d05fe802248
SHA1 19bf6db1fa1e3e2771a06498d310c0654a7cbc24
SHA512 c4a247cd943acae37e98e92dcbbdedf2c37e94779784d37934dbee919489bfef1c636b4a1e01f91f4a4f8ca78df91f6fad86eb83a8863c9d5964c83a979d5532
SSDEEP 192:yVEFldnghAkKnanjQnanuMVEnInzQ9g8SR4A8Uf:yVGldnghAkKa8auMVEIkB7Uf
TLSH
T1F232E22A67B40C05B5B3DB9FDCFA5513AF32F8425678ED4D00E1534A0AA250AF4A17BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4c6249e-d3d6-4471-81e0-b5c520ced8d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\f4c6249e-d3d6-4471-81e0-b5c520ced8d9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 163KB
SHA256 e4f29292f48b0092713244e20a4cc32effc01099eb6397315a0645b833045931
MD5 eb6a867e2fbb9bdbd00d8806f51eed08
SHA1 f84c241b5d2a55202533bc4bfc67137858e28c63
SHA512 3cbe3338af41689ed1e971f9934d81bbe35c06313ebf9df2bac8382bbb07dc7156427fc3f67e25447d869ca7327b842c6b6932b91d490056fe36b63451b94742
SSDEEP 3072:4o6tFoLwq+DJktE5CYNXqzis1/dOO0UcOLgZEs0DIcB8:HWXX
TLSH
T1FDF34296CD2E51BF341B4BC7C3BA7A685567150A63DE091C32CF92CE5841903CE6E8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mapping.csv

Path C:\Users\Admin\AppData\Local\Temp\mapping.csv
Size 120KB
SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
MD5 d3186aada63877a1fe1c2ed4b2e2b77d
SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
TLSH
T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
Size 2KB
SHA256 2166a69b51245819fffcf93e223dfc423391a0238bea216566f479fa1779cef5
MD5 791c6d1103e31c28cef76e982c0e8761
SHA1 66f16bacaf12f8da4a83bb0372bbd2d519564901
SHA512 062f95874adc30875f904d8ea2afcc798bc49656be3dc316636596fdc17aad149fd5b57fe4a40790a0b8a041fbdd9e33321a81d9682bf25cee2e1ac822361e8b
TLSH
T19B51DED66AD29271EFDFF2E3116239395E9941CB89D05530F4B94082B4C3EB2813F492
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 381KB
SHA256 48ff36892ceac7bb0ac5cf8c779d74edfb2f94a12d2641b052c6d530424dcd14
MD5 5453214a2ac7e26a23511bd24c6631df
SHA1 be26412f70b2079886e0da79ef7149535e71a713
SHA512 200c061cb28fb16eb9424125e93002b3933c8a734b10af0b56b293f67125a08f927293d02f804bf8a52991a55797722ba7203d80cbe33ab351135b12b5fab0f5
SSDEEP 6144:6dSr+voa5D+rdSBQrmH7/+GN1MXuYxZf22WYopmCk5gHoAbesMp3Qbon6CnFA:6Kva1KSBg0WGN1XkfktmCqweLpA86Cnq
TLSH
T18B8402F5B76038D7177E4207AE256EEE47928D13CB8FD0DC592B378148B7B286E95208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wct68FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct68FB.tmp
Size 63KB
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
TLSH
T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wct6D32.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct6D32.tmp
Size 40.2MB
SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
MD5 fb4aa59c92c9b3263eb07e07b91568b5
SHA1 6071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA512 60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
SSDEEP 786432:YMwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59w:YpQcWxDMPnN+dk65gGUjku4vNjLjw
TLSH
T170972212ABD88075F2B79270697A63B5867ABD703F36C5CF62843A5E1B30DC19931723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 693B
SHA256 467925fb7e8277706e4a5a86df5adf511ef6a51afb7e6151d7b20a9d685cd339
MD5 309764e2acdb1ee5b842fbc0f58b26fa
SHA1 445f8e382d5a6a859a75ddfe267a794da814ac92
SHA512 a61b6f2f45f023a8309819705a60ef70b2b52913a3c2a02ee13546b122061796f3d0648b2d6065d0352d1249f2e87c7b2000b83fd14b63835400a6e303217eb6
TLSH
T13501F7D70A0994B0DE901BA769DCDA39737AD3CB43A4D126B7899419450A23DB33E05D
MD5 SHA1 SHA512 TLSH

