e435b011d7cb0329e63c7da0d0d1c7b04bb8b3862435966a22edba05d771393b

Analysis

user interaction
yes
max time kernel
476s
max time network
472s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 20:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RIP_Tweaks_V4.7_Installer.exe
Size 41.5MB
Sample260428-zmkdfsat3m
SHA256 e435b011d7cb0329e63c7da0d0d1c7b04bb8b3862435966a22edba05d771393b
MD5 622ccdc91109f114ad6f1d9683a6f08b
SHA1 e0b8c150662629d736c5220c7f56d293b3b1873a
SHA512 517b2fd746e9faba3222c3bec19227e18bfe005af1c098eb34363b94155b443b6fb8a71265e9a1a5808922150965029f12a3bf6730d7504121c746d30633971e
SSDEEP 786432:2wGxzmeIx0nmCYmTwbgVIf2ZERwAqq8BtUorEXFiTa4OwyNBPhDP:2hqZx0dYjbgIf2G9qLrtOiOTwyH5DP
TLSH
T1A897333BB247653AD46EE9377572E224053B6A2560064F1286F88C4FFF694311E3FB86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery installer persistence ransomware themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RIP Tweaks V4.7.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RIP Tweaks V4.7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RIP Tweaks V4.7.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	go-memexec-1124434714.exe

Executes dropped EXE 5 IoCs

pid	Process
3480	RIP_Tweaks_V4.7_Installer.tmp
2428	RIP Tweaks V4.7.exe
1632	go-memexec-1124434714.exe
468	go-memexec-1124434714.sys
3952	NSudoLG.exe

