Analysis
- user interaction
yes - max time kernel
674s - max time network
680s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 18:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
virus.exe
Resource
win11-20260130-en
windows11-21h2-x64
33 signatures
900 seconds
General
- Target virus.exe
- Size 107.6MB
- Sample260420-xefdesev3z
- SHA256 7dc8b7717f8d114440b4ad71bc25fb221f638a16dda65379508ef06b17cf7c80
- MD5 67891fcc7ae1db3a410c685f29639bb5
- SHA1 52462f46dfe368a9feafe6d8853062884606fa88
- SHA512 d891fc4ec7c0ae72c8a7f69449b58857edc1255750df14f2a7eac28b9d811c3a4eae96700210c7107edbac3c10d098e901dd33765c1593cf3ba830919cbc0d59
- SSDEEP 1572864:1kglH6u7onh1pAU5DVlY1x8Glj3Of7LqFdzLcBdyNyB13jSQDOqSWQ13:2gN6hlLJ84PqFdncBdyNsSmQV
- TLSH T1BD38338C94E35E5CE0F6F93CD142FE74014A22FA273657C357E92EAA35B6C512A39B04
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
pid Process 5568 powershell.exe 788 powershell.exe 196 powershell.exe 240 powershell.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 133 3280 firefox.exe - Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SET800.tmp NPFInstall.exe File created C:\Windows\system32\DRIVERS\SET800.tmp NPFInstall.exe File opened for modification C:\Windows\system32\DRIVERS\npcap.sys NPFInstall.exe - Manipulates Digital Signatures 1 TTPs 5 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION" certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION" certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL" certutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e certutil.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\0629C303220B256580AABA536A1A3C060B87E3A2\Blob = 0300000001000000140000000629c303220b256580aaba536a1a3c060b87e3a22000000001000000c7070000308207c3308205aba00302010202100675d6b59ef1b0ab30e5d2e046da2431300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3234303732353030303030305a170d3237303630393233353935395a3081cb31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c6177617265311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130736333937353838310b3009060355040613025553310f300d060355040813064f7265676f6e3112301006035504071309426561766572746f6e311a3018060355040a13114e6d617020536f667477617265204c4c43311a3018060355040313114e6d617020536f667477617265204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100e80f7d81d43b6e7f27c5a9d671bf92b5bb4ebe29ab087341abb94a189869339d2928269ff8a142a831cb6c77e45f8691375ae009280d148456ad7f817cd96d8beacd09980761fdd99d8ceb289dcb4f0da4030eeba61fcf227f3e42728e3d569fe239197d44ecf3b532ad126cff9a15aafc66807ba9d637aa3a5d4ab45189b835d15ccb5502513b00b8423b3c536b4bf3bc4374186237603223142f66881eb17f699f9467f66c829366b8d66788ba1268ccdac909e2024e53413abe2033825c8f94bdcc96f1464d7a5e3b0aea7aa7ed2daeb5579f40279c4d879ae167fc7f064a54a7f474cf8a8590e6f9c78efb7f4f6d396cc6b23c23c75a2a0ad7ced10e9d18d883508a01f87acc1bb3bc33db5464432be5e5042ab4e138ec6467b25b5362cce1a856fed1c8dcd3a1e58b4d7dbe38e2cb9a9a0f7af88de58678e948c295dbf1a7f35d4be1389ed802b3d1bc982c2272eaf13a8da04c005cef21ffac7eb292bd384bd33c726bb7fd469b6d5e926bd41728f0b1611a237334636858ad4f75393223d932cc857d863e8f22af3bdc39436fa31ceb6d03c8b655fd3afb34d168a092fb434b325060ccc64de0b399cacadcba02425f56433204bd44ec2c926453e154e73e3351c16c06f015d52e7c289b353fe5f08319e274ba63c3b48dfcd1b113896438e8a81552d1a7844deb8164d90393a1e1389787d759fe5bcf0cdfb00f9ccf0203010001a3820202308201fe301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e041604147bb55ac506010287feefade54638ade666ff1b9f303d0603551d20043630343032060567810c01033029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f435053300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c30819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63727430090603551d1304023000300d06092a864886f70d01010b050003820201007c007a47ac4224e18d5d0c7a795f8718070b8fbd59bae2fa4926029cc464cbca37ef70c683cc1762655f4a91faeac9de304a4193148ad807835a084389ef248237a374c248da6120446da39c10a46852e8fc2a594c031d2de6c19eb0ee6b4da8b5159ce9947ab5b977f805934aef11ccb98fc1b6e19ea41384dee1bbcbef2c8af5d267098662f8d72f82b98b180be27f3d0289469d27cc6981f67bc0753693272786ccbb49097c88669b6a0db0df5cda0434704c57854189dcaa8c3873ffa172f757ef28784442c0839ef92c62ca7314d6804ad4a28bc392c87ec592a207e4981513677e2f7f294db0f6109b5a80d9d04d364022cce1e0aaf29de55fae0756c87cd1c147e663168a518ce2de5e9e4de99b1c350d284277cc5bd15fcb8ba92f9aee6cf3632e9e8b972f7acb38c8ce4e4402b1b26a94f7cb09e8ecd7b817ed22e2e4c1faf3522c238459b1fd427b5e7c84efe3214b644223f650392928c815336264961eabda172f0898eb4a42eeaa033c4f0ade9068e7e3f964b2f788ba3c13aa1c2369afccac5810e166c2aeeaebb648af287673fe3dfc6d0a28597b7d2fe5dc4552f7ee1d018009868eb6967c57348ef0aa84af7e7f7e36dcaedaa5acb871b417292d7278ec31499e00015358d5e4dc4f280d656ecba18fe7ac5b9ee552874afdbfa7b64521a7ef962bd8b6c161f2f4c49434ba4e2b406e548dbaaec9b664b9 certutil.exe - Executes dropped EXE 24 IoCs
pid Process 768 Wireshark-4.6.4-x64.exe 5628 vc_redist.x64.exe 5664 vc_redist.x64.exe 5928 VC_redist.x64.exe 1764 VC_redist.x64.exe 1512 VC_redist.x64.exe 3140 VC_redist.x64.exe 5944 npcap-1.86.exe 5772 VC_redist.x64.exe 5996 NPFInstall.exe 5124 NPFInstall.exe 2180 NPFInstall.exe 5784 NPFInstall.exe 3584 Wireshark.exe 3216 etwdump.exe 6192 etwdump.exe 6376 dumpcap.exe 6320 etwdump.exe 6460 dumpcap.exe 2276 Wireshark.exe 3356 etwdump.exe 4600 etwdump.exe 2452 dumpcap.exe 3544 etwdump.exe - Loads dropped DLL 64 IoCs
pid Process 692 virus.exe 692 virus.exe 692 virus.exe 768 Wireshark-4.6.4-x64.exe 768 Wireshark-4.6.4-x64.exe 768 Wireshark-4.6.4-x64.exe 768 Wireshark-4.6.4-x64.exe 768 Wireshark-4.6.4-x64.exe 768 Wireshark-4.6.4-x64.exe 768 Wireshark-4.6.4-x64.exe 768 Wireshark-4.6.4-x64.exe 5664 vc_redist.x64.exe 4284 VC_redist.x64.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 3140 VC_redist.x64.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 5944 npcap-1.86.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe 3584 Wireshark.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\Npcap\wpcap.dll npcap-1.86.exe File created C:\Windows\system32\Npcap\WlanHelper.exe npcap-1.86.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\SysWOW64\Npcap\WlanHelper.exe npcap-1.86.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2} DrvInst.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\npcap.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_3debe5e78bab1bca\netbrdg.PNF NPFInstall.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_10acfa4b924dd181\netnb.PNF NPFInstall.exe File created C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\wfpcapture.PNF NPFInstall.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\Npcap\NpcapHelper.exe npcap-1.86.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_882899f2b1006416\netvwififlt.PNF NPFInstall.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\SysWOW64\Npcap\Packet.dll npcap-1.86.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\SET699.tmp DrvInst.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\SET69B.tmp DrvInst.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\SysWOW64\Npcap\NpcapHelper.exe npcap-1.86.exe File created C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\SET699.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\SET69A.tmp DrvInst.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\SET69B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_bc519c177a90877a\c_netservice.PNF NPFInstall.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_e67f4c527577a0b9\NPCAP.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_72f156a5ee3f59e8\netrass.PNF NPFInstall.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\Npcap\Packet.dll npcap-1.86.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Wireshark\snmp\mibs\DS0-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\DS3-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\editcap.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\AppToolscapinfos.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\diameter\eap.xml Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\GMPLS-LABEL-STD-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\ChWirelessWLANTraffic.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-main.png Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\diameter\dictionary.ent Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\PPP-BRIDGE-NCP-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\ROHC-UNCOMPRESSED-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\ChTelSIPFlows.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.motorola.illegal Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\RFC1382-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\TCP-ESTATS-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\ChProtobufUDPMessageTypes.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\ChStatConversations.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\ChTelISUPMessages.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-capture-menu.png Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\diameter\Vodafone.xml Wireshark-4.6.4-x64.exe File opened for modification C:\Program Files\Npcap\NPFInstall.log NPFInstall.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-pref-appearance-columns.png Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.shiva Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Qt6Multimedia.dll Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\TCPIPX-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\ChUsePacketListPaneSection.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\ChWorkDisplayFilterSection.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\README.radius_dictionary Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.travelping Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\IPV6-ICMP-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\SNMP-PROXY-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-export-pdus-to-file.png Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.foundry Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\COFFEE-POT-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\RSERPOOL-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.ciena Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.ukerna Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\DISMAN-SCRIPT-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\EFM-CU-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\LMP-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\NOTIFICATION-LOG-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\POLICY-DEVICE-AUX-MIB-orig Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\ACCESSBIND-PIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.terena Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\networkinformation\qnetworklistmanager.dll Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\DNS-SERVER-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\NAT-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\NTPv4-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\RFC1381-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\SNMPv2-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\POLICY-FRAMEWORK-PIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\zlib1.dll Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.clavister Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.ericsson.packet.core.networks Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.rfc4072 Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.ruckus Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\translations\qt_uk.qm Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\GMPLS-TC-STD-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\SCTP-MIB Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\snmp\mibs\ietf-netconf.yang Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\ChSNMPUsersSection.html Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-expert-column.png Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\Wireshark User's Guide\images\ws-pingpongprotocol-statistics.png Wireshark-4.6.4-x64.exe File created C:\Program Files\Wireshark\radius\dictionary.eleven Wireshark-4.6.4-x64.exe - Drops file in Windows directory 29 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF8A0E5BA483C8E686.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB04D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB177.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF4D170AAA4BBEFEE8.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53} msiexec.exe File opened for modification C:\Windows\Installer\MSIAE48.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE52577268E2AAAE9.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF741A6CCFD7362CD5.TMP msiexec.exe File opened for modification C:\Windows\Installer\e59aacd.