Submit Download

6CKCUJR6Y50QVGALRU2K.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6CKCUJR6Y50QVGALRU2K.temp
Size 11KB
SHA256 8ca0ed144278f9dcbe6adef003f7a6b2a5cbada1adc733f940ff46695dff5c0f
MD5 9c04b270277199df9961c4d8d11b3825
SHA1 ab386d31de2a2dd18473201c0fac5fb3c0f34448
SHA512 51b96b4b613e8061400b8e922264a4d78e807a0e8e05aa2c6b57abd0db10235aa87bacbea288e694eb5dc5cdbe032b9a7ad4e69dd22ef7130fdc69532014fd61
SSDEEP 96:tl5gcl/YgAl/IgElXYQi96g6KlwO+ug9ep5gwl0O+UgYN:X5goAgs/IgwliUgFwMg4p5g802gYN
TLSH
T1D9320F0107F60D45F6F3AB71BB32A3669777F9016B1B922EC10056890A33B94692DF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\AlternateServices.bin
Size 10KB
SHA256 fcc7f028afeefefbb227f88e66e75de9ddcdd13097d1b9d44583b00576fe2de5
MD5 77b7e3d01093e71767f26d5143dd48ed
SHA1 881f9052e17b5e7f047823b4807a6c29b5693561
SHA512 11322057ce3e8fe389785151afd1c5bf534edb6d0cbd0ccb6e863ab1f27e2e4f8b147ee9c4063eefc7001fcb96fb059dc2bf77ba7380090f1741d272823a8047
SSDEEP 24:hAuhMZn91zj9x3/9BLb1qN9Vv9YT5q9F55A5YYk9FZYg9lFY:YdR9lJMHBedI565G8qY
TLSH
T1D92294FB6B72A472F0A2CFB08059718CCC33132559A89184E75490F307C6AE9913FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\AlternateServices.bin
Size 15KB
SHA256 6d1be00eeb1be83405436d3eac9e4718edb7e579a64e2426c5923d981a989d50
MD5 757630d98cecdb6b5ec802b73ba4e302
SHA1 e9d98ab961397e586340c41f5b59a2aacc1d0e2f
SHA512 f6c46b88cb1eba30ffbf9bebc4c47228211da595da38e1e975f2c5ba25dc9ac8603280a488ac88e1e0b00e9d81b6d117500c75dcdd675ad8e4bca2e614bf7a12
SSDEEP 24:VuhMZli91iEq9xai9BWe9Vv8F5q9F55A5Du9FQK9lELWN9VxWAYq9Bb6TTNz+lzi:GDIkQokB8LI56D0GoKLM/pYI969z4i
TLSH
T15662A1FB6B75A462F0A28FB18058708CDC331315A9BC9184D71490F706CAFE9903FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\addonStartup.json.lz4
Size 4KB
SHA256 8de5a490aabb6ed252b653b72e9216970c4568f2c2d5c9ef78cb424b61ae3caa
MD5 3e87f142fb38d1d61f6c02418e343988
SHA1 210a055dd9252006d37357ab44f4cd6bf2d44d82
SHA512 85d825f4372518f8daecd4607d41f12ab35fb78b8b1bc67ffe022fa0c48bcabe034280203c7c3eceaaabe49d94712ccf34c8dee8969b6e917a5b0e731bdd5fac
SSDEEP 96:NXDB4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:N852xxhD8rGvm6ApwnHUuhN
TLSH
T16CA17DBAD141EFA2FE32C04398D93FB2EAD5AB3414A9C8D0F16EB1294D24A735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bookmarks-2026-04-16_10_SvMCTvWh1HcQDf-I0xGGt0O-zmnHoDT0A8iZDNjYFQg=.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\bookmarkbackups\bookmarks-2026-04-16_10_SvMCTvWh1HcQDf-I0xGGt0O-zmnHoDT0A8iZDNjYFQg=.jsonlz4