Loads dropped DLL 1 IoCs

pid	Process
2428	RIP Tweaks V4.7.exe

Themida packer 38 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2428-256-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-279-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-307-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-319-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-340-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-344-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-348-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-394-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-407-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-428-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-440-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-444-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-686-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-698-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-702-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-706-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-726-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-738-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-747-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-1089-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-1175-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-1298-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-1646-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-1728-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-1752-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-1816-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-1851-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-2730-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5638-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5780-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5804-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5818-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5831-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5835-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5842-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5894-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5908-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida
behavioral1/memory/2428-5912-0x0000000140000000-0x0000000144CA9000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RIP Tweaks V4.7.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	go-memexec-1124434714.exe
File opened for modification	\??\PHYSICALDRIVE0	go-memexec-1124434714.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2428	RIP Tweaks V4.7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1041672015\adblock_snippet.js	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1770986698\test.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1041672015\Part-DE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1041672015\Part-FR	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Mu\Staging	msedgewebview2.exe
File created	C:\Program Files\RIP Tweaks\is-ASS66MKM8Y.tmp	RIP_Tweaks_V4.7_Installer.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1188057033\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_728279149\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Sigma\Advertising	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_308776442\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Sigma\Social	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_184197306\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1041672015\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_308776442\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1770986698\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Program Files\RIP Tweaks\RIP Tweaks V4.7.exe	RIP_Tweaks_V4.7_Installer.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_728279149\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Mu\Analytics	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_728279149\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Mu\Advertising	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\RIP Tweaks\is-UUY15R7GLO.tmp	RIP_Tweaks_V4.7_Installer.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1041672015\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Mu\Social	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1770986698\model.markov	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Mu\Content	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Mu\Entities	msedgewebview2.exe
File opened for modification	C:\Program Files\RIP Tweaks\unins000.dat	RIP_Tweaks_V4.7_Installer.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1770986698\passwords.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Mu\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\Sigma\Content	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-en-us.hyb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RIP_Tweaks_V4.7_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RIP_Tweaks_V4.7_Installer.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3384-0-0x00000000006B0000-0x00000000007A7000-memory.dmp	innosetup
behavioral1/memory/3384-19-0x00000000006B0000-0x00000000007A7000-memory.dmp	innosetup
behavioral1/memory/3384-32-0x00000000006B0000-0x00000000007A7000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218834202457988"	msedgewebview2.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riptweaks\shell\open\command	RIP Tweaks V4.7.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riptweaks	RIP Tweaks V4.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riptweaks\ = "URL:RIP Tweaks Protocol"	RIP Tweaks V4.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riptweaks\URL Protocol	RIP Tweaks V4.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riptweaks\shell	RIP Tweaks V4.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\riptweaks\shell\open	RIP Tweaks V4.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\riptweaks\shell\open\command\ = "\"C:\\Program Files\\RIP Tweaks\\RIP Tweaks V4.7.exe\" \"%1\""	RIP Tweaks V4.7.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
180	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3480	RIP_Tweaks_V4.7_Installer.tmp
3480	RIP_Tweaks_V4.7_Installer.tmp
3952	NSudoLG.exe
3952	NSudoLG.exe
1916	msedgewebview2.exe
1916	msedgewebview2.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4808	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	go-memexec-1124434714.exe
Token: SeIncreaseQuotaPrivilege	4428	WMIC.exe
Token: SeSecurityPrivilege	4428	WMIC.exe
Token: SeTakeOwnershipPrivilege	4428	WMIC.exe
Token: SeLoadDriverPrivilege	4428	WMIC.exe
Token: SeSystemProfilePrivilege	4428	WMIC.exe
Token: SeSystemtimePrivilege	4428	WMIC.exe
Token: SeProfSingleProcessPrivilege	4428	WMIC.exe
Token: SeIncBasePriorityPrivilege	4428	WMIC.exe
Token: SeCreatePagefilePrivilege	4428	WMIC.exe
Token: SeBackupPrivilege	4428	WMIC.exe
Token: SeRestorePrivilege	4428	WMIC.exe
Token: SeShutdownPrivilege	4428	WMIC.exe
Token: SeDebugPrivilege	4428	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4428	WMIC.exe
Token: SeRemoteShutdownPrivilege	4428	WMIC.exe
Token: SeUndockPrivilege	4428	WMIC.exe
Token: SeManageVolumePrivilege	4428	WMIC.exe
Token: 33	4428	WMIC.exe
Token: 34	4428	WMIC.exe
Token: 35	4428	WMIC.exe
Token: 36	4428	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1576	WMIC.exe
Token: SeSecurityPrivilege	1576	WMIC.exe
Token: SeTakeOwnershipPrivilege	1576	WMIC.exe
Token: SeLoadDriverPrivilege	1576	WMIC.exe
Token: SeSystemProfilePrivilege	1576	WMIC.exe
Token: SeSystemtimePrivilege	1576	WMIC.exe
Token: SeProfSingleProcessPrivilege	1576	WMIC.exe
Token: SeIncBasePriorityPrivilege	1576	WMIC.exe
Token: SeCreatePagefilePrivilege	1576	WMIC.exe
Token: SeBackupPrivilege	1576	WMIC.exe
Token: SeRestorePrivilege	1576	WMIC.exe
Token: SeShutdownPrivilege	1576	WMIC.exe
Token: SeDebugPrivilege	1576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1576	WMIC.exe
Token: SeRemoteShutdownPrivilege	1576	WMIC.exe
Token: SeUndockPrivilege	1576	WMIC.exe
Token: SeManageVolumePrivilege	1576	WMIC.exe
Token: 33	1576	WMIC.exe
Token: 34	1576	WMIC.exe
Token: 35	1576	WMIC.exe
Token: 36	1576	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4428	WMIC.exe
Token: SeSecurityPrivilege	4428	WMIC.exe
Token: SeTakeOwnershipPrivilege	4428	WMIC.exe
Token: SeLoadDriverPrivilege	4428	WMIC.exe
Token: SeSystemProfilePrivilege	4428	WMIC.exe
Token: SeSystemtimePrivilege	4428	WMIC.exe
Token: SeProfSingleProcessPrivilege	4428	WMIC.exe
Token: SeIncBasePriorityPrivilege	4428	WMIC.exe
Token: SeCreatePagefilePrivilege	4428	WMIC.exe
Token: SeBackupPrivilege	4428	WMIC.exe
Token: SeRestorePrivilege	4428	WMIC.exe
Token: SeShutdownPrivilege	4428	WMIC.exe
Token: SeDebugPrivilege	4428	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4428	WMIC.exe
Token: SeRemoteShutdownPrivilege	4428	WMIC.exe
Token: SeUndockPrivilege	4428	WMIC.exe
Token: SeManageVolumePrivilege	4428	WMIC.exe
Token: 33	4428	WMIC.exe
Token: 34	4428	WMIC.exe
Token: 35	4428	WMIC.exe
Token: 36	4428	WMIC.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
3480	RIP_Tweaks_V4.7_Installer.tmp
2428	RIP Tweaks V4.7.exe
2428	RIP Tweaks V4.7.exe
2428	RIP Tweaks V4.7.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
16756	7zG.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2428	RIP Tweaks V4.7.exe
2428	RIP Tweaks V4.7.exe
2428	RIP Tweaks V4.7.exe
6112	firefox.exe
6112	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3480	RIP_Tweaks_V4.7_Installer.tmp
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe
6112	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3480	3384	RIP_Tweaks_V4.7_Installer.exe	85
PID 3480 wrote to memory of 2428	3480	RIP_Tweaks_V4.7_Installer.tmp	88
PID 2428 wrote to memory of 4808	2428	RIP Tweaks V4.7.exe	89
PID 4808 wrote to memory of 4524	4808	msedgewebview2.exe	90
PID 4808 wrote to memory of 220	4808	msedgewebview2.exe	92
PID 4808 wrote to memory of 220	4808	msedgewebview2.exe	92
PID 4808 wrote to memory of 220	4808	msedgewebview2.exe	92
PID 4808 wrote to memory of 112	4808	msedgewebview2.exe	93
PID 4808 wrote to memory of 4620	4808	msedgewebview2.exe	94
PID 4808 wrote to memory of 4620	4808	msedgewebview2.exe	94
PID 4808 wrote to memory of 2548	4808	msedgewebview2.exe	95
PID 4808 wrote to memory of 2548	4808	msedgewebview2.exe	95
PID 4808 wrote to memory of 2548	4808	msedgewebview2.exe	95
PID 2428 wrote to memory of 1632	2428	RIP Tweaks V4.7.exe	96
PID 2428 wrote to memory of 4452	2428	RIP Tweaks V4.7.exe	101
PID 2428 wrote to memory of 3920	2428	RIP Tweaks V4.7.exe	103
PID 4452 wrote to memory of 4428	4452	cmd.exe	105
PID 3920 wrote to memory of 1576	3920	cmd.exe	106
PID 2428 wrote to memory of 3952	2428	RIP Tweaks V4.7.exe	123
PID 4808 wrote to memory of 5064	4808	msedgewebview2.exe	125
PID 4808 wrote to memory of 5064	4808	msedgewebview2.exe	125
PID 4808 wrote to memory of 1852	4808	msedgewebview2.exe	126
PID 4808 wrote to memory of 1852	4808	msedgewebview2.exe	126
PID 4808 wrote to memory of 1916	4808	msedgewebview2.exe	127
PID 4808 wrote to memory of 992	4808	msedgewebview2.exe	129
PID 4808 wrote to memory of 992	4808	msedgewebview2.exe	129
PID 4808 wrote to memory of 5828	4808	msedgewebview2.exe	130
PID 4808 wrote to memory of 5828	4808	msedgewebview2.exe	130
PID 6040 wrote to memory of 6112	6040	firefox.exe	133
PID 6040 wrote to memory of 6112	6040	firefox.exe	133
PID 6112 wrote to memory of 4500	6112	firefox.exe	134
PID 6112 wrote to memory of 4500	6112	firefox.exe	134
PID 6112 wrote to memory of 4500	6112	firefox.exe	134
PID 6112 wrote to memory of 5148	6112	firefox.exe	135
PID 6112 wrote to memory of 5148	6112	firefox.exe	135
PID 6112 wrote to memory of 5148	6112	firefox.exe	135
PID 6112 wrote to memory of 5148	6112	firefox.exe	135
PID 6112 wrote to memory of 3400	6112	firefox.exe	136
PID 6112 wrote to memory of 3400	6112	firefox.exe	136
PID 6112 wrote to memory of 3400	6112	firefox.exe	136
PID 6112 wrote to memory of 3400	6112	firefox.exe	136
PID 6112 wrote to memory of 5380	6112	firefox.exe	137
PID 6112 wrote to memory of 5380	6112	firefox.exe	137
PID 6112 wrote to memory of 5380	6112	firefox.exe	137
PID 6112 wrote to memory of 5664	6112	firefox.exe	138
PID 6112 wrote to memory of 5664	6112	firefox.exe	138
PID 6112 wrote to memory of 5664	6112	firefox.exe	138
PID 6112 wrote to memory of 5664	6112	firefox.exe	138
PID 6112 wrote to memory of 5256	6112	firefox.exe	139
PID 6112 wrote to memory of 5256	6112	firefox.exe	139
PID 6112 wrote to memory of 5256	6112	firefox.exe	139
PID 6112 wrote to memory of 5256	6112	firefox.exe	139
PID 6112 wrote to memory of 1576	6112	firefox.exe	140
PID 6112 wrote to memory of 1576	6112	firefox.exe	140
PID 6112 wrote to memory of 1576	6112	firefox.exe	140
PID 6112 wrote to memory of 1576	6112	firefox.exe	140
PID 6112 wrote to memory of 3160	6112	firefox.exe	141
PID 6112 wrote to memory of 3160	6112	firefox.exe	141
PID 6112 wrote to memory of 3160	6112	firefox.exe	141
PID 6112 wrote to memory of 3160	6112	firefox.exe	141
PID 6112 wrote to memory of 3828	6112	firefox.exe	142
PID 6112 wrote to memory of 3828	6112	firefox.exe	142
PID 6112 wrote to memory of 3828	6112	firefox.exe	142
PID 6112 wrote to memory of 3828	6112	firefox.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RIP_Tweaks_V4.7_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\RIP_Tweaks_V4.7_Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\is-4MLJ0VX0VG.tmp\RIP_Tweaks_V4.7_Installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4MLJ0VX0VG.tmp\RIP_Tweaks_V4.7_Installer.tmp" /SL5="$601FC,42070044,950784,C:\Users\Admin\AppData\Local\Temp\RIP_Tweaks_V4.7_Installer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Program Files\RIP Tweaks\RIP Tweaks V4.7.exe
    "C:\Program Files\RIP Tweaks\RIP Tweaks V4.7.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=2428.5056.5729228750395636435
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff8abdeb078,0x7ff8abdeb084,0x7ff8abdeb090
        5⤵
        
        PID:4524
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
        5⤵
        
        PID:220
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
        5⤵
        
        PID:112
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:8
        5⤵
        
        PID:4620
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3568,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
        5⤵
        
        PID:2548
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2200,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
        5⤵
        
        PID:5064
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1172,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
        5⤵
        
        PID:1852
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4560,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1916
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4464,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
        5⤵
        
        PID:992
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4376,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4072,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
        5⤵
        
        PID:1116
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2192,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
        5⤵
        
        PID:1392
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3780,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
        5⤵
        
        PID:17080
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4484,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
        5⤵
        