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF6C085B1C131A5910.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF68AE1C38C117BC98.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIACFF.tmp msiexec.exe File created C:\Windows\Installer\e59aadf.msi msiexec.exe File created C:\Windows\SystemTemp\~DFA8D0F02501E68D3B.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\SystemTemp\~DF641A7B136EAE3610.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF} msiexec.exe File created C:\Windows\INF\oem3.PNF NPFInstall.exe File created C:\Windows\Installer\e59aacd.msi msiexec.exe File opened for modification C:\Windows\Installer\e59aae0.msi msiexec.exe File created C:\Windows\Installer\e59aaf5.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log NPFInstall.exe File created C:\Windows\Installer\e59aae0.msi msiexec.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\Wireshark-4.6.4-x64.exe:Zone.Identifier firefox.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npcap-1.86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wireshark-4.6.4-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virus.exe - Checks SCSI registry key(s) 3 TTPs 43 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 NPFInstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 NPFInstall.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009f1d998fde3c4bea0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009f1d998f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009f1d998f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9f1d998f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9f1d998f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ NPFInstall.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ NPFInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe - Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString dumpcap.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 Wireshark.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString dumpcap.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString dumpcap.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 dumpcap.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Wireshark.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString Wireshark.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 Wireshark.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString dumpcap.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 dumpcap.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor dumpcap.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 dumpcap.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString Wireshark.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 Wireshark.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString dumpcap.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString Wireshark.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies data under HKEY_USERS 59 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ttl\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bfr\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wpc\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.enc\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ttl Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.out Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.trace Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.trc Wireshark-4.6.4-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wpz\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\PackageCode = "51FBA0EFEFDB3494A815FAF727EE72D7" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\DefaultIcon Wireshark-4.6.4-x64.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\.cap Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ntar\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pklg\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\VC_Runtime_Minimum msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}v14.44.35211\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rtp\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rf5\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.snoop\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\ = "{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}" VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pcap Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pcap\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vwr Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wpc Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wpz Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.44.35211" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\Shell\open Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ems Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fdc Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mplog Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{43B0D101-A022-48F4-9D04-BA404CEB1D53}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\9CC2BA68DB8034640B9F8FD200D627FF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wireshark-capture-file\DefaultIcon\ = "\"C:\\Program Files\\Wireshark\\Wireshark.exe\",1" Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.5vw Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.trace\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ems\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mplog\ = "wireshark-capture-file" Wireshark-4.6.4-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ntar Wireshark-4.6.4-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.44.35211" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF msiexec.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\Wireshark-4.6.4-x64.exe:Zone.Identifier firefox.exe - Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3584 Wireshark.exe 2276 Wireshark.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe 4396 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 768 Wireshark-4.6.4-x64.exe 3584 Wireshark.exe 2276 Wireshark.exe - Suspicious behavior: LoadsDriver 5 IoCs
pid Process 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3280 firefox.exe Token: SeDebugPrivilege 3280 firefox.exe Token: SeBackupPrivilege 6024 vssvc.exe Token: SeRestorePrivilege 6024 vssvc.exe Token: SeAuditPrivilege 6024 vssvc.exe Token: SeShutdownPrivilege 5928 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 5928 VC_redist.x64.exe Token: SeSecurityPrivilege 4396 msiexec.exe Token: SeCreateTokenPrivilege 5928 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 5928 VC_redist.x64.exe Token: SeLockMemoryPrivilege 5928 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 5928 VC_redist.x64.exe Token: SeMachineAccountPrivilege 5928 VC_redist.x64.exe Token: SeTcbPrivilege 5928 VC_redist.x64.exe Token: SeSecurityPrivilege 5928 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 5928 VC_redist.x64.exe Token: SeLoadDriverPrivilege 5928 VC_redist.x64.exe Token: SeSystemProfilePrivilege 5928 VC_redist.x64.exe Token: SeSystemtimePrivilege 5928 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 5928 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 5928 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 5928 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 5928 VC_redist.x64.exe Token: SeBackupPrivilege 5928 VC_redist.x64.exe Token: SeRestorePrivilege 5928 VC_redist.x64.exe Token: SeShutdownPrivilege 5928 VC_redist.x64.exe Token: SeDebugPrivilege 5928 VC_redist.x64.exe Token: SeAuditPrivilege 5928 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 5928 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 5928 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 5928 VC_redist.x64.exe Token: SeUndockPrivilege 5928 VC_redist.x64.exe Token: SeSyncAgentPrivilege 5928 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 5928 VC_redist.x64.exe Token: SeManageVolumePrivilege 5928 VC_redist.x64.exe Token: SeImpersonatePrivilege 5928 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 5928 VC_redist.x64.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe - Suspicious use of FindShellTrayWindow 22 IoCs
pid Process 3280 firefox.exe 3280 firefox.exe 3280 firefox.exe 3280 firefox.exe 3280 firefox.exe 3280 firefox.exe 3280 firefox.exe 3280 firefox.exe 6800 WindowsTerminal.exe 3916 firefox.exe 3916 firefox.exe 3916 firefox.exe 3916 firefox.exe 3916 firefox.exe 3916 firefox.exe 3916 firefox.exe 6360 firefox.exe 6360 firefox.exe 6360 firefox.exe 6360 firefox.exe 6360 firefox.exe 6360 firefox.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3280 firefox.exe 3280 firefox.exe 3280 firefox.exe 3280 firefox.exe 6800 WindowsTerminal.exe 3916 firefox.exe 2428 MiniSearchHost.exe 6360 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3628 wrote to memory of 3280 3628 firefox.exe 81 PID 3628 wrote to memory of 3280 3628 firefox.exe 81 PID 3280 wrote to memory of 3400 3280 firefox.exe 82 PID 3280 wrote to memory of 3400 3280 firefox.exe 82 PID 3280 wrote to memory of 3400 3280 firefox.exe 82 PID 3280 wrote to memory of 1632 3280 firefox.exe 83 PID 3280 wrote to memory of 1632 3280 firefox.exe 83 PID 3280 wrote to memory of 1632 3280 firefox.exe 83 PID 3280 wrote to memory of 1632 3280 firefox.exe 83 PID 3280 wrote to memory of 1400 3280 firefox.exe 84 PID 3280 wrote to memory of 1400 3280 firefox.exe 84 PID 3280 wrote to memory of 1400 3280 firefox.exe 84 PID 3280 wrote to memory of 1400 3280 firefox.exe 84 PID 3280 wrote to memory of 1524 3280 firefox.exe 85 PID 3280 wrote to memory of 1524 3280 firefox.exe 85 PID 3280 wrote to memory of 1524 3280 firefox.exe 85 PID 3280 wrote to memory of 4576 3280 firefox.exe 86 PID 3280 wrote to memory of 4576 3280 firefox.exe 86 PID 3280 wrote to memory of 4576 3280 firefox.exe 86 PID 3280 wrote to memory of 4576 3280 firefox.exe 86 PID 3280 wrote to memory of 3188 3280 firefox.exe 87 PID 3280 wrote to memory of 3188 3280 firefox.exe 87 PID 3280 wrote to memory of 3188 3280 firefox.exe 87 PID 3280 wrote to memory of 3188 3280 firefox.exe 87 PID 3280 wrote to memory of 1324 3280 firefox.exe 88 PID 3280 wrote to memory of 1324 3280 firefox.exe 88 PID 3280 wrote to memory of 1324 3280 firefox.exe 88 PID 3280 wrote to memory of 1324 3280 firefox.exe 88 PID 3280 wrote to memory of 4176 3280 firefox.exe 89 PID 3280 wrote to memory of 4176 3280 firefox.exe 89 PID 3280 wrote to memory of 4176 3280 firefox.exe 89 PID 3280 wrote to memory of 4176 3280 firefox.exe 89 PID 3280 wrote to memory of 3976 3280 firefox.exe 90 PID 3280 wrote to memory of 3976 3280 firefox.exe 90 PID 3280 wrote to memory of 3976 3280 firefox.exe 90 PID 3280 wrote to memory of 3976 3280 firefox.exe 90 PID 3280 wrote to memory of 4504 3280 firefox.exe 91 PID 3280 wrote to memory of 4504 3280 firefox.exe 91 PID 3280 wrote to memory of 4504 3280 firefox.exe 91 PID 3280 wrote to memory of 4504 3280 firefox.exe 91 PID 3280 wrote to memory of 2876 3280 firefox.exe 92 PID 3280 wrote to memory of 2876 3280 firefox.exe 92 PID 3280 wrote to memory of 2876 3280 firefox.exe 92 PID 3280 wrote to memory of 2876 3280 firefox.exe 92 PID 3280 wrote to memory of 3148 3280 firefox.exe 93 PID 3280 wrote to memory of 3148 3280 firefox.exe 93 PID 3280 wrote to memory of 3148 3280 firefox.exe 93 PID 3280 wrote to memory of 3148 3280 firefox.exe 93 PID 3280 wrote to memory of 4024 3280 firefox.exe 94 PID 3280 wrote to memory of 4024 3280 firefox.exe 94 PID 3280 wrote to memory of 4024 3280 firefox.exe 94 PID 3280 wrote to memory of 4024 3280 firefox.exe 94 PID 3280 wrote to memory of 768 3280 firefox.exe 95 PID 768 wrote to memory of 5628 768 Wireshark-4.6.4-x64.exe 96 PID 5628 wrote to memory of 5664 5628 vc_redist.x64.exe 97 PID 5664 wrote to memory of 5928 5664 vc_redist.x64.exe 98 PID 1764 wrote to memory of 1512 1764 VC_redist.x64.exe 105 PID 1512 wrote to memory of 3140 1512 VC_redist.x64.exe 106 PID 5928 wrote to memory of 4872 5928 VC_redist.x64.exe 107 PID 4872 wrote to memory of 4284 4872 VC_redist.x64.exe 108 PID 4284 wrote to memory of 5540 4284 VC_redist.x64.exe 109 PID 768 wrote to memory of 5944 768 Wireshark-4.6.4-x64.exe 110 PID 3140 wrote to memory of 5772 3140 VC_redist.x64.exe 111 PID 5944 wrote to memory of 5996 5944 npcap-1.86.exe 116 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\virus.exe"C:\Users\Admin\AppData\Local\Temp\virus.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:692