Size 851B
SHA256 a6fe0fd71632d89f97b7132bd355d7b9ad8f8b17edde953fd259ce2c4387c27b
MD5 a4ff94a2bf4cbe6f6f9c825ec6c21cd6
SHA1 d32c3df2e7449b934bdaac047ed55a4cc7eb616a
SHA512 1becb8671a06ea6a7f2a5a713e3a95e8b85296848a4f1ac2f14f8b24fa1b0fd80028ccc6c950ae99037e416fd084b0510821f6dbae2ddcf667567f1cca77bb13
TLSH
T188015259F6B904D819C1403F54011A45F6A33E078EC968E8FECE08A8109899453DA7CA
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 91KB
SHA256 778e070316ddb71a2517c6962d2b5eeaf101112409d215c22a52e620e1cc6277
MD5 7213c395a1f0a2251efed30a97b009aa
SHA1 4f56f10f2023036e9c18b545068251197eb680b1
SHA512 ada994ae2db2e47d7a29404dcd1283b286f7c36c665ab0f18c5f0168097c3f3b9123881d271b8e3110e0869e071fa6c126de5131746e90e12b68e5b653ea615a
SSDEEP 1536:8eXwj/omZqpaVPIlmIltWAzs2uOcz8I94d0NgPM5JBhxJW:8eXwcmUkFjIljsOFIcugk5JBhxJW
TLSH
T18793DE80EB1B403FEC2445BBB8951B282735F4654A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8bbc8cbbaa5e441ceda2b6f9def6a8766db4710fd96c5f86179cc8dc653dc945
MD5 e234f6aa85ad32ee98055c503bd5f7b6
SHA1 7a9c8595e7c2cfa2ef82c21f9305f688198f9882
SHA512 c963f5e0cbaed8c997a63a94d425dc513ab377f1df494d06fd83b7103821c725524ec91c8931131ce1b9bff9f533663f4f986e7e10885fe46b2061042b46f490
SSDEEP 192:e1d66Joz0dzgCl6mc0dEOv5zbooZl9yjJxI:4d66JozQzgC1j5booZl9yjk
TLSH
T1C6D1DD68F639963FC448423BCCA61B501F36385B988E3F2931AC645D2C563DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 91KB
SHA256 4a4108361a0309e203f02feff9281601395a88a938de6306fb57e6bf6f511b94
MD5 30268f71e8a67408c1c03ea64f0590a7
SHA1 fa18395c1b5a0d7e8b5323fdb3d6c80bb680efcc
SHA512 1c5c2cb8b6e4989b32e5baf16c18220029f5f87e1a4579cf05a56344aa679719a4118603d9038f0c97550d1367631a46c382f0f8f965ae0e608dcac8fe098dc2
SSDEEP 1536:oeXwj/omZqpaVPIlmIltWAzs2uOcz8I94d0NgPM5JBhxJq:oeXwcmUkFjIljsOFIcugk5JBhxJq
TLSH
T1A193EE80EB1B403FEC2445BBB8951B282735F4654A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 93KB
SHA256 826974150d988ddc50f8ac0f52df882cf3ef2011d0f6e4b59f8dc2c2e1beeeb7
MD5 72034df09fb55f9be8a8c9c0ea4bf5b2
SHA1 cd591a856641f49396833e70099e7e78263e70f1
SHA512 78bdca5042f8111df21212f6d16ff3e0a19959bdb589df70ed70af33853f910edd84164eceb48fbde9f89275bf61abadcf3929bc838f0c23b5fd5123d811c433
SSDEEP 1536:JgkNj/omZtvoySPIlmIN4tEDys2uOcz8I94d0NgPM5JBhxJY:JgkNcmTv9sjIN45sOFIcugk5JBhxJY
TLSH
T1F393EE80EB1A403FEC2445BFB8951B282735F4654A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bc560ae2b281c53e7008c498f4fe8cd2c41e13cc6f8fd9449ffcf75c88058280