        PID:5168
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP Tweaks V4.7.exe\EBWebView" --webview-exe-name="RIP Tweaks V4.7.exe" --webview-exe-version=4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4536,i,18266694180846991125,3515530171917168511,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
        5⤵
        
        PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\go-memexec-1124434714.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-1124434714.exe --listen
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\system32\cmd.exe
      cmd /C "wmic diskdrive get model"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get model
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
  - - C:\Windows\system32\cmd.exe
      cmd /C "wmic diskdrive get size"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3920
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get size
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\resources\NSudoLG.exe
      C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\resources\NSudoLG.exe -U:T -P:E -Wait -ShowWindowMode:Hide cmd.exe /c C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\Basic_Debloat.bat
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3952

C:\Users\Admin\AppData\Local\Temp\go-memexec-1124434714.sys
C:\Users\Admin\AppData\Local\Temp\go-memexec-1124434714.sys
1⤵
- Executes dropped EXE
PID:468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1636

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\Basic_Debloat.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:180

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27099 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {00f85f5f-0cd2-4783-8ba3-86577cc17594} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {0216a9c2-e06a-4d32-b2b0-f041f64d308b} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3488 -prefsLen 27325 -prefMapHandle 3492 -prefMapSize 270279 -jsInitHandle 3496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3584 -initialChannelId {3f9c4dbe-cae9-437e-aed7-fa1d39b7e43d} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3780 -prefsLen 27325 -prefMapHandle 3784 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {f2d60b40-6de6-4516-9f6c-9e9457fd7a91} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2720 -prefsLen 34824 -prefMapHandle 1500 -prefMapSize 270279 -jsInitHandle 1560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2804 -initialChannelId {b6ca6b74-65bb-4fcd-8a3f-9b76a28456cc} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5004 -prefsLen 34905 -prefMapHandle 5008 -prefMapSize 270279 -ipcHandle 5020 -initialChannelId {3dda29a5-4def-4480-b01b-52cf4598754c} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 33031 -prefMapHandle 5700 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {7f1fe5cb-7d9a-4816-969a-cedad103927b} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5924 -prefsLen 33031 -prefMapHandle 5928 -prefMapSize 270279 -jsInitHandle 5932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5940 -initialChannelId {c89ceb82-5bd2-4c76-be10-51143d4e9b7d} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6132 -prefsLen 33031 -prefMapHandle 6136 -prefMapSize 270279 -jsInitHandle 6140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6152 -initialChannelId {b8db6a9e-ec8d-4f6f-ab8f-e527eaa635c0} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5844 -prefsLen 33071 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 6388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2924 -initialChannelId {1498070f-60c9-4b8b-aa5d-83ec4b180982} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6596 -prefsLen 36758 -prefMapHandle 6764 -prefMapSize 270279 -jsInitHandle 6780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6768 -initialChannelId {af876e99-34a9-4503-88c9-a2a81f089f2b} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 36758 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 6472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {63d68332-8c72-4d20-82ee-4a88f2d4a1ab} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10236 -prefsLen 37240 -prefMapHandle 5864 -prefMapSize 270279 -jsInitHandle 6284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12308 -initialChannelId {4bb49d51-4bf5-4931-828f-bcc498b3e885} -parentPid 6112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:7748

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap29349:334:7zEvent17870 -ad -saa -- "C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\riptweaks_basic_debloat_2485469861"
1⤵
- Suspicious use of FindShellTrayWindow
PID:16756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1041672015\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1188057033\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1188057033\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1480914657\manifest.json
Size 132B
SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
MD5 a4d9ab812da8b2906ff9d46f9ffc07c3
SHA1 48b428dc760bc008058e6df47a9f05f2f86b4abb
SHA512 5a2ba950ed85ee55bc1402d57d09ca8d54c0c2df5b43a402bb8bf3668920a40d584fa18d270376b046e23be00698bd1399ef6a0b695ee6c0b99fb454616b1cb6
TLSH
T1E8C09B115801797654DD77F00D29D7526672CB1D1494250546F5C218EC2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_1770986698\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_184197306\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_308776442\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_41069107\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_44208509\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4808_728279149\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

9B9E9F460C23008C7664AAF66F4A80F73F1DF79C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lqvyev6p.default-release\cache2\entries\9B9E9F460C23008C7664AAF66F4A80F73F1DF79C
Size 170KB
SHA256 40abec9f9e011c92beb5e7e018e94cfcd430837a1c7f9e38545fbac82c3277f9
MD5 679365d50fd84ed57023c75f779b43a1
SHA1 2aa1c7c19a7533285f8f06ebaf0930dcf4eb1d3d
SHA512 2b9d4a299ee23fd89a81d9533b7f0bf9f055466d225a489bd1549a717d4d9022d09a02803f45b6d977c846457a36d0bf44a58f73ee7986cbc7993bac5273408f
SSDEEP 3072:SiWY+b5C09xefyDkxkdWPNZTE6SxLj18nD4RE0kTz6tcZOh2WyDDX2+G2UZoI:SBjvm64bPToj1ftHhiu+Gb
TLSH
T10E041237ECC5D2AD06056C8F2B6701BD65052566AE2E5B2874C83728ECF0DF2967F0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lqvyev6p.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 40fe88f4784f505f34bf40174e96be3669a26cb9c1ecc058fe87077c24b61608
MD5 750bdc0e7705d7d482d33ae08eedfa90
SHA1 3ae2f3911d8ecadfa3a974279805718efcf9c198
SHA512 782368260179100d450b38827f4945f6dd60689dd338fda2c11e51ec5c1367949e0beed5b53816d40df63d37c5ba51387f207d2f79c24fb47f4522e8cefc242b
SSDEEP 384:HbaFrLiO024YAFuhw+5EL1pPsac4j0lpDII++9H:7aAZYAFuK+5EB9sac4ID8LQ
TLSH
T15C527E7EAF0138BA0B27D2D4D9E99204CE04D5BBEEE2D16605543844CA8477DF8F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lqvyev6p.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 45816dfbb72319830447f31cac38b307b0a6c4671b8b244d075fdcc490ad6c76
MD5 429b621a7e51655054e4156edd7dd0b4
SHA1 16cafe5cf02f6c53e3e29e4e5e10677b20022e12
SHA512 629f7c262fdfff7ef23392fd55df59140d75daee2de65bc90210c549746226f1dcb66c71ef6eb129c81eb9f0ad5c503730bf3e7a6cdcbcda2294f40236b5219b
SSDEEP 384:HHMO0iO024YfFuhw+5EL1pPsac4j0lpDII+kqx:nrZYfFuK+5EB9sac4ID8Lj
TLSH
T10C527D7DAF1138BA1A27D1D4D8FA6218CE08E5BBEFD2D06205443C44C684779B8F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e37f6f4-c94e-4969-aee0-92a57914d372.zip