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {c5518813-2009-4a2a-951a-9fc730355469} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:3400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {dac5951d-4dc7-4abf-82b5-f81a4b04d588} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:1632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27274 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {d240b08a-6eef-4246-a8f8-38e06c389570} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:1400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27274 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {d4caeea1-2d83-400d-a0fa-c71d84f7d277} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:1524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4540 -prefsLen 34773 -prefMapHandle 4544 -prefMapSize 270279 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2624 -initialChannelId {d03dc2c9-8443-42e2-ae88-ffd39eb52cb1} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:4576
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 34822 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 4880 -initialChannelId {9830216f-2091-4345-a229-0d717625cee3} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵PID:3188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 33031 -prefMapHandle 3196 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5716 -initialChannelId {4f6fa906-8407-4b1b-bcc2-4dbb623a519b} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵PID:1324
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5884 -prefsLen 33031 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 5728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5916 -initialChannelId {fb396d66-16a6-4e65-8420-44be696efc78} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:4176
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6100 -prefsLen 33031 -prefMapHandle 6096 -prefMapSize 270279 -jsInitHandle 6092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6084 -initialChannelId {7edfebca-e456-47b1-96a5-5050c0601c51} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵PID:3976
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2448 -prefsLen 33071 -prefMapHandle 2692 -prefMapSize 270279 -jsInitHandle 2724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {84abe9d4-8b5f-4b21-b230-c4aa057dce5b} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵PID:4504
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 33071 -prefMapHandle 2448 -prefMapSize 270279 -jsInitHandle 4892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6560 -initialChannelId {c36fa43e-e6fa-4b4f-9d25-d377e168b6d4} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:2876
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6672 -prefsLen 36758 -prefMapHandle 6052 -prefMapSize 270279 -jsInitHandle 6072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6800 -initialChannelId {12f80dbe-d8a2-44bb-acc6-42e7685e25bb} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵PID:3148
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6068 -prefsLen 36758 -prefMapHandle 6312 -prefMapSize 270279 -jsInitHandle 6076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6852 -initialChannelId {617fd427-9b1f-426c-a060-33334b5f4ef1} -parentPid 3280 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵PID:4024
-
-
C:\Users\Admin\Downloads\Wireshark-4.6.4-x64.exe"C:\Users\Admin\Downloads\Wireshark-4.6.4-x64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Program Files\Wireshark\vc_redist.x64.exe"C:\Program Files\Wireshark\vc_redist.x64.exe" /install /quiet /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\Temp\{2B2CDCB8-4521-4353-BE67-C8310B74AC89}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{2B2CDCB8-4521-4353-BE67-C8310B74AC89}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Wireshark\vc_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /install /quiet /norestart5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\Temp\{A8124D93-BEE3-4AF8-AFAA-E467798B4CDA}\.be\VC_redist.x64.exe"C:\Windows\Temp\{A8124D93-BEE3-4AF8-AFAA-E467798B4CDA}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D445A954-40AF-4BCF-9D4B-95878C244F3D} {8F5B116C-5DD3-493C-B296-39E3FF274EFC} 56646⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1244 -burn.embedded BurnPipe.{D3D13183-BC96-4CD8-903C-6714FEE37B83} {D0D580A7-3823-44A4-9C8C-AA2CBDA2FD53} 59287⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1244 -burn.embedded BurnPipe.{D3D13183-BC96-4CD8-903C-6714FEE37B83} {D0D580A7-3823-44A4-9C8C-AA2CBDA2FD53} 59288⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B2F12621-3F08-4B36-BFC2-3F46AE4FDF0B} {95BD1DA4-C00D-47F4-BA9B-9C083E174D34} 42849⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5540
-
-
-
-
-
-
-
C:\Program Files\Wireshark\npcap-1.86.exe"C:\Program Files\Wireshark\npcap-1.86.exe" /winpcap_mode=no /loopback_support=no4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\NPFInstall.exe"C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\NPFInstall.exe" -n -check_dll5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5996
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
PID:5568
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4){certutil.exe -verifystore 'Root' 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4}}"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
PID:788
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -verifystore "Root" "DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"5⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
PID:780
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst"5⤵
- System Location Discovery: System Language Discovery
PID:3508
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\signing.p7b"5⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
PID:4180
-
-
C:\Windows\SysWOW64\certutil.execertutil.exe -addstore -f "AddressBook" "C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\digi-ts-2023.p7b"5⤵
- System Location Discovery: System Language Discovery
PID:1968
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -c5⤵
- Executes dropped EXE
PID:5124 -
C:\Windows\SYSTEM32\pnputil.exepnputil.exe -e6⤵PID:2168
-
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -iw5⤵
- Executes dropped EXE
PID:2180
-
-
C:\Program Files\Npcap\NPFInstall.exe"C:\Program Files\Npcap\NPFInstall.exe" -n -i5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5784
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
PID:196
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
PID:240
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6024
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4396
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420195152.log" /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420195152.log" /install3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E34CF244-5248-4A2D-B226-E78428AD70F9} {1E514C1D-0DF6-4709-9EF8-8A7DD7789DD8} 31404⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5772
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵PID:568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:6136 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5db5d76d-32f4-224b-974f-0ddb930a0c24}\NPCAP.inf" "9" "405306be3" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\Npcap"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5792
-
-
C:\Program Files\Wireshark\Wireshark.exe"C:\Program Files\Wireshark\Wireshark.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:3584 -
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.62⤵
- Executes dropped EXE
PID:3216
-
-
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump2⤵
- Executes dropped EXE
PID:6192
-
-
C:\Program Files\Wireshark\dumpcap.exe"C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S -D -L --signal-pipe 3584.dummy -Z 16922⤵
- Executes dropped EXE
- Checks processor information in registry
PID:6376
-
-
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump2⤵
- Executes dropped EXE
PID:6320
-
-
C:\Program Files\Wireshark\dumpcap.exe"C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S --signal-pipe 3584.dummy -Z 40842⤵
- Executes dropped EXE
- Checks processor information in registry
PID:6460
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6800 -
C:\Windows\system32\wsl.exeC:\Windows\system32\wsl.exe --list2⤵PID:6868
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa2c --server 0xa282⤵PID:7060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe2⤵PID:7064
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" start npcap3⤵PID:2092
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start npcap4⤵PID:2428
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:5168
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3916 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 31069 -prefMapHandle 1952 -prefMapSize 270978 -ipcHandle 2036 -initialChannelId {46d4adef-7e7f-4287-b00b-a129bae990d9} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:5712
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2276 -prefsLen 31069 -prefMapHandle 2280 -prefMapSize 270978 -ipcHandle 2288 -initialChannelId {d95bfcf0-9190-499f-a830-10ac92a015c8} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:4408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 31677 -prefMapHandle 3856 -prefMapSize 270978 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {01ebabb9-ee11-4cb0-a853-42785ed3aa9a} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:4328
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4092 -prefsLen 31677 -prefMapHandle 4100 -prefMapSize 270978 -ipcHandle 4108 -initialChannelId {204717cb-5ff1-4925-a4d6-cd3c1aca375a} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:2972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4508 -prefsLen 39233 -prefMapHandle 4520 -prefMapSize 270978 -jsInitHandle 4524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {c97439cd-6c4e-4048-ab49-d946226c4667} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5388 -prefsLen 39233 -prefMapHandle 5392 -prefMapSize 270978 -ipcHandle 5396 -initialChannelId {685a36c1-1687-4aa3-b1a8-e06abcb3394c} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:5392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2704 -prefsLen 36275 -prefMapHandle 2464 -prefMapSize 270978 -jsInitHandle 2272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {399acd72-2e0a-469a-aa35-8a8feec8b377} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵PID:1548
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3492 -prefsLen 36275 -prefMapHandle 3024 -prefMapSize 270978 -jsInitHandle 3164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4784 -initialChannelId {640a7746-e3c4-46b9-b5a8-411ca619b8a8} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:4716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5920 -prefsLen 36275 -prefMapHandle 5924 -prefMapSize 270978 -jsInitHandle 5928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5936 -initialChannelId {76e7008a-c3e5-46a2-9f6b-a9233ae5b0b0} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵PID:6012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6488 -prefsLen 36315 -prefMapHandle 6496 -prefMapSize 270978 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6508 -initialChannelId {e09353e6-8596-4da3-8f3f-346b750ed927} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵PID:7156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6528 -prefsLen 39432 -prefMapHandle 6628 -prefMapSize 270978 -ipcHandle 6320 -initialChannelId {27ba128c-4217-4318-a333-2bc7c05d1583} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility3⤵PID:5696
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6892 -prefsLen 36315 -prefMapHandle 6896 -prefMapSize 270978 -jsInitHandle 6900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6908 -initialChannelId {6d971563-e551-41ca-865e-2dcfac119990} -parentPid 3916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵PID:5524
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2428
-
C:\Program Files\Wireshark\Wireshark.exe"C:\Program Files\Wireshark\Wireshark.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:2276 -
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.62⤵
- Executes dropped EXE
PID:3356
-
-
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump2⤵
- Executes dropped EXE
PID:4600
-
-
C:\Program Files\Wireshark\dumpcap.exe"C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S -D -L --signal-pipe 2276.dummy -Z 17442⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2452
-
-
C:\Program Files\Wireshark\extcap\etwdump.exe"C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump2⤵
- Executes dropped EXE
PID:3544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:5648