MD5 0e9d0c0358d4cda6a1eb9a3d0b152db4
SHA1 99b8701f004696d37860b337b563ea00b1356540
SHA512 b9f79c68158e4a0266b505b45ca52125f9f3b2bbb0acb571523570c3c07efd74c91a87e2fbd5e49a200ebfdadbae48599c3a83f56632a268d9cc220d7049ebeb
SSDEEP 192:l1d66Joz0dzgCl6mc0d/Ov5zboHul9yjRSV:jd66JozQzgC1jGboOl9yjC
TLSH
T117E11064E628863FC448537BCCA61B405F3A385B9C4E3F2935AD65482C472DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 87KB
SHA256 026d04c647388074d425a106371bc2d3c25bd546731b7ce3f6d1346d932def2f
MD5 11910ac777ceb24c861382d3caf3c0b6
SHA1 73b085ddf6bbd98c3ab70df1936055f5aa63daf8
SHA512 9924e9b523a83780c7b5e65b3a77ff600ddb104f66c90735a2cfa8cacb1b5255f3a06d37f43039617148c6d7607b02987f917ca4c8d4ff518f93afb8c8241ef9
SSDEEP 1536:5r/oi1NZLHjxPIlmIYfCu/stugwL8U/NMf5wjv5JBhxJY:5r/PNNDpjIYHXgZU2xwT5JBhxJY
TLSH
T12793FF80EB1B403FEC2485BBB4955B282735F4254A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 87KB
SHA256 45eee3d8df21e889ccdcfd1eabf3c80329d604a9046779db6d1ca0e3d0d26d4c
MD5 25283a258a8fa75bebcb9c2c97a0ab58
SHA1 201b49d85f99812772a264b726a2f6eb8dd1aaef
SHA512 0d6d34b4e48abcd469dbb13f37e5fdf007ad078f6457b2ce40dc22a9d73cc7cbb347def529b758e5f76d1e3961039bb383a81b90877a6ff149888df72fb58151
SSDEEP 1536:Hr/oi1NZLHjxPIlmIYfCu/stugwL8U/NMf5wjv5JBhxJ2:Hr/PNNDpjIYHXgZU2xwT5JBhxJ2
TLSH
T13D93FF80EB1B403FEC2485BBB4955B282735F4254A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
Size 1KB
SHA256 45b291f2375ab16c926ace22df09c48ab2f26a21ef04b66bc447571ffdd20a23
MD5 c83dbcc892b1a89c79e0b186e3f76021
SHA1 53a0fb63b71a41f82656d5c34895ce98728a47ee
SHA512 fee968485240ff83317a7d82c5a5574da84fb32a10bf0173c9b761bbded58d31c65604b9f30a98e53f4555041f12e224b31f344ee02eeae5ac5796cf67cf371f
TLSH
T1CE21916CB9B84D2A7CE7EA9D7480128E93154A4B1AC71C431E02DF8DCDD9ED9316E438
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
Size 6KB
SHA256 da19ee1004fb9d1bcf7eef18d6badd91c7947821b799c6fe8c02acc1c185cdd7
MD5 118188cdffcc3882d2572a441c5c17ba
SHA1 f3af32887a821c92db68a96ab3c9f58512870190
SHA512 3b2b61b2152a4f9dfb97e77d3d1b36abb8299fbfc73b3abef6712336bef26a2817663313f95801a0cb4b939882354dbb39b03877e3cdda4d92a320903868dba9
SSDEEP 48:YpC7b52R24UzyHgJxL1oIOs26M5i/8zzMpFfVr/vEM4vOsxYn4JodwJBTd+wWAdm:h1hGY26aH8B3KtYn4WdAd2XjCsAJG8l6
TLSH
T1DAD11D1C75A80C7E3DA7D66DB84003DD87D98706A5CB1C876E8BDE49CC9AE89321F538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