Path C:\Users\Admin\AppData\Local\Temp\7e37f6f4-c94e-4969-aee0-92a57914d372.zip
Size 3.7MB
SHA256 bce9807b5cef8d47f4fbda8098cf8fb6bc7c5226c23ea4cf110dcc69c4f195ba
MD5 d2194db4baa3776cd382ca143e9c2590
SHA1 d77140a3d350595583485d23e0e872c3c43c49f0
SHA512 bae34f89236c6138760a09d6f05d2dfb2d00addcec5dfa8ce45ea7cc8f8ae23890a4c9a604dd2395f1143ef95d60af9a39df26242294550179ac12a77bf53770
SSDEEP 49152:yrLY/t0fRzH2HifS/CRQl10ofHCufEfAIfqCgh8EHPAv/PFeFfamXoL4KqL+dxBO:yrL4i0xf0oBE55gh8kPA9e3XzSdxBs7
TLSH
T11406E035D69C1608CDBF8FBA813C3FC2984F4F668074A95B6A6AF5735CA31E61BC4844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

go-memexec-1124434714.exe

Path C:\Users\Admin\AppData\Local\Temp\go-memexec-1124434714.exe
Size 3.4MB
SHA256 f82a381914fe3e468f0b2e4e1cab7a1be64231eeb74a9783ddff4cbb5f9911e2
MD5 00634b691982afc1213d507099398b6e
SHA1 a68067dedc4db500fd4e39af1d9f75d346f8c4c2
SHA512 e85452e54a7dcb967bd9f743da182397f11cef19497495de738b66d8b016374adbd48bb6fc1735fd6bdaa2ba7aec051b3c466f42ce0fa0ecc738d694c4847842
SSDEEP 98304:GjfAJo9IXXr3sd2uoYmLz+XpSPHf0+wfQzXgPr:bJSr
TLSH
T141F59E50B3A8DD2FD4FE473494E20B1987B5F486AB47E71F1E14AA780C637409E22B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

go-memexec-1124434714.sys

Path C:\Users\Admin\AppData\Local\Temp\go-memexec-1124434714.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hardware_id_generator.dll2830244100

Path C:\Users\Admin\AppData\Local\Temp\hardware_id_generator.dll2830244100
Size 1.1MB
SHA256 3c3fc28a6e2d107bcc222f419b63eb1b3bc72681b11996619284bf7e2c6c2205
MD5 d6d5a577537f3eb2e99621d1cc402dbd
SHA1 019a4e2b156e9b7f5a2dea982e33d5de1a758f19
SHA512 818dd106cad7150cbaae5766f253158b4c14b0661409de64f0c63e9845dc0aea22198804bd4d0cf2989ed5f21bedac57757ba4c21837360698c6637a6f620fcc
SSDEEP 24576:dKeyNUbr9xWoB27OWyjn1GLxSzcVzmHS8:VyNUbr9x57L1YSizO
TLSH
T14C359D1AA3A900B8D1BBD078C9970647E7B1745A136097DF57E086AA2F23FF11B3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RIP_Tweaks_V4.7_Installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4MLJ0VX0VG.tmp\RIP_Tweaks_V4.7_Installer.tmp
Size 4.8MB
SHA256 be5a712500efafa903846498182328d634fe5509d88997a351cb7c0c9a79f56d
MD5 65a4393f4a7e52dfa20925d9cf377096
SHA1 5049a072ef1c4867a0e2c1caa400f5fd665febdb
SHA512 3c0f6c155c14fd5246eb7d12e9259eba07f03eac886ccd7768f1d8e4d920f94c2505436550f201bf13ae2cfdc1d0ac3e61c13a206cc5c67bda1d02f7cf347d54
SSDEEP 49152:/p1m50HttLVQWN2SIc3TS3UcGM90sD72FwY85L7bIo43U0mUM3zKmon333obj:/vdHRh7cGM90sD72C77bK3UnzKm+3330
TLSH
T12F369D23B344A53ED06F5A3B587BA658583F7A202A168F076BF40D4E6F396402D3B747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Basic_Debloat.bat

Path C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\Basic_Debloat.bat
Size 13KB
SHA256 0876b2ecce1d23f51bc8199786ed4ba33e15ff6d679024fbcc066d61d8bd5e7c
MD5 846eff515039683a54f1c9ef14439640
SHA1 7f6ac9b42050f1ff90e0702cf82a0e0be5abaf25
SHA512 b8d96c019201a07cb144a0bde233230fc1bd088a0690f535cede27e25034f0ad0db2ba58e4bc53b778209f667e716206eedf0a8b79f0fb206538ecc9e671965f
SSDEEP 384:pDiLOU26/8xPMDu5ycCPbqb1PbLbQbNbWbjb399hXRzrFiRWyKEIGpWlOUQ7LAan:ecCTGFP8hSXbhNBuoUQ1SooIC
TLSH
T1A5521F2669010D56C5A1BDB2D8F74CA5ABD95383A8812FE4F1C220CC9D73B4B8737AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSudoLG.exe

Path C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\resources\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
TLSH
T1CA046C0BB3A9C5ACD0B692B866825502F375741A132097CF3791437EEF36BD0AE36712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OOSU10.exe

Path C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\resources\OOSU10.exe
Size 2.0MB
SHA256 6ff124adbd65b5c74edcc5a60b386919542ca2a83bc4fcf95db1274af7963c6e
MD5 ae5d8c9dfacd114a70b250341cc5e3c9
SHA1 93fea4816fad20993c254341957f7ae612c3d0d7
SHA512 ec4efbe17df3a0ef881361d01f3112d6a2f42bf702fd9f6f3c587397bf3e31bde787939f2b546753f77c64150b7a0f3959cad636de025f43b4ea2fec8f5ae3ff
SSDEEP 49152:SE6GsEyW+92SJEJTJxJROfOrh3rukxanVyBWkC4Ui8TLsO6XERRjmNE:JykxWsW9RMERRai
TLSH
T1EAA54B6213EC115CF1F71B76EA399641BD7ABDFE7E12E21E0065240D21B2B44CA7A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

riptweaks.cfg

Path C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\resources\riptweaks.cfg
Size 20KB
SHA256 418cbecd9cbaf731b53ef7ae8706ad742924655ae1b5524956e764ec1be7883f
MD5 5d522e80b020c3634cc50e7087a62c7f
SHA1 1d7f20e4b9302eb679a1a90465306975dcb63170
SHA512 7741bfd977b0ee56b48e8aa385c3f6e62a2db899d822dbba0ad5ef5c16da920a827ece1f892d8c86dd906420fb5354c57382fb0db826a8cf83b752135345776c
SSDEEP 384:ustVUV3y8atdHh3dcMQdgwBrCpsa31J1vby/Ue8aGE:bmV3y8atdHhNcMQawBrCpscN5e8aN
TLSH
T1FE927BBD822C28A56B13D2578EF5DD2C3F9220A6BDAF5DB10419E94C613F4C4921FCA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