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6360 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 31069 -prefMapHandle 1956 -prefMapSize 270978 -ipcHandle 2040 -initialChannelId {f36a455d-4850-44fe-91e1-2a7b3fd71ee3} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:5596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2292 -prefsLen 31069 -prefMapHandle 2296 -prefMapSize 270978 -ipcHandle 2260 -initialChannelId {9f6b8d99-3a72-46cb-96a6-eb07ffda8139} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:1720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 31677 -prefMapHandle 3796 -prefMapSize 270978 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {18aec619-f469-49d9-a984-4b7882f00d8c} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:4748
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3988 -prefsLen 31677 -prefMapHandle 3992 -prefMapSize 270978 -ipcHandle 4000 -initialChannelId {a18c8f40-71e6-4048-b979-c12cfd9a2a67} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:5508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4748 -prefsLen 39287 -prefMapHandle 4752 -prefMapSize 270978 -jsInitHandle 4756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4764 -initialChannelId {37505235-9aee-4ea8-94de-d65d2fbe5245} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵PID:6256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5216 -prefsLen 39287 -prefMapHandle 5292 -prefMapSize 270978 -ipcHandle 5352 -initialChannelId {95397da6-d876-4974-b20f-ce83ede187e9} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:5632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2456 -prefsLen 36222 -prefMapHandle 2452 -prefMapSize 270978 -jsInitHandle 5476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5708 -initialChannelId {ff2b5e4d-6a08-4c84-8bf9-db7055549bbf} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:4652
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 36222 -prefMapHandle 5848 -prefMapSize 270978 -jsInitHandle 5844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5892 -initialChannelId {47f83b6e-eb1c-4653-ae02-7679a55929ec} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵PID:4464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6112 -prefsLen 36222 -prefMapHandle 6116 -prefMapSize 270978 -jsInitHandle 6120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6068 -initialChannelId {a25e7df9-bfda-4b79-b0e7-6f01bdea7cb3} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:1064
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5908 -prefsLen 36262 -prefMapHandle 3248 -prefMapSize 270978 -jsInitHandle 1292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6380 -initialChannelId {6cd5c655-79cf-4674-bbf4-b34ea66a343a} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:7048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6672 -prefsLen 39379 -prefMapHandle 6676 -prefMapSize 270978 -ipcHandle 1292 -initialChannelId {c90dd547-4e70-45b7-8ed3-194ca263da3a} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility3⤵PID:3224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5804 -prefsLen 36262 -prefMapHandle 6268 -prefMapSize 270978 -jsInitHandle 6792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1292 -initialChannelId {71e763dd-5d04-4f58-8f9f-274498af07d3} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵PID:856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6352 -prefsLen 36262 -prefMapHandle 6256 -prefMapSize 270978 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {b7f0fc52-9533-4f9d-b9f7-f6777835c964} -parentPid 6360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵PID:3544
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2SIP and Trust Provider Hijacking
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59aad2.rbs
- Size 19KB
- SHA256 dd652b5c6d36846f2691200cfadfaf53a14cad15a0d2263ba5e5ebfb736455fb
- MD5 ce20a052d7c393d6f85540a7ec472d5a
- SHA1 0a48bce36c7075a438057c3187937018b93bf313
- SHA512 3c9200a46ce0c8fb17a088911f75aeebef6470975c811603101f210ea915b87a30e88631484bae9f939d15475566764016c224ce43abcb8cc0ad61ba054f54ee
- SSDEEP 192:nvlR/1kRf15dXcFUADIc1f+W+y4+ogP1D7:nvlR/6RfTeC81f/cOD7
- TLSH T137920C42A680C9D3D8766B70CD671B653B76DBD9A350438B50DC90308F93BCA2F9DA8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59aade.rbs
- Size 19KB
- SHA256 b5c68b01507396464d2aef240d3375b01b86fbf5c03ac3c8b873c0129517d878
- MD5 016893904c50759453710a82ded094bd
- SHA1 e36c7080d67ce570c4c59779515b4746d84ddbac
- SHA512 906defc0d876acb256061d507a823b6314fc3401031502dadb913602052eb3a806bf8bfdbd508720044040389b1d344e181c809a92e3a067034f42d995de1f81
- SSDEEP 384:nvOOGnJXMjZ7Up+BFqiO6hSgJK0uJK0GoaOD8Lfv/8c3zMZxq+nNwzQ6R:nvOOGnJXMjZ7Up+BFIUKFKx
- TLSH T19892BA026640C5E3D8A62B70DD4B67243BB5D7CAA355A38B41DCC1708FA77CA7F8D24A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59aae5.rbs
- Size 21KB
- SHA256 3f627cbfebefab88dddf45d475a12d4f4d5ace6b4ee0a743df07570a699d6a77
- MD5 a997bd9766292eb36e2b779390bd5667
- SHA1 433751b60575b68664f5895a0bdd4928bacac894
- SHA512 6118d2faa68282ff052b02daa365b71ccfe7f5571f3f5a3af279a35a6f4947e9a18ff712413721a7623242e8f1b14df24a03b70f26350f0a5ab956755d3b894f
- SSDEEP 384:nvzR+GRGnAKxNAUhUC7xJjrMNYPzIbSfGeE/m+J6H8JHkP:nv9XSAKhkmZ
- TLSH T111A21E03768099E3D86627B1DD671BA43B73D7D99350434B10ECD1388F633C72E9AA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59aaf4.rbs
- Size 21KB
- SHA256 5ac3394eef671b153808c9acb5ff3cb1484c7787145d1e92bc7e9c78bbe0994e
- MD5 820f3cfece945e35d119ca473c98af40
- SHA1 62f722576ede3df22bbd6da79709018408a5833a
- SHA512 652c9ddaf4ae4d5b3894b3995efe7599212fbdf62633cafd1908a670d67144974b8c102846aee4b5cbeab99f174da703e0804d149616dac53d80f9b1c252b3e7
- SSDEEP 384:nvrqvDIAZxEth/phSYjK4WbJGwazsalckU72eC6jJkE5KsJ9UJ9sr76c+0dWg:nvsDIAZxEth/phSYujbJpTpIWr76/0dP
- TLSH T16FA20E42BA40D2D3D8A62B70CD975B2437B5D3DAA755474B00CC90348F937DA2F9AACB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Npcap\NPCAP_wfp.inf
- Size 2KB
- SHA256 cac90dbb6cbe96adcfcd75df8bec86c41ab64a59fdd31ef1bce902b59c479090
- MD5 2e9ed86283f378a665507527ee8c9878
- SHA1 d3017a8f3086297113addd52f873ecd5ce8ca1ba
- SHA512 5ff56cc217c600f8a3e968903c06812d4effd5300823e65b7ba24ef686dcea958bd1fc8525cb5acd935068f4330560a91d9368707efd9a6584d7be8ea619d3b3
- TLSH T1384132490D8647705056E69B6B0304C2EA7E118765FC515CB3AEE0AEEB59E0D623CCFB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 7KB
- SHA256 70a8a1fe5b902b2b395a5466c5403bd7793774fb206b091bef7979d0f9c5b15c
- MD5 9ef2942089f3299aae3a27644c0756a7
- SHA1 bfddfee5223a414ecef3dc0d727643337f14ebff
- SHA512 d8ea02614084dacd5479ccf3c2f4bfb0973e0b94696e51ec06a325560c9cb224a3159d688dd322ee87566cc6dd734ff2b24beef81208985df993611a511b59cc
- SSDEEP 192:T0jyfpEEtMM2XaQ5Lprzr7+U+Ey5vpTEYZhioMcsGNlmX7dQo6q4iX39qREe:T0jyfpEEtMM2XaQ5Lp3/+U+Ey5vpTEYd
- TLSH T1E4F1D2212DED20E0E5ED92A4B6176CBB1F86F24342F740F2BB09D5680FC640D5EDAB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 11KB
- SHA256 ae00d6dbba9d3b07032c3094b5ee4483fa125f059591de127cf9fc61fd695a66
- MD5 e4fcc7cb3e9d8ef3f200b5ba451a28d2
- SHA1 8cdcb93e6cd7b93689035c31746c4c9f1c8cc4db
- SHA512 afd8eb851727936d53d98f219ee675dcec1dcd5013017eafb756985b55a7dbb4acdc45d4498ad668e21b9192ee16ec48fe1d0432a78833bcec7fccbe4d99e863
- SSDEEP 192:T0jyfpEEtMM2XaQ5Lprzr7+U+Ey5vpTEYZhioMcsGNlmX7dQo6q4iX39qRER6X68:T0jyfpEEtMM2XaQ5Lp3/+U+Ey5vpTEY3
- TLSH T1F332E2212DFD20E0E5ED92A4B6176CBB1F86F24342F740B2BB09D5680FC640D5EDAB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 13KB
- SHA256 9effbd288041b00df4a0316bbc8c9fdd0541cf360a3f58b5070a0512a4a9522a
- MD5 a5046ceb87a8c0862471dd160c59bfeb
- SHA1 47c0ca0b2070632cff561411f909993842d7bf4b
- SHA512 d79614ab651de75c9dbc3b3fd20355ff453e57feedcc2d1af1bde2eb0efb88b80b84e3c05cc04a167a31103737f68108d985927ebab068fd30baa19c400810c2
- SSDEEP 384:T0jyfpEEtMM2XaQ5Lp3/+U+Ey5vpTEYZhioMcsGNlS7dQo6q4iX39qRER6X6QL6Y:T0jyfpEEtMM2XaQ5Lp3/+U+Ey5vpTEY5
- TLSH T1DD52F1212DED60E0E5ED9290B6076CAB1F86F24302F740B6BB0DD5680FC640D9FDAB45
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Npcap\NPFInstall.log
- Size 13KB
- SHA256 3b890558aa5c71c4515861a1691eca9db062d8bebd301234295fbe2243dcaa22
- MD5 404a1b516fa9bf43dd3256ff572556e0
- SHA1 f8efe999baeda8f813d3f8f4d634de8639afe813
- SHA512 415ae1222a0462b7f024b4736921e22b0799a25546f43da0cf2d59a1fa7dbe1c7fb184e3a765e5e7019ff08a34da0188411c51c75f1f481f9135590c9c19c1a4
- SSDEEP 384:T0jyfpEEtMM2XaQ5Lp3/+U+Ey5vpTEYZhioMcsGNlS7dQo6q4iX39qRER6X6QL6o:T0jyfpEEtMM2XaQ5Lp3/+U+Ey5vpTEYn
- TLSH T1E652F1212DFD60E0E5ED9294B6076CAB1F86F24302F740B6BB0AD5680F8604D9FDAB55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Wireshark\dumpcap.exe
- Size 544KB
- SHA256 7bded1b76583fcbeb8dabca3eece135666741d6dd249014330d99b4a81ee05ea
- MD5 85c6d834379ddf7fdbda18d35e0610c4
- SHA1 3c5d09efbd11d983f2726a3bbc795fcd675a5f7a
- SHA512 f0965881ca3b1eeb9b905f00ab00199f74f54d00f17493d3a642a6816c46df3e3e92b6e6228c07e720a46c66e111e727f823b8d7a27a2c1d45f241e64d2af32a
- SSDEEP 12288:RqM7ja7Mi9V57+82KVzZvKL6bdWqBj5IjFP9hu:RRj1i97+GVzZvKL60qV5QBXu
- TLSH T168C43A9437C4D9E2DEE2113A8003B775A1B36EEC57A0A1CFAB5CB70637339D8647A158
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Wireshark\extcap\etwdump.exe
- Size 348KB
- SHA256 62e207aca197004a47488a81893df08318b9c5fdcd3d3271bfada5cd1ff205a2
- MD5 9c122f011eec8afd80a38650560638c5
- SHA1 e08c49d6c977299c79d3a3aba84ed656e192075f
- SHA512 9ec17aa7f3b70155f96f820e954cc0c18380efeb59a1ca606657f0cf9436299ab3de12927f183c3ee11c2f74c557bdf3bf6ecbb6ba2013ee81844a1293f42f21
- SSDEEP 1536:BMcN06GSZRkAoyTuyKAq8g9k5Khy7T7ODuYUg48o0VBgWHncnFPXavErjnCj2WeT:Wx6zZR3oyFDgm5K4yr2rFP0oBjb1ge
- TLSH T1D974B6E46BC5E5E2DEE012368003B7B835675FFDAAF0241DEA4CB7053674CD829BA458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Wireshark\npcap-1.86.exe
- Size 1.3MB
- SHA256 a4f7ab0c5850b819dc7a131213c16a9deaf8d32bceed7131fea38740ea788503
- MD5 3e0d78fba254cdbdb422ebea1d0e84a2
- SHA1 5b3c7d276c7acd9e4e23d8ced04c204441b83046
- SHA512 ecf1b28d7901f1eb67f77a2f42ac879b2c3de5fe3167a0772ac8275193fea100e5d03a20c955223feae06f255ee828ae00b14183b5c1a9e49a24ae19bd9913d9
- SSDEEP 24576:rF0Sg84ZIcpGJjTAhBJImfKmQDDY49VA4yiFH/i01Bnn:ySVBZn6I1m6TFa4
- TLSH T1A1552392A7F8E41BDDE65630F1F19B4941E670100D92C5DADB08EF0E6D2AB427E1C36B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Wireshark\vc_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
- Size 900B
- SHA256 67d4e16380c480041e8d7c31faa72e6fe7352f0d235428ae73981459aea7fc3a
- MD5 00126f53bd11c3cf16f77bb7ae218d03
- SHA1 a2a4906e11c5ca9a8226d49e658066d9e5b1a1e1
- SHA512 42cea28bfb57c4b78ea762d38f88bb2b8c75e9aa08964805fdc185a4373443784dd340aad65adbde16d312496c45c68262b17a232a9ffa2786a2405b6762136c
- TLSH T1FA1190605FE2042EF3F7AA7138F40715587BF8020931812D408231869F72A90DC24B66
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 8f2c523d6b851d6a91ebad962f18f005e8ab564efc5a2c3325a2d7ddd469f0a0
- MD5 08a41b2a5cba04117cc86ac7628814fd
- SHA1 27ef154216bc996c5d6726072715f176ac349fc5
- SHA512 df9d99b0cd8de5b2da7c74520c66a35acfa0dbf6fe927e3146a63d52c0808792a1cb56c36645810a4eccf3ada536f931e0e4b5e1472c01a709fda4d3eafb53e7
- TLSH T1B4415A303161B5D80D435F1609286EC5A2EF478AAFAC9F5CB669231DCE2A44BD7221F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 17KB
- SHA256 c4a87d881c68f4470f5360556f33fb86c2e7880e9b9d1f50d5ca5bd1c4278e94
- MD5 f93e7f937a03eb21c24e09fdc854d230
- SHA1 7bb0e22e1f1c879635910779dd9f1dc90c052e32
- SHA512 b40f13bac24ccdcfe71167dbae93579363aa412d26ffcd3238a486ddf07bd09e7d694d8c21c654cb911d2cb1c8c09b0218dd982f842780bd8f5d5c79eccf828d
- SSDEEP 384:hM3H1Lj601S1it2qDsy2rRHEMEnWnTRrnNDjs2GgWy7SFDKIEDwT6si1ja:Ghj/1SYEqDsfRPEnU5Dj7GgWy7aDKlwR
- TLSH T1A282B5AE715F22C3C4911378D10A010FE8F2DECD031A43D9B72A9E3B8DADA5E517D598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\activity-stream.contile.json
- Size 4KB
- SHA256 80e5916eb9366d660470afe51c341e1613a2c98661e2954738ee8a1a991e687f
- MD5 0f5fe083ab8a1760024a4af865ffedd6
- SHA1 30b6800e2adfee4cc8a32c10ccadc2ac137ccba0
- SHA512 21bed9572a51aedb03558cfe07659492712762d9247f87cbad080e41a5bf3163c7aa82dd10c01f6c251b057d8e7e1bebfbe32ec9a39c3ada9e1fc3785953a528
- SSDEEP 96:KwqOttqrFdANNcvv8DlbaZBk6BKVrg3ImQ7R0YkJol:KutQpdscvslbUDBKVrziYool
- TLSH T12BA10ADB986CC84B43357BD03C6F337DE10BF24BAADA5815E745CC01D5AD48641AA794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\activity-stream.discovery_stream.json
- Size 74KB
- SHA256 23f46abdfaf37ad78735e10a261988166079afedf9e2ffd778ada0c2f5b90fc3
- MD5 bfc63fbfb2f3874e9c62440b4c993228
- SHA1 aa97c47a5f392c545e3757313bd5a14217e94ef6
- SHA512 68a2e3af5b8217cc35c2796eddc0d142b8626507de604065871b144184026007a7c76ea7b03177c2526a86b0cbc7b62971fea835168cae9ac496e6705ff89f22
- SSDEEP 768:+y8ko6cc0Z5j3nrGiMKcK2jNSgHvI6+K5JtaFd8vrARxvssDfb1t:lA5t8HIJiJAFdYERx0sDfbP
- TLSH T18B73D8E3A3E8B1BB1B9527C72C0B799F66E60185E38502D9FDE9C51C80DC694123B5EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\activity-stream.weather_feed.json
- Size 14B
- SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
- MD5 3ea4da2ce03c4204ffe9b30074d62fac
- SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
- SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\doomed\5552