202358b8-3d1d-42af-8632-027073030530

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\202358b8-3d1d-42af-8632-027073030530
Size 2KB
SHA256 69b2ad8cb89c8d19c5375e8085a1f0fa09aa9bb3324e0e9e87f6d12034f4be27
MD5 69103fc26d1f547e1d2f062883ee0558
SHA1 5cbe9605bb7799c2e682d447095e898377b53b77
SHA512 f54c34b5b99f96ae12dddaed486d935c85b5fb914490d5a77c1759cf6eac0e74014772cb2d037162b901cae9a8744efe06e0001f49e3c56f019cd048f9e5b4b3
TLSH
T1D251505C35786C3B6CCEE56C548233CD53A1CA1300862C936E95DF4D8C8A6D9736F92A
MD5 SHA1 SHA512 TLSH

Submit Download

3697d6ac-0abe-484d-8d6e-1001a21b4eb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\3697d6ac-0abe-484d-8d6e-1001a21b4eb6
Size 883B
SHA256 329629caa63a38bc396734b4623e23438fa309051134945dda0e31d9df8d73ad
MD5 306b964f1a37f6d66e2e7cf445600cfe
SHA1 d99f2aba410a6db805abacfb49151f514f774149
SHA512 f45b0cd42ce9726db21a5ac8eea3b03f6c99bcd89a5429b323afb94cda169d3a960a45df8ce7ffbd55330aa8b2d8090e4a7461bf544be3f08a0c607f6932de31
TLSH
T13E112350D335B9B2CD6CD25B89917B05A7F4752380CA54183EF15A040C7E62EE75670B
MD5 SHA1 SHA512 TLSH

Submit Download

66c4a02b-a25f-49ba-bae6-00d75c17c4e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\66c4a02b-a25f-49ba-bae6-00d75c17c4e7
Size 16KB
SHA256 4c59dded406cd28c40bfed992243b0fc4654c7bdeb2170b853d55ef1994dc694
MD5 9d3d3a431a2844df68e2351b91d7ae60
SHA1 8e8e346a21ee21c2d48c58e838bc52fb5b70a188
SHA512 1fcef1ec2ad5cc01b5071d1aec181b0f90aacd00577ef77e52062198b6a75df2d50104e84202d861811059efa1afa9d648230e5775d420c8bda3e15ce013e9f6
SSDEEP 384:Yy69uWVKNidPzIrAVklAmFhAl0bnRaAke:X0VSi5zIridKh5
TLSH
T1E972A956582049BAC291E36894EC7FC3D6F528CF4C418FCD9BE4BD086DDE46E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d8abcec-49f5-4590-b7c4-d1a442b3d5fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\8d8abcec-49f5-4590-b7c4-d1a442b3d5fb
Size 886B
SHA256 2b18fd5b35dd99a7a1b8b12e40c93da40b72f284aa735487f2829c02e950a2fb
MD5 d73082a42812ceed63b3a13e0348d8ae
SHA1 9874a30377007e4a2fe2c9215697ecfcc38bda13
SHA512 47cb8f4acce35d9921baa9dc2dbbacd6756c3c38a89f1bfe0f752b3697f734be12711d798f25ff0757d504b8b2d4b66be311b6c9542a09fa4a58d38ee027503b
TLSH
T1F3112340DB34BDB2CD6CD39799D1B72157E0712380CE18287EA49B180CAF22E9397B07
MD5 SHA1 SHA512 TLSH