riptweaks_basic_debloat_2485469861.zip

Path C:\Users\Admin\AppData\Local\Temp\riptweaks_basic_debloat_2485469861\riptweaks_basic_debloat_2485469861.zip
Size 1.1MB
SHA256 5d55a3cdb1f5d649af656ebb39de543c98671f694330c2bd53a4f0eee014d50e
MD5 9b81d0cbe88e7eed49bbdf36755825f3
SHA1 8f4d746694d8dc8fecab683945b7f99cc4901cd6
SHA512 685342f5fdd801259c62c0db9ce294b8489c9fe1340b7c9b179df5e5184d4324b65bbf1e7683f1e0e56b97a10ce2e8d98b7d11d4600ef0a877223f9e35a7d3b9
SSDEEP 24576:i6p1B/wtvrE+YkZ6yBLEyMwCKrs9FOHE0aY7U7CxMVQeZ:i6P5IzIyBwyMwc9FKtyCirZ
TLSH
T1AC453341831A64A8FB5B98BBD22CD18D1D280FB6E675AD3EC319C3633CA465BCD97D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 15KB
SHA256 1808abd436a3554cc649b34706c4d7bd8e8dcf2e4ab59be8093bddfe5c6d7af1
MD5 99a690f6ad4902be57f77a5811bb5df5
SHA1 3b8081eb0ed595f7d93860d88df752e67ff273c5
SHA512 74f4d199108a712830951c946fcf0aa2fcfdf16d63be9196dfc2b44404d8df0a384c8d1a0bc6affaf4dd963bd1506cb2eb9141e229e5c748d03427d45d3d9209
SSDEEP 96:pZtOZ/U5gZ/kMZZsLcgHSVZRO+umb1gsbpnWZHO+uHS0ZOQjmgGhMQbOZOtvbtgS:pZcZxZ/fZZsiZRUZHB0ZLj5JZyvbxb3
TLSH
T13B6274010BFB1A80F5F39A717BB1B7526B77F9025B06860E8181928A0933F90DD6DF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 17KB
SHA256 3915effb544efaa4254d6998a44b11bc8ca856aec995c6bdd591375702a44a28
MD5 e0fe306e4d4681e30a2db19e96cbaa36
SHA1 d343f07634ac760d1fbe3bbaeac6c6a8f5575b44
SHA512 1f3d39e7aa89f3199ec2bd11b34b949c082d2c11f7d4688a1410dbe38899c5f263325a740633a38c235363a345ee9a9ee98b266b723c0787f359a1b11dcfb637
SSDEEP 192:bZpZIZ/9Z3jZ4smZRVZHB1ZLj5gZyvbxb3:bZpZIZVZzZKZTZh1Z6Zibxb3
TLSH
T1738253010BFA1A80F6F399717BB1B3526B77F9029B06851E8185928A0933F90CD7DF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\AlternateServices.bin
Size 11KB
SHA256 593c4434be2ee613dfae5c16f3e69c44bc3e1043b3d6240ec68b2596a381715f
MD5 eef38363bdf12bec8c63ba86cdbbdff3
SHA1 ccd595fd29f54af815d38ea41ce72ef87bc1fa91
SHA512 96724fdb47c51b0c56169df6722b259a5528740803b7942486b5a830ffe7ff6ef09b43e711830558f52e97979a733948f1cf89a8d49bca14f183d77aeeffef3a
SSDEEP 24:6uhMZcj+lz+91rewm9xxR9Bdf9VvbH5q9F55A5N49Fmfs9l6:Pj4Eg/Dj3FBbZI56NywmE
TLSH
T117328FF36B76A4A2F0D2CFB0945C719CDC73132549AA91C4CA5080E717C2AE9D03EFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\AlternateServices.bin
Size 20KB
SHA256 8612d90afbb6e27139683a074f1d4995bb7f71815f36215a9b84d8c5b0cd4647
MD5 44ed6b98f3514eaa29360f76b83e05b4
SHA1 6edbff3cc864fe0b09601cb866b635dbfb7173cd
SHA512 263f113d185e9a7a380973b464142ccfbf3be52b6172d7d0f4e04ade129e4e69883ba4a7e8665cc692335122121a2bd6d69868cdb86f8ba168e978bea0572550
SSDEEP 96:n4YIy22SuBudI56BmcqILFB4M/pxrz97S7Sb7PQIYQSrK3j:MUQn9Y
TLSH
T1C99293F7AB7664A2F0E28FB1545C718CDC33131549AAE1D4DA1490A713C5BE9D03EFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\AlternateServices.bin
Size 20KB
SHA256 bf8a02909b40d88a632f480f2010d6d0b501554550bc9639afccb7bdb2571a3a
MD5 d0fa9cc5548ce4e18c7a8b86496cc6b3
SHA1 fcc34d009753067774298169b6f043735d6eab5c
SHA512 ade17de8c7e9198ff2d941a5a317e65a8f20c8aba4ac72a53fd520501856782c8b1a155f0532edaea0ed8d66ac87290cf50bff7919e58afa66e868d9435a38bf
SSDEEP 48:PP479TaM/p35HBHSCjHS7OH4H3GHlaHIYhCHUzHK3SCH:n47laM/p31dn7S7cK30lQIYhYUrK3SY
TLSH
T12792C5F7AB756492F0E29FB1545C748CDC33131549ABE2D48A24909B12C9BECD07AF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\AlternateServices.bin
Size 20KB
SHA256 8f4e17ef42a9701a54968e5d56119d6a2fa62fe5f3f9f94eda186050f68ce021
MD5 ff89e2ae5445e6d443d3f2ab8c8b3192
SHA1 ea981645484a2251ad18a5488197bb382cb5f11f
SHA512 7d2864730fa7c71fc7a1ace38bb99736fa67738305da14cee84dfda48e4cf47f4cb3c00399bf91e5b776f7e6680cac1ec14203d704b955010087811f80144fb2
SSDEEP 96:n4o2LD/9JhpaM/p31dn7S7cK30lQIYhY:LQP9Y
TLSH
T10092A5F76BB5A892F0E19FF0586C705CDC7303255C67D2D48A2894D622C5BA9D13EF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 586b1c3e108600850039252e2495a501a0c5b63dcd5af18b712c45055572ad17
MD5 aedce74cb8e3f6acd1e1e792a28df341
SHA1 ec5cc63345e814a9fac9bc6edae93719964dd37d
SHA512 989f3084e6cfbbaecc28d9f6f8abe38757cb3a40610c467b80520ea208c904ddbd70e5cc79e668c416351937ed9dfdd6a5b0e6f620ec10c57395400f834b4ea7
SSDEEP 192:COv5zboVZ3zyjjU1d66JozGzgCl6mc0dz:hboVZ3zyjqd66JozGzgC1jd
TLSH
T10BD1DC64E639867FC418123BCCA51B400F36399B988E3F2532AC745D2D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2712e432e65056d6c64bd08abe495c1f4e52a2fdfed7637828e53d5e707ef372
MD5 40ea5600e46e2a1955cb90482f6240a6
SHA1 a6fd7f610e3a6545f3fffb1d8a323cba5b50d4e8
SHA512 eceb5428a44d96a5746c8a1304322ffb9ec79fad09ab6305dad66938643bd9b18ec2ff8ad62bf78924fd756c0c27a5c304e760c2bde70f4480ef28d98ca56973
SSDEEP 192:+1d66JozGzgCl6mc0dYOv5zboP8Z3zyjtyL:Yd66JozGzgC1jRbo0Z3zyjI
TLSH
T1E7E13E64E638863FC408137BCCA51F410F39399B984E3F1935AC65582D5B2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 90KB
SHA256 20c660a2ffa0c7c35354ecc66f87e445d8fe0155e170174ad03b5f2a2ed90985
MD5 954dbacdfb7ddb97bf5cf0d0e6defa74
SHA1 3ad77740e2b860ff800c0adb1bbf86d8a5d0bd54
SHA512 41cd18dfe8f70ccd2032463b94bda2d444652f53e0bc35f133598bc1edad02ffab6d3fe8129603b41d87497905f82fa78c77e1838461c3f14047f14b22e68a6b
SSDEEP 1536:dszUPHWVm214ykCQ1rcNgbnHFIUkS+5JIhxY1:dsI2Eq4ykCE2gD5kJ5JIhxY1
TLSH
T150930090EB1B403BEC2485BFB4951B282735F4254A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 90KB
SHA256 0c40dfd4e4e9fa109cf8d5974aa3f2bb0890904cc173e8e5903ca9cdb7610599
MD5 e4f77f97a3790e064e2c8c9499e73f5e
SHA1 6f4d6b75976d90ee397a1a7fc794614589c6649b
SHA512 70dd7e57586896346e63e81211b2a6bf7ba45852f5c1b1c47b5554a952883e9f7ca9df470e199cad79d5d31113034eda0ee81657e0454714cecffad848a66c6f
SSDEEP 1536:8szUPHWVm214ykCQ1rcNgbnHFIUkS+5JIhxYo:8sI2Eq4ykCE2gD5kJ5JIhxYo
TLSH
T161930090EB1B403BEC2481BFB4951B282735F4254A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\db\data.safe.tmp
Size 90KB
SHA256 baf6cef3da9a937d04596c1f7f5cdd3d178f271bc224a8a8df9360bd1c6e9355
MD5 52f57f4340186ca81191a4cb6c3946ab
SHA1 2e2cbf5b8adb1df23c5ecb791d053af121eb88c5
SHA512 b16913a7d9aab896c9f7802bf84721f464cfafdd5f382db2b1d072fa5c7abfb13cbf17cc14332e5da2675595eef222632eaeb6ad40391d9ecac863e55e4a4f83
SSDEEP 1536:kszUPHWVm214ykCQ1rcNgbnHFIUkS+5JIhxYY:ksI2Eq4ykCE2gD5kJ5JIhxYY
TLSH
T106930090EB1B403BEC2481BFB4951B282735F4254A595B1B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\events\events
Size 4KB
SHA256 dfa95a68ee641305b8caab4082a12874c1c7a1a8dd1e85fde25777cfb4405029
MD5 0ee80b1f16ed9b8337cd7a03984874ce
SHA1 25558453669f040349422404f637528e0a05158b
SHA512 05e81e8127cf714d9080bfceb7a1363218823b21f5a79ef29893dbc4b2f03697c663c6ea5e9e388fb1d3fe245cefca15b68bb9523f1e0b8581807e733db330d7
SSDEEP 48:YpCreYA7uwCgQDKaz4vqi/sCssAezCuJKMea7kefdMdR7W7HBlCzHC7/bZHvhMWp:HS41ko0xSH76Ye7/Qz1kl
TLSH
T187A1F31C65BA5C7E5DE7E2ADBC49028D92E58B0384C72D834DC6CD88CD8AF96324F539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4e963b90709fc7dba151af604551c5e665eefef67c5454f6967c4983797cbb3c
MD5 a0ae1019f65fe483e843678c01e42a04
SHA1 fb691e9c2934b21f616af672675eeb4398877e22
SHA512 d6d15d0393225d4da4c39995a746bbe4e7b29319e835cf2067c9d1f6f1a46663fc1f96ccc436385a79ffa5ca06bd56bc03bca08d9849eb10dbd921275f3bc91f
TLSH
T12821AC9C39B84D6A9C97F29CB849018EA3514E0748C71D830D02DE8CCCC9AD9326A53D
MD5 SHA1 SHA512 TLSH