- Size 13KB
- SHA256 547345ae8827924981e04e2b1224e6adaf37a4cc00cce6431f360a6929a95348
- MD5 2526f787204fbe2778f0bf9220b3e72a
- SHA1 dda9826e501e608185e819dc306d6d13b01baad2
- SHA512 7bf1dcf860b7e557c7b8a39623356cd9dcda6c8e96df7ecb0529d6345fd5f6b40eba9ed370fbc29fe7f678a85a43468b61b879404f65f963d84292ae53049c71
- SSDEEP 384:xc7hUSVnWIXMi7cEoglr9+41k+Qtc7KpwT3V5cP+AWRMAY:MrWIXMi7K2r9+QkDi7KpwT3VO+hRM5
- TLSH T1D7527D314B1479EC9D679130C4EAAE487D2C68E3EFB4D2C8B2471901C58E9DCA97C89F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\37700D616EA20ABB48AB457D33ED2A73E8CD3102
- Size 167KB
- SHA256 fbec461a69940605ef2e88a40ecfedd6e571a32c45a40785fdcd9275491dea70
- MD5 e3091a989f8ecd607649f7c62ddbbdd0
- SHA1 0b1c60bdf6392f5ecb5882b66497c737ba1b2a9e
- SHA512 d7d91253611844b08dfc4c8d7234fc8d77253924fa1ead7787bdcdc8eac054163ff9f6fbca2ac50db083d17cf586617e6953307bf28ff46d0fa10fbe8c47413e
- SSDEEP 3072:eyrFzhdXyzBMMPawYNBObgtKUnsFH545N9bu29mNCxByZoJDk:zYzuMyjNccMnFZIruR8xU
- TLSH T11AF312B2EE40E78BF2A481E7D35B55440D80261BBEE6C698D92DDDE9CCCDE64BD03414
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\59E2D0A282829B71DB2829D7B27E20752D194388
- Size 69KB
- SHA256 254d0a38e0ca3949c2a5c019dc29221e134a1f6bd8450adddb918c8fd8770da5
- MD5 a7ee15060e68946b2d70940957a80254
- SHA1 6d26cb5c80a2411f3bab096c602d9417785cf883
- SHA512 1991219412ee423afdc40fb87baff60c1b163e161125abbeded021afd3c78ac8a0e02a22716843cd4f2bd0f204e78623411414d895f7c932b838cabd0d671617
- SSDEEP 1536:e2ncYQu2bz/Y+bcB+96OtP2kiBLLudrErhl4J/pZoZ:DBgzATB+96OtP2ke+84VpZoZ
- TLSH T124638D7135312903C22208B59097537B7EAFB1C35BCB8765EF94F6927CE1A241DB2E68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\6C85CE1392A69D9C782FF0E9CDE20087CAD2453F
- Size 630KB
- SHA256 f8571e6ceca2df7982cc916545b402ca4c3a7bff9e01af04a5bc26cc6ff7d8d2
- MD5 4c1d0a5de5dc325ae3e127925db0bc95
- SHA1 586e3f4e752284561c6ae27e69ed4c1ec948320e
- SHA512 fe7b85f382818008797aa21ec2ff29490c67e4b85ab115d20d96792f0ae7e0e1ba8ec654d151dcf5435bfb9d0b6d86164ae4345d8ccd783d4d155ae1d8fcec1b
- SSDEEP 12288:exwXQPznPiKMppo0T92HsUlonN/n151Ahi2PamYfcZXqpGEPD1:/GznPiKMppo0T92HsUlonN/n151Ahi2Y
- TLSH T137D4A256BC526E06C2525A7740EB63323279D4C17FC7F2275BABB022FD91D1805EE2AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\915EAD52D5265CE2D3A42EA174CD1088665AFF7A
- Size 64KB
- SHA256 a37f83a9ae2a084cc596f51f97e0817730ba89c792863a83d522f9d2642a5dd0
- MD5 8bb320a35a30fb9a6e5f9765f84841f6
- SHA1 4853afeebd3b6b6d7ec13bd992cd2253d1f63338
- SHA512 e581423869796cc938e29a1f14eb80859c7d196c7fb6bcaafdb72ec3ddb677e70d9682f702cd5414fd33c59b9ee3f4ead6872a9412ed65b8dafc210327b45261
- SSDEEP 768:4SXVm9Y6Iju+KO3uPgOuIWx7TWGDAyxvmKaeCyAXUVyMIP3uPgOuIWx7TWGDAyxH:4wVmNIxKxPUDAdzfGPUDAhzFEZoY
- TLSH T1CB534AE8BAA1F025C1B3A5F1022F1209F2B77C42984C699DF711C2E47E70E99546FF5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\99D913E1E8E69556E804DE092F0AD95E970E0D01
- Size 613KB
- SHA256 acf27317a6fec3e6a637b2b215a507b260907d358105133ef0e7b8329bb787ab
- MD5 8cc1926c9f52c7a007509f1f12fdf969
- SHA1 044befbe92b341980e9fb78dc49cdc6228724a53
- SHA512 13f76d06f9a5dfabc01d62881b33c9565a18f472dc59c5c3a2d1696ecc9a3ea4464bec617f274fbbdff3a41bfa8c9d3998e1f58042bb44e66dafaf1f527cab18
- SSDEEP 12288:+F2YHVmPMVkw5Bn/c1//+ISWMUof2HP8n8sNPiZzGi65lROVogTQkQyjHSxZyqiP:EmPMVkw5Bn/c1//+ISWMUof2HP8n8sNo
- TLSH T11CD42A16FE555E13D42103B640BB93323776E0D22BD7E32B6E8EB163BC663680D6625C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\B7199DB73B1E33ACD63134DDE01D9B37DEE1E3CC
- Size 1.1MB
- SHA256 0783aa034469bf8ec2fd54ae81135a0e11bfd0135b6c2f42263b59afb3fd46e5
- MD5 3788e6b5eace3025839837f1f950daf9
- SHA1 af81adef998989fa5ef3fc7af2120f148b2d7536
- SHA512 73da9150ed683d2ae1b506e0977bf1ef0061221505fbbdb8b315868910f18792768937a846ce6d8e23d8319aa80c989dee22105c9b5befaf6ff7f3f65ad7324c
- SSDEEP 24576:oCXMpLEOidnkHhxxq0Qr5d8PwfOkargo5n/t5xsBOWCVzwAx4lkHtYlvyeEs7nqH:DMpLEOidn0hxxq0Qr5d8PwfOkargo5n5
- TLSH T16235C726EE465E53C82103B240FB53323B34D0456B96F32B2ECF7566BC6A7751D622AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
- Size 13KB
- SHA256 ca4b186dc7f621b49c5100d3efc48d991184a9363847a176ba0e73a26ce97077
- MD5 2a7f15ecada7877f3834016f97ca00d8
- SHA1 5bc7ee863445f8a05357c5563e0d4bf64f1f34a6
- SHA512 f7198b330be02fb3b248e881e3e3fedbde2288077686e33e45006bfe8ef9b92a89acf35a250facef89c1ec83717a7556653f1dfb97b395faf2e7c547786c3782
- SSDEEP 384:HbaFrLiO024YMsFuhw+5EL1pPsac4j0lpDII+Has:7aAZYMsFuK+5EB9sac4ID8LD
- TLSH T134527E7EAF0238BA1A37D2D4D8A99714CE04D6BBEEE2D15606143844C78477CB4F64EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\D223B359E26D4D50B2217E80436106D502D20C0D
- Size 6.8MB
- SHA256 9f0b113894799f0f3fa392fb186ed1782bbce9d660bfc8be4d15918e7f024462
- MD5 fa5f508a1519073fb1e3ea6b2859f6ef
- SHA1 20e623778ebc9d9cdc31c21a8c7c1bf0128ddbf6
- SHA512 1e84fe0736f5abc3ac344c8a0bd040a7904e7999afb99b8d7577bf0cf92c1a721c341d460e032572261f58e9e0174d874c3e82fbbd5f6dc066c3edcfc2f92346
- SSDEEP 49152:pKGpiZR72ufymEt1YFhXynECnq8U9aosG5Ba1aH5fjhNvBHjpZa19DUjh/jjA5b2:wGpWq6QwsUArr9xG9OisBPI9
- TLSH T130660816EF525E23C43003B641FB63723B39D0852B97E32B2E8F7552BC6A7650DA526C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 301f8649bb0cab25793cf1650920e6c767176596250258ccd07ce8853340f155
- MD5 7485086e082fd8880c033617d442c3a5
- SHA1 a84863f829481f1bcbe0679bab545d2294d7cac7
- SHA512 f9a1ac6d6dbd44865b2e9b915cf9fe6d0f2bd5b44bb752aafb2b26f64a8122be38d9bcbf1add0b3427d7c587f82e7bf124b7fd09be231d884c1921eaa0b97e70
- SSDEEP 1536:XTrliXNxDDX63LozhTHsxaigzCRCIXda8OinAuBK3KpB2tRIak8vRWk0o0Z2913p:X3lHbozhLOcg89AAuGbTvn0ufwNi
- TLSH T19AB3AFF6DBA2893D64FFD42C6B82883FFD162404B3A73419C9637311A1C6BB86775648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2kcqexpx.efv.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420195152.log
- Size 18KB
- SHA256 f6f6e279d96d828135e1472a9fc35e07e316f7552d28eeb10c49e03a001c339d
- MD5 4b98dd79a3b856fb3ae35d1362527afe
- SHA1 3c975c5154fde13033f31354699fec8fe988f2b8
- SHA512 704a02380d38e44b654334dc638dc7ac2ea3db20bd5101d255903167b9c6d354635e945399ba9bdb1a1348f099172c6e0495940c25dba61ba8cfc2242da6477e
- SSDEEP 192:r+JMGn/1s1S1Z1t1K1A1P1ODpam1sPPm5jNjuKp6tSft2g03hK5xy6eJw:r+JPKDpam1Z5hiQWK5xneJw
- TLSH T12192341225FDE5E02C90D3E4D19ABF5CC727F15C2AC4206A57B682CC9128B2DE7DD6E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420195152_000_vcRuntimeMinimum_x64.log
- Size 2KB
- SHA256 cb490ae4c37333632ce624a7f6dcf7e6170942060bc2aafe974b8df75485dd9f
- MD5 f214f547dda5651b773d50bc2c56f9fb
- SHA1 1b36759e78a2e3f4a7625e486a3112eef786b96d
- SHA512 e4c76dc347fb81b9856050850aaf139a1896ff032bb173dcf0fb9af6fa505aa7740fa5eafa30033b02c02e4358cf6c7e5d6cd27b8270a371f481298e492a2cfe
- TLSH T15C41C5541AE8085AB2B65647DEF3C4664A33FCE35834CB4C6386431A46ABC016D6D7AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260420195152_001_vcRuntimeAdditional_x64.log
- Size 2KB
- SHA256 5c8168769d18bd6d939e8447516c85b24212b5234211d468e6eb0ea5fc1a52e2
- MD5 fc65126f027ab828b3f7f0aa9e56ac10
- SHA1 4bc5634759df5b44946c6255025e80fd5d4c465f
- SHA512 a1f9dc50279c4ff2df854a6d3f4a3c21d5f4f4a1355d61b5d009a896279dcaccfe72d2cb57c334328e97287ebf71aec9585f4bf2cc1547e056290895a8e33078
- TLSH T184411A651AE40849F1BBA657DEF3C4628A33FCD16534CB8C2386531D0AA7D016CAD7AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsgFB49.tmp\StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsgFB49.tmp\System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsgFB49.tmp\UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\CertificationPage.ini
- Size 968B
- SHA256 af95b338eb4bb1962969a0a8dfbaf7e26c518745206ea5a88ac05f928d603941
- MD5 2d25af084ef716e8950bc114257f9dc4
- SHA1 2764a08a3d23bedd587dc38160957b13c541b9bb
- SHA512 3422e853e8f1ec880494f30c264508f5bc008d367411cff11be07acfdacb428830eb9230ce334da5b29657c554a0103f604b4c31e7fd9bb18e9fad29c575e4dc
- TLSH T12E11480327F90618F5FBAB58EAF454316B797C85683CC58D51D1060E44F5E808876BBB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\NpcapPage.ini
- Size 2KB
- SHA256 02d741007351f106ae01ada992a5749668819abc97fc6d7d29041b6f270bec96
- MD5 26380e576d505f3e988e07b3d9b2fc96
- SHA1 bed3cccf7e76af6f70d7cbd5918b6de4cbe58cb8
- SHA512 b7becaaae79059dff7a0a82944cad9985ac99e36c343570288e5189f6c7982fb5846a97f174a0f6f184e4ac2cb4a41e9018a2ca6753ac358430049ddaa05c75c
- TLSH T10E4147533AF84028F5FABA0CEBF580319B397849583DC51D81D10A0E89F5B81857BBEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\NpcapPage.ini
- Size 2KB
- SHA256 b0c0caea126dc9f4433b656f93132d88700645362016316c02c6a737fa23f2bf
- MD5 8933161307ac0ce78f6b4bdba3686746
- SHA1 a02d13959f1ca88b7c0bbeccbb0326c4c75605d4
- SHA512 3fa616eab1fc46ad5688a46c2fc05729a494e6853a2f5cdda7df524e878f1500b5889997a260e8a33f26ad700ff0ca7c17cda813eed8c46f3be2c0fdbff0a2b8
- TLSH T123518F533AF90428F1BBB64CEBF4407557393845583DC50D91D10A0E48FAB8199B7BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\NpcapPage.ini
- Size 2KB
- SHA256 2a5e87a9fda31a6f3386e76cc16da5b98b067afe4bf667a8d8c0a9af58ee559e
- MD5 49dd9aee929e37d125238293333bd701
- SHA1 afecbcb22fd0374705e99744105c71a16d2964e1
- SHA512 febbecf4531335726f7321a1c37ae858287ddc5309ae42de99002f0a83ad10cc46b6f73d1f4e94d1efc39b642d677bb1d5b35e581d06fcac5471d30a2b81eb1c
- TLSH T138517F533AF90428F1BBB64CEBF5407557393845583DC50D91D10A0E48FAB8199B7BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\USBPcapPage.ini
- Size 2KB
- SHA256 c776f49524f3c988eab62e7e5a4eb8d4a6c660f144cf7eaa83fb62f7bc346276
- MD5 fe47e587d6c88a0f2dd6354a11a7c51c
- SHA1 1db24e232acfcd2c5f4ede9afb95d91f89d4977a
- SHA512 964d9a52cdd3ab5dded71eb51f472c361e468de8f9f7eed7a644e0357994ddfd7765fef3e46450d32e3cea07eb424cf2671792bba483abd2a8238659b1842829
- TLSH T16951B0033EF84114E1BBBA0CEBF544B187393946582DC91D91E10A0E59F6B81897BBEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\USBPcapPage.ini
- Size 2KB
- SHA256 e7fd1a69f482d1792d7874a44a504fea579d16c5529dd11de22830e9c2577f5a
- MD5 775262b8fc4d2c8e5e8720de99e9ebfe
- SHA1 057655b9030e899528b8df875b7dd59d83de20e4
- SHA512 20992f348dd8537551e01d87c3b41e50a83bc1903b18b0487c1b3834009859562b3d9302cab2e5b73a18ef5d21bc05385acdb24d24bd168bb1f4c5c1a0540a77
- TLSH T1885105033EF84124E1BBBA4CEBF5447597393946582DC51D90E10A0E99F6A80C97BBEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\USBPcapPage.ini
- Size 2KB
- SHA256 8ee6da270a3f053bcfad3922cb85b954f7be3dda29f0a9302982365fa2eb09c5
- MD5 c13d18d07b4428b0ed132e1ce608b01e
- SHA1 f9371f8dd2a66aff3e210736f4a000d8c6d04a03
- SHA512 442e608dc4976284a3e6828c147d772e3f5990744789a23c170b35eb7e9322fc22455e33368a29a456aac9dfbf502f784bc1d598eb5c5f6c7a475a3665076fcb
- TLSH T1E35105033EF84124E1BBBA4CEBF5447597393946582DC51D90E10A0E99F6A80C97BBEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso57FC.tmp\nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst
- Size 1KB
- SHA256 98280770b3d1e577754a07b6d3e5790f988bae9b905c2b30c0e646d0fb619b03
- MD5 1ee653bd6791acd004f795a383d35cc5
- SHA1 35f877ab45bab133f3a757248f54a7682d2b44c8
- SHA512 2fa3d49a422edfba43c100201ab421a82aaf28004d253fc953c0fe884c3607e0d3872e9243248171206b5a92e98203b91d7874d4e4d50bb4034e6cc2a57669e9
- TLSH T18141098343503C4ACB03DCBFA590C77929BBF4956912CDB1821E86A20F7C78B606B02D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\NPFInstall.exe
- Size 316KB
- SHA256 8e91ef9de398a2b31f1eff9461049b373c5f1b6ce9a7cba94e37d41ab312e1bd
- MD5 180f294407f783a4c09ef04a4bd38423
- SHA1 cef3d1b59377a5288360401bddff013379921819
- SHA512 575149c43401b3104dfd0f73582d8f01802ec0644fe8df99839201b5263fa0420961bfe3b42a1e67a551ad7e32791167266d0ed95f286f0590a644f93ec4ad8f
- SSDEEP 3072:bIK5PQ9EHkPxn38RwGu/ZWjhYz21pETQU4b0qczzThYvuW/TJ4DvRHCSoMsA/1Z4:bmvP4UZuhYzspEUeBavuVJP9tMrB
- TLSH T129645C11E7E510B9F5BB8A788DB68545DA727C424B70D9CF039045BA2F73BD08E39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\digi-ts-2023.p7b
- Size 3KB
- SHA256 0594d1899bf9f738ef4c1b9049372ca66059c1343b4d8dd7ecbda465ad04deea
- MD5 7cb9a1de5b9b612912a21106813157c3
- SHA1 45c81fbff13041c96a67c73aa3bb208655752167
- SHA512 43e1bfd11316e5e66593f91631c095d0df43b933caf9b4aa33e1d95c1149e920985e1151f48c07aee2e2eb556236a90dfec1b8384c7fa8b7d52b004ac62654d8
- TLSH T1287108F1CA25BC55ED9BAD413ACCA53A8DB173833B84C5D31396C2108B45B82BBE44F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\final.ini
- Size 614B
- SHA256 9795f96826a74b07a35367a9cf948588b1ffc4fc82357c2c2a20bed1732c20bf
- MD5 59bdb4aea7df85ac6416c3e80396d31c
- SHA1 214310ec15984225b68e74ba289bf75be0bd8f04
- SHA512 6864e2cbae56897a7c139839b34ecb839f25be12d971f76f7d5761a5bdbfd950876f068fa52973b0f7cfa82a3b511824dd3673ed82e2f11e54d0a3582fb021c2
- TLSH T171F01D432AF89054E0FBFA48EBF5407147357855582DC95D91D00E0F89E5B818537FEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\options.ini
- Size 2KB
- SHA256 cbfb13a4246abb7c031506bdebc31424f87cd2e811e95596f6908f7a2aa3f7ec