Submit Download

954142f6-83e5-4185-a60b-896d0367c681

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\954142f6-83e5-4185-a60b-896d0367c681
Size 235B
SHA256 a61d59a0202fbab2e6934e2030abca75004e70a1309d2b99dcec0fb07b685510
MD5 29384938556781dd0dc8018ce7618da2
SHA1 a4dd1233b38a4fa724ace80187a88e2fa5b9c526
SHA512 4a734b3d0b2cb0dfd43d0d56c92b5cc98c34327a7eb24a7b9cba349db7ea38b35dca7b0271772eaf48aa9e82fa60ee43081a045117e248733bda7dcb7cbc6538
TLSH
T1FED0978068D8276C08280F02F0A439D630488C3310789818966085B8EDFEDC8025280A
MD5 SHA1 SHA512 TLSH

Submit Download

d2aa6c97-615a-455f-8cf0-364e2663db61

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\d2aa6c97-615a-455f-8cf0-364e2663db61
Size 235B
SHA256 495ae95cf0ac7eba420c80a311a29b28bcef1ff2156b1df30aa60f48b4828741
MD5 a95793ac9c3baf8b77912e611ddc2021
SHA1 7135ecaaaefc535e1e51c3dcb2fbf73ff7ccc962
SHA512 9881e2a9b0faa6e5607429fa4debf5fc34ef3b29de49e89548f9b24ee172f3a7ef0827746922f67855be75ebe5221def510138af46111da6f0fbdde7123b4e3c
TLSH
T142D097D198E8B79E08080F06F0E029E674889C3310A05C5099D14474A9BDDC4425191F
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\extensions.json
Size 16KB
SHA256 97eccf77a5008183a86557bb4f8e150f83ec0577a41dfad029eb8775501a38da
MD5 bb0009ee37c8445643283d03ffd5f429
SHA1 dc82963446f285ae24bd67ef028da693b62008d2
SHA512 3e2a8858f67de27941bae8280c5a3b1a6a449c576654369b3c490a7b945d82ec8245b05013f5421aeffd4b7d6ee110f4c217763ab61ab0a6a891790a9dfe4140
SSDEEP 384:DkI4vBUmldvZ8dhWi94zI96oUL4HjL4P1L4HZL4HXDL4HSI4hD:AI4pRfqXv4A614v4d4x43v4/4N
TLSH
T17372431545049EB8294EA79BAA367E02C37D473B60845C78F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 12KB
SHA256 bd38bc936cac2fe9e5569b7f9a16f5a5ecf104bb8e820e8f28e0442c8f12aa90
MD5 5d7c01e1bf5c1763c8e5e7573f381441
SHA1 9c0a6ceee38a2580e9b8b3e20394305591af300c
SHA512 3a3e54e5810dbd2a022efbde5fecb32fdcf8f097fd4c65dd061f1ccb3e479c9dfddf92afb77589aa2503357969e1da9923d21bd12c507096f5ccbf3f0c42d7ad
SSDEEP 192:59gRaf3v5OzSS20rLRv3034nmBw88yYHyPz5:lH0PRMokwbSt
TLSH
T12C42993C60448E3F24F2367EAC2549B05A65412776FFBCD616FD88C2084CF2951EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 6KB
SHA256 33d6caab6064c64092fcd1215021818bfd64bf246107d9c86d24a3d1ed50d94b
MD5 519103b1c73e64da2b84a1ece0d06209
SHA1 343b7917ca5003b1de4de723af16e09675fcc8f8
SHA512 b0589690f8064544fcf582b054523ccbab75c232963e51bd7bb0e9b793362ffb618127ded5c17a1fd441793e787f8bf906336a018d862035258974f4d0f2b573
SSDEEP 96:xHX9UTUq1qGqafuv51zStGSSlIdv9jT0/nlHw303tBw88H8L4cnQVUGS:d91Rafuv54GSS20xw303tBw88K
TLSH
T13FE10E78A0188F7F68B6766CAC6888319AB2413BBBBF68D750A544C5054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 8KB