Submit Download

156a1ca9-1168-464c-90d0-f5a1c26d48d1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\156a1ca9-1168-464c-90d0-f5a1c26d48d1
Size 2KB
SHA256 5aeebed111c8bac6973e33f4e778408819a77a6d578d6bb4fc7cd4340f07cc8f
MD5 0eed64daa81f6da2cb642420be063e39
SHA1 688afa9526f192ee3f24656b60888eeab87e09cf
SHA512 a74dd25c3365b7a84dc0bc74a12d98f4b81230a50fe73081aff3a86356d7ad0819239d2272fddb7ce06aa0d7015172c5dede22068e080bd1d9e343fcb05f2971
TLSH
T1D641345C35785DBA5DCEF64ED582374E53A08A1310C22C832E95DF4C8C867ED636B52B
MD5 SHA1 SHA512 TLSH

Submit Download

3978a9c8-a14a-4d23-865d-964bf10aa9c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\3978a9c8-a14a-4d23-865d-964bf10aa9c2
Size 16KB
SHA256 62c54fd79a1bf71b1a544d7039aaf9934f1b7451d87070f942f1ada182a3baec
MD5 1d7ee26ffa6d446d2795011b63724792
SHA1 833203deb1eb689b26a770a26de9e684d63fc17e
SHA512 bd161fae754c45e17e398b166e1406c76b04ec7736e4dd3fea51032b22f87d7890b81db5ae8d4070c36b2378a3cd72caf02a920259c4a55cdd2bebe94381aeec
SSDEEP 192:yD0ut7cgKyizazUbuJvLHBj3b2tBk1EAc+Fyw9bPaPD9jyAkqFUqNoM6vUTcORxn:6t7cgKyiOQ4LHZkBzANywZP0FeGH
TLSH
T1FB72C916683049BA8251E768D9F8BFC3E6F538CB4C419FC99BE0BE086DDE05D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87af0346-1060-4ccc-89cd-9d50d37c6bb0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\87af0346-1060-4ccc-89cd-9d50d37c6bb0
Size 883B
SHA256 b18b95c549a933215a976a80b3e0fb3d0487065af49f1dee496220c89bd8c6cd
MD5 1901a29dca0276b63c34d952dc747f65
SHA1 3284e3a0a5c9f01d3ff9c315c795461d912b8dda
SHA512 2b2ff601fcc74582f4ebe23799699f24daa0076337083f709f844fc74741ad40c85fa345cbf26caa4dfdc67fec7b54392a06f79845fe7c4313ba09d00e178b3e
TLSH
T1111100808674B9B2CD68934BC5583B024BE4352380C688043EF05A040DBB61DE7A671B
MD5 SHA1 SHA512 TLSH

Submit Download

a7772554-1d6e-49e2-bc54-dae003bc1db2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\a7772554-1d6e-49e2-bc54-dae003bc1db2
Size 235B
SHA256 2971f3189110c4d911132d2c82451a2bd1481a79a38d2ac4a9de310a2ae29d28
MD5 7026a33c334ecc3c1e78a064fdd5ddfb
SHA1 00d95e65bd0c9d184884a218bb5704485c3f93a0
SHA512 0e0e8b30e1e047251db64e599d4859298d9ce9c9b1564cd5f2cd5eeed5585ff09d57069c73293dfba18aa4c3c2b3478ee0f0a12847312e123af7e83d3b935423
TLSH
T18ED097887488232D88100F07F0E06CC231894C3320765850D6928438C9F9ACA025182A
MD5 SHA1 SHA512 TLSH

Submit Download

bd7e1f6b-f3d5-4e3a-a416-f56e4615044e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\bd7e1f6b-f3d5-4e3a-a416-f56e4615044e
Size 235B
SHA256 625b659151de16e236fca16838805011b997d0797c08b84b4b90dd1bfd5b9784
MD5 46274afe9a8c47d3457b257027a39471
SHA1 4722692dbdad1fa8bacbc7d7d73401cf7adc12de
SHA512 514d8bad6c32bdc726748289fcb3cbbb7ee14bdca7ba816505409e6fa886ad597d07960a09b9b87d4f2660e6a34a8ba01979dc525b032247e624e7b40be318f1
TLSH
T13ED097C02888631C08000F02B0A029CA30988C3329F0A820999100788AFDEC801D290A
MD5 SHA1 SHA512 TLSH