- MD5 b452427f863d99db0d3b0b22026ff489
- SHA1 fadc22e8e130f24a48fea66b9aacd623914b05ff
- SHA512 4e09ed7b9e473b2e9f7f366e429b51132e06acb523bb44ddc2aad777f8db2406ba444f9719301850bbb18d504b8a203bb62e13e7b7031fdf84f242192436f502
- TLSH T1454179133AFD1428E0ABA58DEBF6847597383446542EC94FD1D00A0F4DE6A814A27FEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\options.ini
- Size 2KB
- SHA256 66923b6dcd49b0583750d94304079f9207f971b8b4a5a28a87150842978e65a9
- MD5 fecda2ef0be6c876cf27ce31d44b240b
- SHA1 7487f7925841b152cf0fe461fbc73deb0759476a
- SHA512 b4638f42f6f420882a06edb0fd0ba1ddfafceaf7d635d01aa9abd289f9d9929970dd991aa9d7bfd26aea6fbf86bd4c097aac256a88ce9fe375daf7c7161c8951
- TLSH T1425179133AFD1428E0ABA58DEBF6847597383446542EC94FD1D00A4F4DE6A814A27FEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nswB84C.tmp\signing.p7b
- Size 3KB
- SHA256 dfa30b3667f5d98f267c52078846db6649532a8f877cec6d3e4f8b83a7f1f80a
- MD5 acd6e16f9e010785ea658d698cf6ebe7
- SHA1 bab449b5d29f8c6888e99678686a0efd65cf0de7
- SHA512 b21e01940f9c02d0e2b7b33ace44f108db57cb044a32a36f90975f8787f5f4c44dc3ca1b74b13518713e6955a55478d581b8adfb11a6026ea6046f3019267c24
- TLSH T1F67119A38D685C01DC2B4A4038D4D139BF7A79E95AC0C2C2B12AC516D3407827FA91BE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 10KB
- SHA256 de9dc6559fa0f3ca79257498eae2a1a8abea6d538780b35ef3de9ccf5df3103b
- MD5 410e496c96ac283e92b0615c53a2a3c5
- SHA1 c64931b5b41c09ae3a28fe76929f4fed53a5822c
- SHA512 b018ee741642f71d91596a61910720474bad9638b1f2d738cdaa39f7fbdc5edde327838ef8171e90b75f6b12cabdcfd8c5208f1ff557743bb60e48fa5fd2d541
- SSDEEP 24:9uhMZWs4s91hGL9xaGrN9VvIGL9BOGz85q9F55A5PG19FkG2q9lwG:VCpxTBpp1z+I56Ofz2IH
- TLSH T1AD22B4E76B76E476F0928FB48068728C9C33072555E891C4D75490F706E2BDA923EFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 22KB
- SHA256 9ab77e23b3f9252ad7e5f47f641519f2bc703c426538b60e9ff74a0d14cb9da7
- MD5 1e7b58d45a5f182a06b56f221a08d8b7
- SHA1 997a66918900863c74525b1eadfcbc132a70ee39
- SHA512 263976d6635efb0fa6ecbac6058a4b4e865a7a6f467896808abe68a01c3ad0663ee038af4ac6440adf46b0583d6df117b100a5b312c07a7d62083e9bfdd6a3d6
- SSDEEP 24:puhMZIZ9VOk3BW9GF9VlBW9GrbYmLLfCTwi91Otm5q9F55A5kH9VvjnWN9VxWAZp:gBBWIv3BWI1QQMI56kdBjnM/pc54
- TLSH T17CA2B6E36BB1A432F0928FF08469755C9C33072995A891D4DB6490E306E1BA5D23EFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 25KB
- SHA256 09473119d77908228ebbdab569447706f35910c20c7355bae4ea686284286b7d
- MD5 54f15653865337bdfbf03506054f97da
- SHA1 77c3c9f8a64899db417ef3eab8e95b3ac8375c4c
- SHA512 b3a194df7ef61ddfdce1aa1397343b44693e1e950894dcc0d30364e4389cfd38a2b485255491a33cf4469e429755cec6506e8556d66da16e58454374e78e8e1e
- SSDEEP 96:3g//ZFJI56FyBC2Ma+nM/pc3nLLDe6J/iiUPQsKTEPbEbEKCs4AQI6yMDedN:mQJosvIgSX
- TLSH T1BFB2A9E33FB1A866F052CFF084AD745C9C320739586891D4DB5494E706D1BA5D23EF68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 25KB
- SHA256 7b5714b33d0d65b903cbd152e0db5a85b882ba62cafe2db2b7885f7667e520d5
- MD5 67d23d104d67cf5d7eeeba25f03b5e8f
- SHA1 6e77b23729073da4a611c9f715203ce5ec673b62
- SHA512 15b0e56609a426eb0daf14fd08e7205fb0fc866ecb8417a24d27332c1666d72911575ecf8243afc258bc8e5d55297880361cf894efa0048f09dc1929a0d9f348
- SSDEEP 96:qPJJ1JJI56FyBC2Ma+nM/pcLXL79PQs/WEPbEbE/B46ZI6yMbPv:GQgosrIg+
- TLSH T155B2C6E73BB1E866F057CFB044AD745CDC320639586891D4DB6484E306E1BA5D23EFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 25KB
- SHA256 49ec9bac201a5732946727f6fb4c6caae85d3a73ce6604da0cba1a6a0f9f89b1
- MD5 f36a809a4acd09ad85a1854d864ac27d
- SHA1 a9bde5fff87325feef2bb20e4ebcf4f2fb5b4c18
- SHA512 193fe08e7207784fe15385e2625a62cc797b30041fd79fd7a095581689f7639cb45b8fc8f1a476dc3015f691599499a8d13b36fda68c4db21ea03df60ed910e2
- SSDEEP 96:iPJJ1JyBC2Ma+nM/pcLXnH9PQs/WEPbEbE/B46ZI6yMbPv:SQwosrIg+
- TLSH T139B2C6E73FB1A862F057CFB084AD745CDC320729586891D4DB5884E706E1BA5D23AFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 28KB
- SHA256 89fcd5cc616d0db76bbd27825fa337f0d2d6c01bee8d92b69d32d5c28e308ad7
- MD5 d228cde5bcc8dca873c67ea2d90527e0
- SHA1 58a0f1e88347287ff636af142e29159f74b93d2e
- SHA512 6e7c5c5b3d723133eb24fce261160ce54392856c3a63c6c5da1b7f3e12ab725e97b9cf038de6503912013d26ffe1140e6c7fcd193dbe2014937e36291ba721c6
- SSDEEP 96:6PJJ1JgI56YFNxBfnNBnM/pcLbD/bn8e6Jul1MEPbEbEtZG1PkGjGLPZ46ZI6yM3:WQCIgUf
- TLSH T1B2D2B8F76BB2A862F0578FB084A8745C9C330B2554A8D1D4DB1890E706E57E5D13AFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 22KB
- SHA256 8856c308f2b2b1e84925adfdc4d08bda10b8ef36243f6b13f04dec37fce857cc
- MD5 a332279e33e1aa38bac0338bd2359b5d
- SHA1 4b9f80c21556a725ca1e4a8f3f80673f70f0976d
- SHA512 1039919675b28b81534fa0b9c56d55ad616a70f2568f04a62ccef3cf63bb0a3bef1874273fe6277e19e9619fba0a199c69372cc8d8361c378310319aeffc4bd5
- SSDEEP 96:YFemqBuCahI56ZKU+ogYCM/pL/vTzrGRGbGa4:fQ
- TLSH T166A2A3E367B5A432F0978FB080A9759C9C330A1995B891D4DB1480E706F1BE5D23EFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 22KB
- SHA256 cdf650c3c6e8ecc11f53691e4455abdfa8aab32f1ee6345e340270d483a3bb30
- MD5 4138ca20a156ecb6591e00e6050246b6
- SHA1 bed9a95e98a8db4e06e0ada4abfe5580a8627ee4
- SHA512 cd419abec27fab34c3092f4d9cfa1d4e0042f1f924cda02d56cc4c0c9285f619c3ff1534f4b6d3d3b4a1ac1d9342f39e49a1b62d538df6c73795eba73cdf48d4
- SSDEEP 24:tuhMZyem9BbgGnWN9VxWAZG3bY2tVzeTHAY8LeT6YcVeT2TqYet+gJTi+lzUW:I9hnM/pc/Yqn9H4
- TLSH T164A2C3F3A3B6A021F05B4FB08069B55C8C330649C5B885D49B1481D709F57E5D22FFB9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 22KB
- SHA256 3e86e472a27ed40181e54aa67db1b3976bb0e9da68c4f9ff0f1643354ace6c44
- MD5 6db9f0c0852a0605d33b9577bd5576e1
- SHA1 8dfc2ca21230d56d651e44a83eea3b92f709306a
- SHA512 b61fd54ecd54cdebc1bb9addefc8a96024d0d50d6493c131001a7a705ce7932bec5e7c52b2b4ca466b9f20087dc70d5ac0b8335c63b338e7ca976a1ad93fe53e
- SSDEEP 24:tuhMZyeZZ9VOkVGQ9VPGnWN9VxWAZGxTqYet+gJT6+lzz:B6aAnM/pcx74
- TLSH T186A2D6F36BB29431F0164FB0C86D746C9C330B2995A8D1E0871890E206F1BE5D22EF64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\crashes\store.json.mozlz4
- Size 66B
- SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
- MD5 a6338865eb252d0ef8fcf11fa9af3f0d
- SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
- SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
- TLSH T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 72KB
- SHA256 805294c4f80f21ec50b55f6d6ab9a96d2f1d88f9448b17328137c1afb63f9077
- MD5 5273b733893a5858d80fdbfe3effc231
- SHA1 c2432c67c391cab98e262daf3fa329f88a98e286
- SHA512 610ee3bd3ef165f4cb2c7696d1b52aebfb888d986d820d29620a6b31641e1a588217a048f12d4dac53788bf306738e97699d0f301d0476386b986e49ba1ce82a
- SSDEEP 1536:vEqw/Hc43gVGTY9KjeRaopJIK+1LDDBPK2g/J0rb:sqw/dI99WU3X+txyBR0X
- TLSH T1CF730044EB5A543FD96803BA9DD21B003F79F8895A0A2BA7371C54786C873DC3D8E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 81KB
- SHA256 a75d846364288722d545874bd4f000298573375d30945f49b57fec95b797d72f
- MD5 8a821ea0c3ae34095b6663e035651b96
- SHA1 e3ba8b4f6e38901c371adc41eb70f100349a07ac
- SHA512 95274be1b571945f528e094b8ce234ae3ab79df3980da344ac0114e918bcb24f9584e49c42e5ac60d83f81219db35b276d92aa0f0261c4f5c4ce93112e0782f8
- SSDEEP 1536:Oqjzsh2fbchklYbKj1EF+q4eDkQTvlOmrxYn2wS:OqjYADUVbWiJXDRB3dk2v
- TLSH T17D832180EB1A403FEC2842BB68D217283B35F4554A1A5B5B3B6C14751DCB3EF2D4E56E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 83KB
- SHA256 02f525cad7e0ff900c172b1f720413e60b7a954c086cf7006139f935ca3fe976
- MD5 d9cd5d2c3345a658175ae81a9e993640
- SHA1 3ab578b65e252dec90336eb008a12ef495967f18
- SHA512 4bbb29e5e755df18ec76a61bc221617d93eb68a5bbbcab28d9cb10cf2320ffb2237c227c1bb20a60b959576034370f146e801a73225c480f3d1a18ab3d9ec367
- SSDEEP 1536:mqjzsh2fbchklYbKj1EF+q4eDkQTvlOmrxYn2wE:mqjYADUVbWiJXDRB3dk2v
- TLSH T184831084EB1A403FEC2842BB68D217243B35F4554A1A6B5B3B6C14752CCB3EF2D4E56E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 84KB
- SHA256 32db7f1a993044c3e2c68c4dbe44d6f2069f04cc39d3c555911a8ae5de099b2e
- MD5 94bd01c8d654a55f44566c572bf852bd
- SHA1 7f809902e4cff2d5b577c8562e596715e666fed2
- SHA512 3838e270a655e74fcb457bc1b2a8b5a3fa27033119923f7e569eff98520930932ed181289657feef6bbb351b810493d03fab0d24be95018b707bac353441536e
- SSDEEP 1536:Wqjzsh2fbchklYbKj1EF+q4eDkQTvlOmrxYn2wh:WqjYADUVbWiJXDRB3dk2Y
- TLSH T1EC831F84EB1A403FEC2842BBA8D217143B35F4554A0A6B5B3B6C14752CCB3EF2D5E56E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 75KB
- SHA256 aacb5ba44d6573271f19476a8c4b750fddc0ccc462a6cb66e21912be2b29e51c
- MD5 5342354b8c95858f30459842b4d4ffa9
- SHA1 53475fef0583c793fbbc9d257dd711c299dade10
- SHA512 771ce0c153766cd8fc5a5669ae7aa75e57b862e7b9af1f1e7f1d09e865e9b82ed8539eafac9f9d06b2d245b241e0e73039eb56ac0f5e2df1ed9a9a79abbc5d69
- SSDEEP 1536:pt/aRYKUUa9GFOIfDW9IZfBgq6X1LrwnOw2JzxczaL0gl:z/KYzFGUgi9epgRrwp2bUeDl
- TLSH T10A730044EB1A543FD86803BA9DD21B003F79F8895A1A2B6B371C54782D873DC3D9E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 132KB
- SHA256 f33ecf81105a5f39dc67392243deb78d9952ded9d2acf80ce6ef3e3f2389a59e
- MD5 078252eb9220d6921a416a1fcabbfab8
- SHA1 a8a821f51ca553d36cf62edf0e1d7a3f6078f7fd
- SHA512 772d3703ab2377fd9ebcf4128ee24be9925f63fd7b546d659c124ed5b903311ce053a520816426c4b9cf6ac3b20fd06aff605a8e4b2c56ba24eb31c8139c9d6f
- SSDEEP 3072:thSnZ/HhREU3WFCpg0OdWBIqURvcPP2lq6zt6xcQiyF7yvIbx:thGZ/HhREU3WFCpg0oEIqURvcPP2lq6S
- TLSH T16DD38ED4CB1A407BEC1485BFB4D5673C3635B4254B599B0B2AAC04752DCB3FF2D0AA2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 75KB
- SHA256 e1fa005a46eef22ac025281e30f66d86eb005ca50df9a0ac5bdeb8d652de5741
- MD5 d0eb144eb76a1ebfac9f827b1e4d853e
- SHA1 e50fabc39aacab08af70e7d1b46a46ff91c0dc05
- SHA512 4cb9394b61984a72ba470e614d7a164b58ffa4b7aff649997ce9651b2b1bee7b1017dfc41f3eeeb7d184266bb5e1c83bf5bd8ba46473554cac9e716eaef901ab
- SSDEEP 768:YURZIA+HdHVe0GcmhuV1/K+xsbWZMbTbqb1bhJN+5J9mfhx2S+SWVtm/:YeZIA8n1/La5JQhxys
- TLSH T14D738DD4DB2B407BFD2085BFB495573C1625F42149989B0B3AEC04661DCF3BF2D0AA6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 ee245ab8df5e878fd76695d576ce654649261a835d1d9b8171494ff42c991916
- MD5 69d711bd8badcf7443c991a7e382fc5d
- SHA1 ce7e014d1263e965063fc791e6d62ef62efb9756
- SHA512 c1c9eda29318f5a95f6c486dcd5cc1789266aff9f8b0f9d37cc7552d3b983aa0e01c8ca31bb7d9c26b46c1047ecd29cc2f2451a74c33cfe64534cc965da0495d
- SSDEEP 192:skOv5zboKZNbyjqmhe1d66Joz0dzgCl6mc0d:snboKZNbyjq/d66JozQzgC1j
- TLSH T11FE10068EA29463FC444123FDCB52F404F39794A9C4E3F1A32AC65482C5B6DE7A8D17D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 d954eeba5e4c90418d382d2ddf6f814ed6ae399599bb7a5afaf6e601324b27ea
- MD5 9f62a20d2b9d9a4290c86f1501135e59
- SHA1 8c41bcf40dc3448a4ee1744f7160e9f688c5bb3f
- SHA512 d2f3236fd5618df1a86f9ab7ed8bba39003a40b74ea3c4f1410cbd2fa0b786ed365d8445ef0c16c64e63808f84af970096fc75866fbf6cf2b3b72477f25643c3
- SSDEEP 192:ukOv5zboHnZNbyjqlhN1d66Joz0dzgCl6mc0dz:unboHZNbyjqXd66JozQzgC1jd
- TLSH T1DCE11E68EA28863FC404127BDCA51F414F39394ADC8E3F1A32AD65482C572DE7B8E17D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 a6152b15ab33f5cc2c295b8760676544ff35c1dbb44505907e6968578e4d1c24
- MD5 489f9796a59f55f44fdff00e55dca2ea
- SHA1 2339f19aa168347f32843905e38cba4df3dff3bc
- SHA512 5e5a9c8110675465b3f531d6b80dc409985f0289e0d8007534ba0c9d0a5f035761d082bc2a78f1b6fcd64928421fec9f49ae3cc775ca3483e201eda2bdd14f6a
- TLSH T17E217FAC39F84D5A68DBE65C7840028E53504E0B54C72C871E52EFCCCCE9EE9316A47D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 8df08b5ef7d05923d7ded1db9221b9465dc5e81c8e657c2ef2e27d7bb41a772d
- MD5 ce9b4616c24082115df6342eec3b4423
- SHA1 b37a2319e0315408f9eda760a87860a78f2e2c4e
- SHA512 3b1b58c95bc725a876d15fcf6b078ff15f5f317c8a3baba14fb70dfc6da4e33dbe014a6e150a5991656655f1bb8b998cfac883095652c58a611a2f64a6b739b0
- TLSH T186216A8C76B84D6AA89BE25C7441028EA3518E0A84871D832E52DECDDDA5ED9326A47C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\events\events
- Size 4KB
- SHA256 53f479c1216749c1bfe71023cb0314e282879d71f270db528463d5dfdde97af8
- MD5 e0f656b73f090f6a6b9a70fb150bccb0
- SHA1 9b6072388f7087a6b59b43305404a5ce46111866
- SHA512 2661f3b11ac92053b2b630725f97eb78236da72f6586e599c5095451e8ea7e27654bd5b6210d37cced6017717aea1d2272147fc704d4cae1c399edabebdf211c
- SSDEEP 48:Ya4Kbbpb+kPeVK1kui/X50rnPGDWLbvWviPh4CSXVnm5MSdE12+Ii7dmoUYN0sEm:dzm5cgZEh4/edd7Ed0YSsZi25
- TLSH T134A1225C66A90C7E79DBD29CB840038D96D94E02D4C72C875ED7DE88CC6AE9A331E17C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\08f48651-6886-423f-9601-b51baed7da86
- Size 972B
- SHA256 17758bc47d4c2a3fc8d8965cde3b6e9f0bce9e10e195d49565c730369e870c53
- MD5 1c2057283ff7c5d35030316c2d463813
- SHA1 7d00436bf5e972bfb44ccad90428a7717506a1ac
- SHA512 ed350e76ecc424cb68471ab406917c57098d982300a3be85206ff4ff47bd1ca1fb553d8b712a96b1aa94bdf96c57ac787dcd4cbc2cd487548c8132c66ffcf342
- TLSH T101110E40892479B18CB8924F99E1374397F0752384C649243EB01E080DEA52AA3AAB07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\2151f0df-8df8-477a-b04b-2ac52d52155a