SHA256 7d82a967be228406f0369dd9b22ce28b9bd39503674b58791e3669a594eab46a
MD5 73bfe1b1de8e18d0db083e172a3d396f
SHA1 e72f685ec7d88580f4edcb1aa3dcbd70be5c3a3d
SHA512 f1c37120c90af634b18de46902ba81eb882cd9ab107dc674706f56cd334dc7417a0a7162acf50a5c6bca267e6d2f891758acc11fd787620bbff615a3e668332d
SSDEEP 96:xHX9JTUq1qGqaf3v5NbzStGSSlIdv9jT0/nlWRAT8303dnBw88YK8L4cnQZUGS:d9gRaf3v5kGSS204Rv303lBw88Y3
TLSH
T19802FE7C6044CF7F74B6366DAC6889705AB2013BB6BF68C711A954C50508F3851F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
Size 6KB
SHA256 11aea0535c82231c770fe735b481797d9e42d7c3af54e3bf85baf5acc386d03b
MD5 1a7f06ef4f47d4c1f2275a763808ca16
SHA1 173db630ba21e8c3cd1e6709dd8f19bc1b3898ad
SHA512 512f9737e1e42433393c1fb561dc20244ef24650d85268e54f9dc0955dfa68d4e9ed30b17b871f64da697f3b8256762624683b5b6d7cce946de70ebdcb7d8d83
SSDEEP 96:xHX9UTUq1qGqafuKjmnjv1zSFOSSlIdv9junlHw303tBw88H8L4cnQVJ:d91RafuNDQOSSNw303tBw88B
TLSH
T16AE11E7890488F7F74B6766CAC6888316AB2413BBBBF68C710B554C5054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
Size 6KB
SHA256 faf12e748d239d141f9347f95ad2807c6c4def57aacb4827c755fefe59533b4e
MD5 1c580d968aacb44a2ca6882bb40c8e37
SHA1 dfae06164472cfef036146734a83bc7459f1aca5
SHA512 925a32816277cbaae9603a4dfb14389b0c75758bdf336f8061696cb10f9eb283431649354fadf1ec347c7f3aa7e16529758e04e5f0920819405e409e8e14567e
SSDEEP 96:xHX9UTUq1qGqafuv5kzStGSSlIdv9jT0/nlHw303tBw88H8L4cnQVUGS:d91Rafuv5DGSS20xw303tBw88K
TLSH
T1AAE11F7890088F7F78B6766CAC6888715AB2413B7BBF68D750B544C5054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 258e2929be8ee484df3e07b15cca4a441be5b9834e5a359357c83b7e80791ab7
MD5 b045be8b4aa89ca978fe0bb7b818ae09
SHA1 3bf34fb7b22ed2b242d7614ffaf8c7930e67cd93
SHA512 b50e42b7382035d5f95ce2e0968a249b0050de0b9073a0f2edf0f114af78c69f19ef3ba4539df2caa474f816eb485d9b04805e00d70a357cb2767e2ee525495f
TLSH
T13F815C839D586C409EA8DC28D8DB2A7D86FD34029AFC000498426667C2F9989373CBDC
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 813c74600279336785712d08437d5d305b4dad3f2bd57cc745b38264eea6713e
MD5 d64f0b1423ec257fd16af421829ade45
SHA1 dc68920c87df96c9cc8705a5a01288b6149a9e52
SHA512 b482e0b3275ef2c7f4e435a5f49665cc837e99f9bd45235351377c95f5e0b59ccefabf3e0ecd32b9c87037b11ac486e757386747d37f5d64e38913eb4af29f04
TLSH
T1A6413C465F6D4874D965C419A0C51BEDC79D741A45EC4C00DAC86444D4EEACE373ACAE
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 f2df74f54a296e012dcd6bfc6a66b0eaf2f673eaa4a95ef685dcb50dd364fc8f
MD5 f6ba2e63d8dd6028639fb43dfa3af1e8
SHA1 7106d542d97a49eb33bfaa68e6b86f0575c07bf6
SHA512 a186358f8e64d0253f57aa77568668ee4207f4417847987bfde2354356e28d799eba11a908f8f32c3a48d490128aa52e30434092ac4ddb0d5e7d5bfbd5fdc174
TLSH
T1DA814D439D586C409EA9DD24D8DB2A7D86FD34069FFC000498466666C2F9989373CBDD