Submit Download

e7b83760-cb84-4d9e-9a57-fdd02d6cafdd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\datareporting\glean\pending_pings\e7b83760-cb84-4d9e-9a57-fdd02d6cafdd
Size 886B
SHA256 c73be3cbbdc67a842794936a268cd2b68b57a907ab5bf2ce52a2ffd157594d68
MD5 b894661bf2d6e277f63b7ac87ef6af49
SHA1 8e47649f596fdb1425e166ce8412f92cb4eae3a4
SHA512 b944c98fd0da5ffe0adc7a951cb0954f7bdcbc7a2d26a79339fb8074efcad36a4d69af8ac295a9e16cb247a9fe4be0f079f2da0681e4cc99421db9703a05e582
TLSH
T1DE1123A0877CB9F2CE68A29BD5A47B1247E0312380C65D147EA05B084DBF51EE7A661B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\extensions.json
Size 16KB
SHA256 b6573be949e34c1a35d4dcc05c640a554ef885572cd6794b777829adf2f74f69
MD5 0e78b951fde1d611671be34ea6bff098
SHA1 8a8e9977708ce11f42450466b5ec294c952af9f0
SHA512 62149e015bcda5f197b84412bc24d5bc330d34f4de073de89c300600c19428ec6631f372f307401bb2bec0e801e891e66b4bdfa83e1c98eeeddc8c82557dc4ef
SSDEEP 384:tkI4vPUmldvf8dhWH94z796oNL4HCL4PvL4HbL4H4L4HIVi4hh:OI4HRfcXq4t6G4Q4r4n464z4v
TLSH
T19A72421545049EB8294FA78BAA367E01C37D573B60845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 7KB
SHA256 aaf42f04bb3b041bf3650f2558f6673804a67c61db2520ae382644da7824ff7f
MD5 06046e3bac09def1e5935bb87e0a7d63
SHA1 b12470921f9af4d1226c4d40780d22b0f47079d9
SHA512 4e05a01430f38af20ada12ddb354a26d8c9d48d6143ce9f04b6583e0e6038e54484481901b8710766373a26d440e6d99a1048a94b2472e710203d5fc0570d3e2
SSDEEP 96:xHspTUxqGq7f5XBlNbzSMSSl8pdv9jMnEHYfYvBw88E18L4cnUiaGS:qBR7f5XLVSSG3Y2Bw88s
TLSH
T1FDF11F789108CB7FA8B6776CAC684871AAB2013BB7BF68D710B944C5154CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 12KB
SHA256 e3da1768c2accd84753f544b9715fd8bd37bb7f8be5e34592b014032a68d09ca
MD5 6cc5ad9935c8ab919e094e895770e31f
SHA1 638764562d500be40131f3e73fcfabfc35b31420
SHA512 86c4eaebd8830faf5723477356dd90e051b42784396201562947fa58574e2d433ef36169250ba85fa697f2d39c59fd50ec2549822279ac4fd457119cbb09ed29
SSDEEP 96:xHspTUxqGq7f5XBlmbzSMSSl8pdv9jMnEpwoDROtEfYDhpRmBw880zGiWzgn2u8K:qBR7f5XLuSSGZLROS6jRmBw880DWzgnX
TLSH
T11A42EF3C90448B7F64B3327DBC2949B1A9A10177B6BFBCD605FC9482148CF6441E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 12KB
SHA256 5b4114c2477fe653c0fc82061ccdd20e8d9ade767467b8c283a1854425053bdc
MD5 3092cb796b5a2064bd212e6aa18607a9
SHA1 e284c181ad0370d22ef159849487e850f50d0a99
SHA512 f207f61c7ceda7d4c6fd76e8c5f9efda225a4492b6a02d1716f14457eb3c012206ba2d2d2c24c78ac85f16d5087aa914cb36012b8872b837454f6543c7d02085
SSDEEP 96:xH9pTUxqGq7f5XBlmbzSMSSl8pdv9jMnEpwoDROtEfYDhlRmBw884dzxpSP1GiCf:LBR7f5XLuSSGZLROS6HRmBw88q4rzgAc
TLSH
T15542DD3C9104CB7F64B7327DBC2849B1A9A10177B6BFBCD605BC9482548CF6441EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 12KB
SHA256 2fc8fa1ecb5213363a109accef4ab5338a0291a17e4402988d1c9279be2c17d2
MD5 49c4f8156de461d53509aa9926a705d0
SHA1 3ed398fe8faba8c1fe4f7b842abb62c1d22c5629
SHA512 e10c6ed9f75e56a2ab90d693e70f4a900f891d30b7b367026c201489abca697f3e4b89419d2b724e79d9abed5ef59976135a7c4e0517424287e008fbb430107e
SSDEEP 96:xH9pTUxqGq7f5XBl3bzSMSSl8pdv9jMnEpwoDROtEfYDhlRmBw88MkiQxTExpFht:LBR7f5XL7SSGZLROS6HRmBw88bIBQJ7y
TLSH
T17442CB3C5504CF3FA8B3327DAC2849B169A11137B6BFBCD615B88482548CF2541FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 7KB
SHA256 3bdb5c0ea4fe93cbdead9e6732b6e10ce1a3d85f9e1c89bdd757f38f1e92fc32
MD5 6a7b137108c481eb4b9d77c3eb5bccad
SHA1 dcc0fbef7e1a182c828c3df28bbb5c219fc0336a
SHA512 caa9b3b0c5c44aff55a4ec8867e8bc099ed73c0ae4543abd2deb00e965ecdb63e4684870a00845f28995a62f045f6c767cec94125a92ac656098dfbb521fd4b5
SSDEEP 96:xHspTUxqGq7fC6XBlNbzSMSSl8pdv9jMnEHYfYWBw88n8L4cnU8WaGS:qBR7fC6XLVSSG3Y7Bw88Wj
TLSH
T132F10F789508CB7FA8B6776CAC6848316AB2013BB7BF68D710B544C5054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 6KB
SHA256 4815800effbb96f34945dd1189b1eee4b8817d282e074c3275299930108e125d
MD5 46964a35123b6668151a568ac7fabddd
SHA1 0c9b58740bd4de1b109012acfda2704502ecd990
SHA512 161cde2541dd696d9f7d29fe42e8a2c7ec4ed00d89268dedf34ea50e69934747ebed409fb91293a00c992cc0f205a730113c9592c42bfdd238c1f68b23d5eeb3
SSDEEP 96:xHsUTUxqGq7fC6XBl1zSMSSl8pdv9jMnEHYfYWBw88n8L4cnU8WT:q8R7fC6XLpSSG3Y7Bw88Ws
TLSH
T1D1E130789508CB7F74B6776CAC688831AAB2413BB7BF28D710B94485054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs-1.js
Size 7KB
SHA256 b800bdba553cfdaaa44669a105ecb9adc8044931e196cd819b655df16ad90a75
MD5 9c45e98b6d9b4af90a0fd0c2a41259a7
SHA1 ded8f40f412af350f0958d18b05b439ac4dd8945
SHA512 001adf9450ebcfd1778b2a702a943c44990a9325adbf974f3236f61ef07708864767e132c4bf0f40480984daf8f616a862e7d2ae66ebe694f42dfa67872d37fe
SSDEEP 96:xHsUTUxqGq7fC6XBlNbzSMSSl8pdv9jMnEHYfYWBw88n8L4cnU8WaGS:q8R7fC6XLVSSG3Y7Bw88Wj
TLSH
T159E12F7895088B7F68B6776CAC688831AAB2413B7BBF68D710B544C5054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs.js
Size 7KB
SHA256 532ddf21d8f968c54911bc61980f81481bddcce4f76cdc35c9b55646fff51363
MD5 c2a4417b60ba6f16eec752ce60e86aa3
SHA1 bbee2589da2175ae0a3189a41433944e002feaf4
SHA512 bcb453df5f42af6c329e21dd3b90080cd219ea37af215e5b35b7d5b316646a6f0b47be17737a4edfb0e7816a56e5e8968e944ce08fe5aeed3b371532daeeb077
SSDEEP 96:xHsUTUxqGq7fC6XBlObzSMSSl8pdv9jMnEHYfYWBw88n8L4cnU8WaGS:q8R7fC6XLWSSG3Y7Bw88Wj
TLSH
T1EDE13F789508CB7F68B6776CAC688831AAB2413B7BBF68D710B54485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\prefs.js
Size 6KB
SHA256 309b66c63f49842ea9a5a1ce7bde5a4f7184bdb3ba0c991212019c6ce9b3dce0
MD5 8c49b63b6281428fb4788d1d1f4e4e81
SHA1 7dfac7c2f7c8d45cc456c42560f6183a1d00336f
SHA512 a61fa5e55b1839eca7b7b92370049f6d2294fe59ebccea86ba7e2b3b758b86cafc3d91ce787a7c79941ffacdfb4e8f4609fe3258fc3a228b68963900a3bb8d7b
SSDEEP 96:xHsUTUxqGq7fC6KjNnjy1zSpRkRkSSl8pdv9jF2xnEHYfYWBw88n8L4cnU8WT:q8R7fC66eo2aSSGbnY7Bw88Ws
TLSH
T1D0E120789508CB7F74B6776CAC6888316AB2413B77BF68D710B54485050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 e4dc57b71ec3e5947213a44ca3a0292bceb7352f2b94ab326e8133bfa1ae367e
MD5 f17d1e991c00c8d17a9f8b75f8803ec4
SHA1 342d0777b3fb114c4747caa7d574e72b7fe29b85
SHA512 a0bd39aa07e66d348f99eedc62d12cdb33738271b31e1f97751fe5760b5ece78f4a05fadc4b6a94c7dcf17cd61f19d528e75e0744e8ef185512cd36ca64fa6b1
SSDEEP 96:AH2vsWpCYNwdJrge79dXdoOGT5WS636qOUPyBlKfUMn2tsw:AHf2CYCdJrv5dixN75WPWKfv2aw
TLSH
T153A17DC39C9C2C8A99D845DE98C497F136FB2D75CC6420A371DA77818A99E0D21CD11D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b64b6d276d520a5586c03feb41492cae6d15500617d60ae594b429b299c8753b
MD5 212003100a88b04c0732b640c27c2c59
SHA1 7eaf90e31f2de8cbaa7c24c85fd6c8306ff21c74
SHA512 0235bf95b2f32cee9df8aa980d9256bade06429b884148c6e7a92dad604b42347528a6726972a26ff84a9364b4a3378785ec5d75bb9b03ea994205364d01544b
TLSH
T142210A82AEBE0CFA1854D247D0C91FDAC715A0624D54E8E0D468A94047E8C4E7BAD30B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 c7ec18966d8e30cd699901d39b9064fbbc16e0e6c1be056bca13e36339e6b493
MD5 6c0fa03fbbe2de09b1c45f99208a5a12
SHA1 d81827fa813fa3b62e8feb1f83595e22a387cfff
SHA512 ef1ca3215bdee0e03567ad970aee1d046bba6fc3129cc9f7a20eb3ccc3b8321efd11da4d5b366de049e585c74cd46cb1a58286f620d3bf595f2b5e1e2a466c91
SSDEEP 96:92ARQM1Byi55DR2jE9fyuuMHyilRxAesMOKVmjy0csm7lYTt:9RKM1Ig2w9qu/jAvMOKU5Lm7g
TLSH
T13B917F9BDE7109E86FA050812CC12C1EC7E87446D77C26B4C52437678476A8663BF14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 231704a59265e2325de553aa5802bc81c7f5193c0ac0b8e2ad0a2599074c17ca
MD5 29a9d1a2b63440b5cb034f3bf352869e
SHA1 fc40dffa36353ef992186a97c7cd009bbcf56cf4
SHA512 bddfaf288e0e4d1d88c7d5d573465a815fc27018bf748fc86638d08ef1f3b3ed5d8fdf50d95c3729666097fbdc0a951a1327199c94145ff0f127fdb51feeee3c
TLSH
T10E31ECC6FEA6623A9FD0C1035055197DCAD554478F5E69E0960826038155B0B77BF147
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 2e0017c46b4c75bd54979fdbffd9ec71dd7821c6db3c038456e02cc05e522422
MD5 df61db6b48b07d428edb83070b438429
SHA1 d3241902555158970e25bf17da64be45d943e6f7
SHA512 d685e15bac467c3f4536541a96b73cd6828448b05d6857509a82d728fd414163259a0805652a28e11d10f76e660354144137c16bdcf8520401c507056cab9f5b
SSDEEP 96:m12ARQM1Byi55DR2jE9fyuuMHyilRxAG1XNviFbSaoepp7tgZorTt:m1RKM1Ig2w9qu/jAG19aSlS76Z8
TLSH
T12F916CDB9D7609D8EEB050861CC02D0DC2A87A0BDB7C25F4C12432674566E8AE3AF11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 0b9e2f979e2c27ea0208d8ff5802e8f05b972b33957f470372cfb6c7443cd9ab
MD5 81916c64e971038229dfc621ab8a57b7
SHA1 6e70cb8cc8edf84d4d42f5477804b0f5b11b6675
SHA512 8e38cffdd7c623fe1bae454dd2ae713c792783b9d6f9fe7c8c93db7671d4b3c13eced75c8bfed76c51aead639b8ed8bb1217346cc1a16553dab2ac3d14611a65
SSDEEP 192:5RKM1Ig2w9qu/jAvMOKO86i0v/4LvgyS5:jV1J2woMjAvlK16pgLvb+
TLSH
T11DD1AFBBCD3209EEB970D0812CD30E07C2E67800E5BD30B9893477374075759E26A4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 ad28764f31e9853f80ceaeded6c276ec877b45a5c37eb1f405fdf9b2541f43f3
MD5 1ee1013450fd7bfa108c8509c58ea8af
SHA1 ebe065c4cd378a53dc6cc2e93398edef3e3c8ff2
SHA512 83a7b46730badb9813b602da733124f554f29be1b4f5fa98438144c6e234676e3934ff569164a6a7541026cb68ad4c6f8267cd8f9f4fd5ccf40f29aef2f839e0
SSDEEP 96:92ARQM1Byi55DR2jE9fyuuMHyilRxAesMOKV8jy0csm7NYTt:9RKM1Ig2w9qu/jAvMOK65Lm7I
TLSH
T13E917F9BDE6509E86FB0508128C13C1EC3F87446D77C26B4C52437AB8476A8563BF15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 e04d98f0325030c30c92984958ec9e22f3b234795591f1056e4d44e64e179459
MD5 d1044bda346a1f400ec9fad2d977dd6c
SHA1 12d4af8b62b1ef9ded1eb4a1a1cbca794e7ee938
SHA512 46c7e003bbfb6528002e6994b74cea81739015dc7bb418ac74454231cd8fd7c56909e29c5458df2548bf587279fe07366f2efac41e935beb0a32646be363f8f3
SSDEEP 192:7RKM1Ig2w9qu/jAvMOKh8ZsNFi0v/4CCVbKnH:VV1J2woMjAvlKCZsjpgCwbSH
TLSH
T1D2D19DA79D3508EF7970D0812CD30E06C3F6B844E5AD20B9C930766781B4746A62A55F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lqvyev6p.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 0e82bc2fad31003ce62430702c558e83a3796c26340d21487136d5a560a92b11
MD5 436bcba5c94e81d4ab6d80f91113f6f4
SHA1 536bcbd3fed351224be33b8e0fd9b5c30784d479
SHA512 8db85ff4b4148ac0727f25e441226ffa94824cde9ee5d8338e20312847d027320851d248fa69d1db705fa48b4bd4add4f9cbbefbeb3feb96200bf327ea3fd70c
TLSH
T14C514B9BDE4505AAEFA090C75CD51E28C2F57507CABC65948E00B7178462A4BC7AF05B
MD5 SHA1 SHA512 TLSH

Submit Download