- Size 235B
- SHA256 31b019225589fb8125dbf6a4361be85be973fa2590d6d97dd66f5494295f0cb3
- MD5 f886a4a8cf13fd28081b6da95cfe0bdd
- SHA1 684b6fef1e041133138e62afd823d1fa3bcdabed
- SHA512 7f8f791389eb2c800eb8ee66d99970f135de59c91d74a15a26ff2bd3b3578a1f5660d4146ea658781b9b2a2663466b8ffe8539b64b4d45a5d2cbff517b935ae1
- TLSH T13ED09784349C2B7C0C140F02F0E0B8DA30884C3320B5A814D56185B89ABD9C44111896
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\278d8644-600d-49b6-9c85-a036c8021a76
- Size 2KB
- SHA256 8b0ee609f654dff8b68dc4e3f305eeefaaac475c79dd61ebe24d909ba73cdf73
- MD5 195402e2471dc930bfb6d28442672315
- SHA1 93b5bd3af4dea42b509e331b28a8ed162982ce41
- SHA512 727bec7c0f7bff416cdefabee6a7419bbaa5fc24d648ee85443962370ab238840fc161b67f837286c4a52d5d69e9103061acd88b626c6b213cc290cd05306905
- TLSH T18541219C35788D7A5CCAF55DD482338E93648B1340CA19933E51DF0CCC9AAAA736F51A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\64f49150-0edb-48bd-9edc-0b2d368218c7
- Size 235B
- SHA256 6ef6d3fd84d9b6ce3e1afa8470e9ada764ef79590f79da767eb280ba9c726836
- MD5 3c9f5297b0ba1ba1b9efcee8618299bd
- SHA1 b56c19874dabc31f0f66409496fbb3d8fd0d0ad0
- SHA512 0d106fb65aba37900cf23b250ea03b54407d133e9e82af7f6f4a14ed5dd59eb8f7f913bd4a82d517cd8850e157271b51900f6827f8f3969534a584614a5e5866
- TLSH T184D097C01888276D08045F1AB0F028C332894C336069A8208A67413489FCAC8035180B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\656f1e3c-ff08-409d-957a-b60e72ca1207
- Size 280B
- SHA256 6da56deb78fd907e1aef9c4952c05cef28cff82f8678704a7b44b5f7d1fb2928
- MD5 2c56a37e93ceabdee48e779f5cd1c77b
- SHA1 f3d0eb6af2b675b9f814d2b78ed780908dfa52b3
- SHA512 32fdd1e618adf371ba7249f425a0acccde307ee9008aca77b6ec01dca9eafc468513ae8a8013c6a9534cb93c7f11cf6fd9af22dd6cd958e6efbb215379402171
- TLSH T13ED02BD5288C376D4C680F06F0B034E771E58C3396F4591495E1453499FDED891A1E0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\6e97f11f-d6d4-44a7-857a-fdd782738dd0
- Size 7KB
- SHA256 ab498aeebbf1b7da304c6f3d8b978d62386d90de865f1569aa18c3f7bf25e2b3
- MD5 e78d8c408ea7e1a2169b84baea360f63
- SHA1 7f99a8bd067f053564fef955d520120f346199a6
- SHA512 3c4f4a6b388a0c6de9301df1e9b833b01d4ddfcc02fdc2db9d49e225889e5aff959a10a5d835d66272aa64cd73826ae4ee74cfa19aa6a8a8564a2064ebc30a89
- SSDEEP 96:i8Nt3QJoKdboLxz4JdlqdfyKRk/J/JemFapI0bL/qt:iss+F8lMKekxBemFQqt
- TLSH T178F1446CB6B80CBE69DFD19DA482039D43D84F02D0C12CC75DCADE4C8CADA9A335E165
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\855e54b6-f772-431b-80c8-b1e0da659c8f
- Size 280B
- SHA256 1a5d2dea3408c0e0828f5d8f5c01a8abb3399d5e963eba684e970dbea69b0c19
- MD5 b847667952141bf9128ab5411fe4dcb7
- SHA1 5d4c2166838a5806d4bb327857950b83baf3f914
- SHA512 77f757bbc49aa90a7e43daf32a8aa53a6abde2b73ed7fb1a4c0dd20607ed76afc5b9a5ee6a70c5741fbfacb0d201d1276c7952130136b6cfa2c0fd0fd39532a3
- TLSH T12ED0EB946C88222C4C6C0F56B0B038D234BD0C3344E5080484A209B0C6FEEC9C116C1E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\96ce021a-1af5-4c6d-b689-74e81443138d
- Size 886B
- SHA256 962d1a74c083abb2286c2e3b1e588475f8f452a534e03d600a2872e4856a68fd
- MD5 02f4f0a6ad33177e0bd886028a204f0c
- SHA1 10d5120c6ddb13df6c7550b73bfd50452c0b83dd
- SHA512 947cc8b6480fefbb04c9f00745f485711abcfbad122af497b45ec723d2a39529bd8abc6fa9e718f4815ccaffef31c1214c33c236cb0167b6e4b030daa057b361
- TLSH T19A11C051867879B18C64B29F89E1774287E4B523C0CA4D143EB89F084DAA51AA39660B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\99c4c707-9ec0-4f8b-bb2c-033ee25e5c01
- Size 883B
- SHA256 6090fe71f3cc71df04bfd5c1ebd8f103f4d3ad9eca2a490b8ba7c4931e0eba0c
- MD5 75197edba2b092decff41336989a26d2
- SHA1 9bc87f9a5ea7adc82c446fd4fafd00f2f69797c0
- SHA512 8b73b4d9828491459576d31af66bbc7f1e13e6272b3f7ea4c906bd8861de22b124b4e826d77a3f1973f69abc2dc0898e0ec1c7ff42415bbcf9ce1b8ab61ba7d3
- TLSH T1D2110080D63479B1CCA8A24FCD92771197F4B513C0CA84143FB49F080C7E62AA36660B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\9f4622ea-25f1-4052-a66b-1fdfff1a3f25
- Size 972B
- SHA256 c8ef69ab97e89e51a9de0b4da7b1edec175428dffd5ff94a465b48e9599f66dd
- MD5 f2e0736b5c365b8794cb9b41b574f4d0
- SHA1 441d43f28bffe52c2ad021c573d2c3b4b6acf532
- SHA512 f16d5a8220f03df34c1799aebf53f52244df3450606db4f04afedf1cd8a9d6f3130a929a96606f7d7b60d6e898adb5397222932e567538f46f6ec87e85b67e3e
- TLSH T1CB11E155852879B1CCB8A28F98E1775697F4B523C0C649143FF45F080CEA92AA356B07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\c1ee82e8-2a79-44a5-a5b9-8c5bb31cd8e4
- Size 1KB
- SHA256 69a1a8e62b324ab469d87c9f0a500f2f9cdaa687c897276c89b4d1990855b61e
- MD5 de2f583c39bb169fcacce17f16f8f336
- SHA1 9507f1cd4cde46a7c9682bafa9e2c360222c55e0
- SHA512 cfb5a0f609bbd60e7329d2613f6b993c34baff64debe7dbae704ff8e46d0d459d7eeea8108691039f69e440816f5313200107e353ac40e025641729be3a3d3f5
- TLSH T1D321FE1A8824FC799EBED12C52C3B79F6795B16340C66A023EB0AE2CC9E520A511B352
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\c2a1c671-12a1-4fc7-8981-97952dd7b00e
- Size 1KB
- SHA256 1e5505fdc47a00f6fde165a41ea347926c1e79088ceb72f0dd34daf3392431d1
- MD5 fb357b49ef511ac4d61558fee494af7c
- SHA1 b36c4f45441d6a998d374a2c9afb47ff917f1c6d
- SHA512 04aac3445bb050b703f17a8f69acac02c20f60e7df5c9cc7a5017df8c736ed34f7faf0f51338e3d829d9d5c31aa9fe8e8204ee1c65ce475fc71d8295fe3e11a4
- TLSH T17421570E8A14FC7DDFBE902C5782B7CE6FA4615310C69A523EB0DE1CC8F56061117346
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\e6ccdbe7-20af-4015-8d11-a26695c3ce26
- Size 4KB
- SHA256 5462f75a4f03bf016d2c2b0dddd98e2147be302589dbf0797af84571167de498
- MD5 0e03df322f905208ea6c9a1ec480dbc3
- SHA1 a8f1de38d3955c954416727f996c62dbc3b78908
- SHA512 f86a43067771a4b0bfc6cd6c9d3b696c75be0ff98052aa78f6ddb3844ffde6850ca2cafbde3c8dc01887f7109f26eabeeecae17a242ed85af220d9ef66f74e76
- SSDEEP 96:jPXN+OKvc0dXoRpRVHB0ToZ0gJZG01ZhBsZ5fe:bjKv0Lhp3XmTfe
- TLSH T146A1642C35B80C7E6EEBE71D54C2235E57D88A57C0C51CC32E56CE8C8CA9A9A3329175
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\e7930ac4-c162-4f56-8dc8-5b9dfcb03922
- Size 16KB
- SHA256 5d3006a8232fc134d85bdbadd1a290d5fedc275790e6cd616d9a1165900e98b3
- MD5 4061aa6713c2bc6ef2adbc4df7d3f006
- SHA1 7e6a2184e2b52e6837d730913a15f50f5b558394
- SHA512 aad61e15e39d35beee13ef5484071410b22098ee8f453c19bd87352549f958f6b8c88a54992ea88a9caa2f8f014662d45e4b10673654003c0110eda0ccb77597
- SSDEEP 192:5eodbNijKKSz46T4/gJpz4K5doKN+ZbsutZzp+ZC49AuKeU48lHYU7pytUSORONX:7dbNijKKSUfUz4KFN+RsutZzW8MMrmoA
- TLSH T1ED72CA466820497A8691E36C94FC7FC3E6F538CF4C419FCA9BE4BD085DDA06E512784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\extensions.json
- Size 16KB
- SHA256 d475ef35bd1bd5f50f3f1ca2692a7ebfec6d248828678a19e80e1e1dd9f4232c
- MD5 25382df2ffc731a3f36302b16592fe80
- SHA1 a8138a7aa783e8eb43f5e927488c3dc2ea245d17
- SHA512 337d3aea0e0135ec7fd42036c26193f5afeb87b4b7d49d8a25d7bed5e450aa13ac5ddbc81d68b6c2b6a2337f1e5785e2bb555a0cd882c796dbf5083eaa22771d
- SSDEEP 384:kkI4vzUmldvH8dhWPVy94z296o84L4H1L4PGL4HotL4HUtL4Hwnb4h6:rI4bRfkXh4e664V4E4It40t4q4k
- TLSH T1FA72431545048EB8298FA79BAA367E01C37D473B60845C78F4DD8FC842FB5B902BB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
- Size 1001B
- SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
- MD5 580786a5ec9eb650dde3e0e75db8588a
- SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
- SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
- TLSH T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
- Size 18.9MB
- SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
- MD5 15fa9ea03f6f451d587b1dabb2f7b036
- SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
- SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
- SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
- TLSH T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\places.sqlite
- Size 5.0MB
- SHA256 0614c57b6c02830b88da0058007b7523e42a9791a6c52b9972a46b4378ca4f56
- MD5 bab4c5a3dcb3779eb218524634b8bc8d
- SHA1 c144cb06813ddd236674bf236f422fbf5fcc8639
- SHA512 3bcbdf2d69fe7801c53b87f1c12ec4c894aa9616f31c867a54c6e2f0f97cdae64073c8a63571f08b83bf5805c3e438a594a5194bb8be5669e722c82017f8a9a7
- SSDEEP 192:M8rJQaXoMXp0VW9FxW5YvobDHhH4z/2maDbE/FXkV3jKNWE:M8r54w0VW3xW5YmDHhYz/2nvqkVW
- TLSH T13D36934F7A616151D4EB9232BCE36F191C3F71068A3276D238A4252D4DE0B66B91CCBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
- Size 12KB
- SHA256 bdcbac0169b4dc02becd005b8fd1f236cc6decbffd7488878a77d14ecde9f785
- MD5 72f508e3d0913b750e412228f045ef7f
- SHA1 7dd0e754dac1c5aa6fdc787b430a30418bd905c8
- SHA512 061627a6c284ddd6a2049b309343bdbef31d6e4ecfa531949f8703091343503a01ad2020e7f6dc5f0d6a866fab7606cffbdfaa6075606683be2d75c8c1a8ad0e
- SSDEEP 192:FwCRFgfAwQCPSSELRICH3dmBw8OgVUNCDU:3g0RT32waJY
- TLSH T12142DE78D244CA7F30B7317D6C2949B019650527BABFBCD656F884C5092CF2442FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
- Size 12KB
- SHA256 5fcb43ccbeace27974394528b0321dbafc81f94932b91abb716e100a289ac596
- MD5 b11dc9f435045ae7de6970e133dfee6e
- SHA1 77aef6e9382fe97635ea7396a066a2404c356e02
- SHA512 133d24782a67ec00bdab1554c2c564288f09694bdeb067cf22fe5d1dd2cca9fcf7508ee6bdb4a5f187a95e7c3551ef4bb23ebd6aed6fec6018c458da089f1720
- SSDEEP 192:FwCRFgfAwQCSSILRICH3dmBw88gVUNCD6:3gcRT32wIJm
- TLSH T10F42FE789144CA7F30B7327DAC2949B019650527BABFBCD652F884C5096CF2442FAAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
- Size 12KB
- SHA256 88a0c6e15744a481bb747bea443c419648fd2d78fb27bfb1c70e9a89d31f8471
- MD5 94406f47fdc2ff77d971fa14726a25a2
- SHA1 ff02be3a48675733f53525388d98be307aa29f48
- SHA512 d33d5ebea590b6b1106f5c1033a2ec215694929bc60240e5f27d907d98ca8d32191c73cd7b2852cf70b2563fab9e2dcb8358f9ab519f6c0929bc4c176bf375d4
- SSDEEP 192:FwCRFgfAwQHSSILRICH3dmBw88gVUNCDp:3gDRT32wIJN
- TLSH T12842FE789144CA7F30B7327DAC2949B019650527BABFBCD652F884C5092CF2442FAAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
- Size 12KB
- SHA256 8388dce35c6bfc74083fd09860046630b723c126efa6dea168c97535fb98a377
- MD5 12c168f518b8597b3bfe4e41a75b965b
- SHA1 6844f77b252c93004188c8575937b95f25de8f76
- SHA512 10caa20249845cceab9351a13dd977d84d56d67bc4fc65904ff1954e2fdf95b06bc062f5260c0dc1af0de48ce66fe6583bd926083da14f7cc3eea4c5f49757bd
- SSDEEP 192:FwCRFgfAwQhSS/LRICH3dmBw88gVUNCDU:3geRT32wIJY
- TLSH T17942EE78D144CA7F30B7327D6C2949B019A50527BABFBCD656F884C5092CF2442FAAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
- Size 8KB
- SHA256 6f003f6f690cd3636b718c06f1860ceaaa9a42dc7edd60ff8296ef640b5af661
- MD5 56a32f265c88ef25381fca452a6fb49c
- SHA1 3b168f381bd971dea40f29677a36a7d48eef30b0
- SHA512 3665cf4870d67fcdc2ab3b16123f34ee22e95447cc6f2992b4e84516cc459a93651b1ca0ad8553e280aa915cee37c66ecc0868f1179dd7418a62f3c3f8d1c3b0
- SSDEEP 96:xHWgxTUaqGqFyzfAwQNbzSDPSSlldv9j1PnoWRnZDaCHVLgBw88sMHZl8L4cnivg:FoRFgfAwQCPSSVRICH2Bw88TZ+
- TLSH T13D021E789104CF7F74B7366CAC2889715AA2013BF6BF68D721B944C50518F3442FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
- Size 6KB
- SHA256 6d67567a11cf660f8e6af6ffb4f91556890c270d8da8f419dc2dc4d97e0bd616
- MD5 03240cae62dec256dc494abb695e879b
- SHA1 aa06cf98241176823940398476cffd595e59df94
- SHA512 ca039536f37e12293bdb88384113b2ae807d2dc74a85e22abc1363a986b5f5f7ff415893fb13c532013da98d45e0fef0fd58b70b3b0da548a4c8f3500cb60e42
- SSDEEP 96:xHWgUTUaqGqFyzf3KjCnjo1zS0SSlldv9jO7noHdDaCHV4Bw88H8L4cni0v:FdRFgf3lEJSS+i0CHWBw88q
- TLSH T1F3E11F7894088B7F64B6776CAC6888716AB2413BB7BF68C750B544C4051CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
- Size 6KB
- SHA256 b157851916e65a5725e3a8fe218397b2e75aeb86e75acc5c572e06fee2b5e5a4
- MD5 26821d8f58ed9591f26ab0057058fd2f
- SHA1 23f4aa245317e35269ec5c6777e11c490dfc887d
- SHA512 2bf55f529f5e6b39e0b5a383a8132937050e787b3e9aaf2c50493105897657b61c04732128a57ba9fa4e7db09ded2949903280777a1f366fa903ee42aeabf810
- SSDEEP 96:xHWgUTUaqGqFyzf3wQkzSDPSSlldv9j1PnoHdDaCHV4Bw88H8L4cni0GGS:FdRFgf3wQNPSSA0CHWBw88Z
- TLSH T19DE1107894088B7F74B6776C6C688871AAB2413BBBBF68C750B544C5051CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
- Size 7KB
- SHA256 4e9611e1926bd5f62fa60cff6acd187ed4195169d985a86caaf6cf931af40bf7
- MD5 a1906c1f9e64edbf2147ef9f7024fcaa
- SHA1 e83e849c9644d705309e70ab10bf7b2538d65991
- SHA512 dd92a763c625a9bb6a5db414f1946c05728e888ff22ebc51ffa5e474564a80ef47b94ca8f300777ed2c4a91d6fb674b1998ede937b1b33bb77631c08282dc71c
- SSDEEP 96:xHWgUTUaqGqFyzf3wQNbzSDPSSlldv9j1PnoHdDaCHV4Bw88H8L4cni0GGS:FdRFgf3wQCPSSA0CHWBw88Z
- TLSH T174E1107895088B7F74B6776C6C688871AAB2413BBBBF68C750B544C4051CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
- Size 12KB
- SHA256 73ed3e482ae18feba9115dcc266ad4916b1d1da6d8b0655e9cc8cc74a4211ae0
- MD5 d7f0096315e4c8c79aee2b4dbdde3f2d
- SHA1 d4b63f2f36e3c932309c0de625328b00351f404c
- SHA512 6d03f80620100c68fdbd6dccf11f95e5193b830d70f3b56856b0a70e2d11f5013575d0adc91337d5783cc0dff49a1866ce84cc4b907f74355c20e60e83462390
- SSDEEP 192:FwCRFgfAwQeSS/LRICH3dmBw88gVUNCDU:3g3RT32wIJY
- TLSH T16342EE78D144CA7F30B7327D6C2949B019A50527BABFBCD656F884C5092CF2442FAAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
- Size 6KB
- SHA256 a366dad54a17db55f26d057f4d35a72a77157208fbd9ad6ef7fc4edc2a56c7b5
- MD5 ede323ac49bd267c7d70c4431e7a11b4
- SHA1 04f636dffad918d88fa6d4feae5f8ab541a4c550
- SHA512 8126011fe36890a9ba4fcef88a6fb71283d7a21e9ece38b43fc53e4d57cc4daa96d064d0cf6e78fbdd5088684fb6d6643fd5020fa75b632a37ad397af23eeb3e
- SSDEEP 96:xHWgUTUaqGqFyzf3wQ1zSDPSSlldv9j1PnoHdDaCHV4Bw88H8L4cni0GGS:FdRFgf3wQePSSA0CHWBw88Z
- TLSH T1A1E1007894088B7F74B6776C6C688871AAB2413BBBBF68C750B544C5051CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionCheckpoints.json
- Size 122B
- SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
- MD5 99601438ae1349b653fcd00278943f90
- SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
- SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
- TLSH T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionCheckpoints.json
- Size 53B
- SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
- MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
- SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
- SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
- TLSH T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionCheckpoints.json.tmp
- Size 288B
- SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
- MD5 948a7403e323297c6bb8a5c791b42866
- SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
- SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
- TLSH T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionCheckpoints.json.tmp
- Size 259B
- SHA256 4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
- MD5 700fe59d2eb10b8cd28525fcc46bc0cc
- SHA1 339badf0e1eba5332bff317d7cf8a41d5860390d
- SHA512 3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4
- TLSH T15DD02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionCheckpoints.json.tmp
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 9KB
- SHA256 648361ddd2968fe2017b368886e0cb932ed6a1a8b45d61e3ef2cdad2be527793
- MD5 46f5c1a59f44d3c241a6cdafb4f31725
- SHA1 c821377d5d8fb3370d5e2230b9e657d964be7b1a
- SHA512 03d6028ce5bb0c8d5f449703606da753fbba356fbc03e8402a7ccc4b2431455f94e96ca04a0d5b8ab4118bdb5f7de5ac86d278fbf5c0962eb8e699dad7b2a9dd
- SSDEEP 192:U3bMi/i0v/4QgzobC7hDIY5LhHH3SzCx7Z:U3Ai/pgQZb4b5Lhizmt
- TLSH T1A0129EABC80231BFAA96C47AA88A1DCE09634C9185EB12DFFD6DF73901397161106DC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 12KB
- SHA256 7a1f42ba371e5d10fa83906ccfb34a4c2d3e0f25183a2dbef1e2c9045685c18b
- MD5 2eb8d3075b7e68042ec215c009026eab
- SHA1 5a97c21f80ede62822a41a6e1e71468578da0685
- SHA512 668147188b1a2a80c7f65fef415f3a8c41dcf50666e1f2c026ce92376ac3e1de8eca5acb3105a171b391c782419d5ce09fe6d013921415a7533c620691fff3d4
- SSDEEP 192:u3bMRwmK23no49b9Z+gwTIsWUeLiFi0v/4+0IgzobC7hDIY5LrElASDCxE4r+:u3AetyHv4bWU3FpgaZb4b5LrEnDmbr+
- TLSH T13742AFAFDC023AB7EBC788654C491CEE0B632C41C5FB12DF9E18B979057871627495D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 6KB
- SHA256 0e20bea788d87b4a2770bec8c6cd14e9ecb1916215e7bd3c9785990792ca2b2b
- MD5 9deb682195f2b40296b312a03336fe8d
- SHA1 922dafd59115e05693ab2924f4934e5527d87e68
- SHA512 df186b5c337743de358687a1c0c59e96c09de8a464bc0149206152f30100c38d31b97acb6208eab6b0d07118e05aeeecd6771d7fa382d6b79ce68d5e49a41e3d
- SSDEEP 96:127j69lECJXv+J5IBzB+8SAw/FZAR7nLdDL9SOD4RFf/jF4anHLZBTh//Cz4El:1F9lErMzobC7hDne5LFbnHbh//Cko
- TLSH T15FD16C8DCD4234F9ABDA40B6D0C93CDECD239402C7E852DADE98F66C452A365378B980
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 7KB
- SHA256 52cc60dd4c4008ece403cbebf9c10cf78d61a9cfeb91f122f230bbc86968511d
- MD5 71d20fa4c50c13b0f36f6196ebe10e75
- SHA1 5e60a082b04418a22ae99c5a1154be77e5c54836
- SHA512 1d8d302bae4d6cf578b298a321495b702a73a9c1310a2bb38f10a4ad3ef179f45106abdb85c4ce176568c1de049a738a8ded58d9d706bd5467d710f79a598977
- SSDEEP 192:fnK9vot/NSvIHcjtZz7lDOd5LD+HzlkCxe5m:PKit/EwHcb1Y5LD8kmeo
- TLSH T12CF19F9ADC0235FDDFE6846184CD3CFE4E776002EAE803DAA959F57D9228714360DAC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 5KB
- SHA256 20514df15997e1e654abbd109b3264c9b85250d14be07030450ca5c19a6ebf04
- MD5 6cd561d7eba752f7cef65f65c014c045
- SHA1 7807de3615b434c140aa88c6dbcee3e5582e4775
- SHA512 3de4028d078541c5bf6306d9ec93793e21db404b152d0c996330a6c57f83a3dda7def54af56f7b9b8bde43fa25e53b74b78aa2f37db5497c9ebcbbeb604b8679
- SSDEEP 96:O2sMlw/b+TJ5IBzB+8SAw/FZAR7nLdDL9SO7HRFf/jOsanHLZBTh//Cz4EXU7:O3Ml/MzobC7hDPx5LUnHbh//Ck8s
- TLSH T170C15C88CC0131FEAADB85B2C4893CEE89375413C7FD57DAAAADB66C0525725224F5C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.jsonlz4
- Size 13KB
- SHA256 fbecb9fda64ff2af05d3be0c20220454bb153e4b7d57c11167a6f1e1e356d2e6
- MD5 71fefc20f2abdaad059de513104925bf
- SHA1 8908a8ac2267c6d09068a0e567af6c2e02c9f22d
- SHA512 8fe228c5ae13ba9527011cb5d6176e0491f6d1c6c34812345a8d29c51b8a44667405d1fd578e186015ddd620afe54d3628cc5efd72e1ae6306770fef9a570635
- SSDEEP 192:sEMdqyPs49tv8iIISb3seAxpcssGUi0v/46viYUL07hDI75LbuZrcCx+:gIyPzUdISOjfUpg6ixWE5Lbwcm+
- TLSH T10752BF3FD612BCFAE6D648314C490DFE06626C40C2FE22DB996EF97D4138735264D9A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\cache\morgue\61\{3488442f-a92d-4989-b22c-39e8a227eb3d}.final
- Size 404B
- SHA256 ba3629c199956f51e9256ed5da1375954a0197263210e8f39a4e002329b71af0
- MD5 85051cf42305694e9081822a85c9db9d
- SHA1 9a0d7f1155462e0d8ffdf08d3d82057b538726e4
- SHA512 3f9214d83f9c947d8f52e0ce2905f67192e15774a1f79a03729b2c32e955a31d2375c4213277e2623cf1f3f5922dece3733a89981e1eaccdbca1a9c89ae3c848
- TLSH T131E0F11BF3E974DC100D5B80BC6E7602ED4034FD83E840D9C5D01D33B364EA25242B98
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\2171031483YattIedMb.sqlite
- Size 48KB
- SHA256 07e9d366041e3378a229f3702cdd6364ac04695f3dbb81925fb1fed33709e99d
- MD5 a3ac8d89b914d0cd4c3a786096d7569d
- SHA1 a2620a053d99140ea99a3a81e3fc3aa2d1e84d4e
- SHA512 ef038e5484969863f9ba69d0c266b379d592eb30f4a2144fb97a15b083b8f9564415b8285253e2d4470ad5658dfa1c4b5529acebb1565365c02a0966b39fbb3e
- SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyETBn4ES:Oa16S6CKnqlizbxV+2xVeU7X2B0TBn
- TLSH T1D7238F8E3F06F511C536F0B1B8A48C52E85E321E07222AD579D0DAE4C8F215AEA5F976
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 3.2MB
- SHA256 49d0bc3fda64862f57b9ffbe708af53d89edca05558504b30dfce7d227bcfe02
- MD5 3411a460fc43377bb01eeffc1ed9546a
- SHA1 55a2d0c0f891f0691575242ac219d36351ddbcce
- SHA512 497c49b581a88b1339f52b76fe87dcbb26e687d934748408c9844b566042d1443518e00b8db714eb006ce249cb976b4d841e18a75aef1a62ca61eef861c60338
- SSDEEP 24576:QE+OO/IgzrJErR6lZYDyrRLvcMkrf2vOWlr3Ut:QVbfJE6kDyrRjcMkrevOwr3U
- TLSH T11FF52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 3.3MB
- SHA256 9b9eb1a0246c72b7747ddde99930a9f86e8c5a4eb19525d8717b5adc79c0ade8
- MD5 5bd17f1b988258bf3a302e6d89e32899
- SHA1 1188545756960daeff34f899db285be35a0d8dee
- SHA512 41eabe2c48609aae122b26d9967c84d6fd4716a28a0bdd92186b2ede8d1913b1768db9ad7bc0578605356f689701e30ded802f629770fa14a0955105b8f56e28
- SSDEEP 24576:kE+WO/IRU1h62rc6lZYDyrRLvcMIfy85cWlr33tA:kV+ih6b6kDyrRjcMIf55cwr33q
- TLSH T181F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Wireshark-4.6.4-x64.exe:Zone.Identifier
- Size 249B
- SHA256 5ea6f940d68d26f17922c563897d6533cddd51b1b55da1ffdc9776a4d905b0b5
- MD5 fe56653ee9cc03fb8ca07353ff6510d7
- SHA1 f94e2dda3e180592285209987816dd7ef002b5f7
- SHA512 4d75ba54b7e169cb217e9a9fd4d2e3c272027ba86106ff3e4ad4cc21e5906fed881b2ef99a2430cb4584d5b4a092659a7335d9f3e1cdea88554cb7c9435b3ea8
- TLSH T175D05E977994B4E2021E2AC1627EFA69DB17118CDEE01194ED9522AA958816488A037A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\SET699.tmp
- Size 12KB
- SHA256 fa2c6b37aa32c1952b19bd99ab55483035380e1f02b03a714cb79744a83dc3f2
- MD5 364e0389c562fec8f48a522c3caa39a9
- SHA1 f2d7aada2c6e8bbd98c8797b89229ea93fdcfe59
- SHA512 8baa279b9b53bd90ddc1e1da8c5d2838f39c7d413dfebceee8991e8018124242d1f27ebedfb0b1354b02242e2b5b43ea75ac7828ae30875021e1489109185060
- SSDEEP 192:XUYgJOQoV31R2JCc2PXWEwGJhYC/bAw3WIX7X01k9z3A3TcY:EOlIn2P3h3MifX7R9zATcY
- TLSH T10C42E8A555984083F9A7AC6003E4F54BBC7D37CB584045AA26AEFB1E0D673C8FB1416D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\SET69A.tmp
- Size 8KB
- SHA256 eee91afab370399717e7d5138e17aa3907c03b6bb6b1876f6438ad3b167bc224
- MD5 6ce25c0eefbebc189f8294c68ebfa93c
- SHA1 2a3c8d9670fabead0b354b19927fc872c2908622
- SHA512 61582cd88677af36b7661588c1a8124ec375f5cd59f0a8c9dd13762853a002535045149f234d72753f882bb307bb37d5d214548daac1b963c5acf5f2b860c5a2
- SSDEEP 192:l3ZT71HTe4BMNaoyOpW0O3lv5YMN7YyOpW0O3lU7Gb2L9dpnG5YV0q/4vOOgS:/JTe4BMN3yOXO3lv5YMNsyOXO3lU7E2M
- TLSH T1C802940A9C866B1011F2C292F7417842D53DB2D2AACF0148728ED691A71FD8CF63DE7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{ef9980f0-70d1-ee43-adeb-e8fb53e4bdd2}\SET69B.tmp
- Size 80KB
- SHA256 c5a656b22d5e976858bb6d98ed4b11d6ed91dbd1f5de630538f49d4eb2c37eb3
- MD5 863ef02215fe84efa29e61115083dfdb
- SHA1 82b6e1f05fa7ad175e68d937580e32f28cdd4a4a
- SHA512 7e154690ad53e32d8b98791ae88b29145b17dfce099a8e5e161f86c41b7a989ae4894176250f9bfdb8399ed129da958795a691af7bd661ed5378befa619ef58b
- SSDEEP 1536:68TA8SPQHlKkFpzZejsIHfZan7LlDE/s5FGP7/xrzA:6gAJQHlK6pZehHglg/s5FGPDJ0
- TLSH T10D839ED662F459D6E567C674D2E1890BEFB1B44227218BCF0260C66C1F53BD1AE3E328
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{2B2CDCB8-4521-4353-BE67-C8310B74AC89}\.cr\vc_redist.x64.exe
- Size 670KB
- SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
- MD5 bc9c8a6a42e8d3ea18f8da78d5031820
- SHA1 07812a4b945364d04627363e46ab38de188281b3
- SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
- SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
- TLSH T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A8124D93-BEE3-4AF8-AFAA-E467798B4CDA}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{A8124D93-BEE3-4AF8-AFAA-E467798B4CDA}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A8124D93-BEE3-4AF8-AFAA-E467798B4CDA}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 5.4MB
- SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
- MD5 ea81447ef1038bd5726b36063896b39a
- SHA1 8f484a24bfe42276580d120c200a99bf604eea70
- SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
- SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
- TLSH T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A8124D93-BEE3-4AF8-AFAA-E467798B4CDA}\cab5046A8AB272BF37297BB7928664C9503
- Size 964KB
- SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
- MD5 efc41c00aadf8b2050ecf9e38e9036f1
- SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
- SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
- SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
- TLSH T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A8124D93-BEE3-4AF8-AFAA-E467798B4CDA}\vcRuntimeAdditional_x64
- Size 208KB
- SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
- MD5 f375f3d81a661e188146d701d8ed3ba9
- SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
- SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
- SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
- TLSH T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A8124D93-BEE3-4AF8-AFAA-E467798B4CDA}\vcRuntimeMinimum_x64
- Size 208KB
- SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
- MD5 23626831f9a05572c6ebd133e5ffc4b0
- SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
- SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
- SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
- TLSH T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B8DBA332-5C6A-43E3-AF7E-9F62B035C299}\.ba\license.rtf
- Size 9KB
- SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
- MD5 04b33f0a9081c10e85d0e495a1294f83
- SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
- SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
- SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
- TLSH T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B8DBA332-5C6A-43E3-AF7E-9F62B035C299}\.ba\thm.wxl
- Size 2KB
- SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
- MD5 fbfcbc4dacc566a3c426f43ce10907b6
- SHA1 63c45f9a771161740e100faf710f30eed017d723
- SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
- TLSH T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{B8DBA332-5C6A-43E3-AF7E-9F62B035C299}\.ba\thm.xml
- Size 8KB
- SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
- MD5 f62729c6d2540015e072514226c121c7
- SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
- SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
- SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
- TLSH T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{B8DBA332-5C6A-43E3-AF7E-9F62B035C299}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- TLSH T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
- MD5 SHA1 SHA512 SSDEEP TLSH