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 464ccdef870e8ed13eea25347fdb1f4f227142ed84ab2f041b4b5c1cd17a244f
MD5 386d96ed3fbe473140a50dea1159c2bd
SHA1 64f8876adce1e60a898d8cd24c94d505a0aa69fb
SHA512 bf61a982fd86a0ab2a2bc9978ec55714aa7158fd2bfe0eaba97bcad30d7c160670476184bc7eeab26ae5afa6e5e7ffe0bb75f02f733cdabf577a5346ccd5776c
SSDEEP 24576:zE+WO/IRU1h62rc6lZYDyrRLvcMIfy85cWlr33tA:zV+ih6b6kDyrRjcMIf55cwr33q
TLSH
T1B6F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.7MB
SHA256 7d582f88c8be2e9a24319ef479e220ee66bc8b9c580a779b4eef6190d3a4dbbf
MD5 9e1c02a8099148a53c5ee69d59ee669a
SHA1 1ea687a30af6995fe176975a5a84ddc43dacf3c9
SHA512 642dc06a12930c5a2a4259fab2d35069c5e7ee41e775318572b252948f79f0fa36b3b2ad27d2ac77253e1966d641a8741eb7ffee64cd96c3894fb073df56a880
SSDEEP 49152:Kk7m7WQ3sSTCPrI41su3XyHFvwYNPF9nAS+Q:572euCTI41R3XgBN9/
TLSH
T101365CE820D1A343F3418073B589A3EB11BFC00C60779D4457A956E9E5B8CEF9E16BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 dc9f7d94044b592c8df7f956a5117fa5f23ab4d1df997eb5eee55ba3ebe662ee
MD5 1f3d2d8de63489be882ac87f42acaf19
SHA1 b2f3649426fd1ec4500844c9b3583272412fbfd2
SHA512 0ea96694c7aa6928d5072fde91a6990eb89f2d15902570b7227a97f8ef53c5edf74c7a9f65b6d4fe405f027eb0940ca80220af0fa5d0e6e8e6eeca13bd0cef89
SSDEEP 49152:8mkWRVaAIoW8zN6wlOQGulxCChnuhiCO7xxEfudmICnzRFgEZmbW+mxhTCirI41f:X+SqNCAI41n0c9V6
TLSH
T12D565DE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\xulstore.json
Size 167B
SHA256 a261f6c4c1f49fbaac01d6d7437da1149f9b03588d54b2fd860fdfe969596115
MD5 e116daaa7b2ab9bd0f8985831cbbac49
SHA1 e7d1fed6c2125cee196699694b7f4532f20536c1
SHA512 5d0ccbfdd9e5160a07f658fcb99e7527fdaed658a3f7c78c9bec2b7fcba9025e88be25b804102b371307edc1aec5972752fcdb204239dbc5e65f7a3c59a268b8
TLSH
T1CFC08CB022AFA8087D27CBCF128D22983E398A5491D0529A7AEA94A018C470F9D18388
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2344-67-0x0000000002200000-0x00000000022DA000-memory.dmp

Download

memory/2344-1118-0x0000000002200000-0x00000000022DA000-memory.dmp

Download

memory/2636-1481-0x0000000002470000-0x000000000254A000-memory.dmp

Download

memory/2936-1120-0x00000000024B0000-0x000000000258A000-memory.dmp

Download

memory/3392-1508-0x0000000002470000-0x000000000254A000-memory.dmp

Download

memory/3392-1511-0x0000000002470000-0x000000000254A000-memory.dmp

Download

memory/3392-1513-0x0000000002470000-0x000000000254A000-memory.dmp

Download

memory/5052-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/5052-1-0x00000000025B0000-0x000000000268A000-memory.dmp

Download

memory/5052-64-0x00000000025B0000-0x000000000268A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads