65a135103dfd1b72d5906c7216069f1e6aec669ad45622be513ec6e871e9c013

Analysis

user interaction
yes
max time kernel
156s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BCUninstaller_6.1.0.1_portable.zip
Size 76.4MB
Sample260509-ptyvbabz4p
SHA256 65a135103dfd1b72d5906c7216069f1e6aec669ad45622be513ec6e871e9c013
MD5 f9e40ca1d95356a9c9d11e7a008cefa4
SHA1 728ff01424fb2a035ccf3b51f2134ac535818668
SHA512 905e8c091ffb07389c6e649bf855d5851808451b9640c95228a4cee4b1d34c03aea97ee1683b660afed8cf537f6a246f70b7afc3c4905ecc85ff22f41af13468
SSDEEP 1572864:ypGwvH314sEdTGy02QvSt2ErZzDx498zJLAhvSUyDts8rNt8+xLkjCmx:ypZ1qaR+2Er9DxDzJntrplUx
TLSH
T1E2083384C6DC1124C63BC6B618F78438DEF5041B686952279EA47465ECFB3C063AFE9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
15	camo.githubusercontent.com
60	camo.githubusercontent.com
64	camo.githubusercontent.com
68	raw.githubusercontent.com
69	raw.githubusercontent.com
70	raw.githubusercontent.com
106	camo.githubusercontent.com
63	camo.githubusercontent.com
67	raw.githubusercontent.com
108	camo.githubusercontent.com
110	camo.githubusercontent.com
5	camo.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
6020	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	BCUninstaller.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCUninstaller.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1032	es.exe
6084	PING.EXE

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TypedURLs	BCUninstaller.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\BCUninstaller_6.1.0.1_portable.zip:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6084	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	BCUninstaller.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	firefox.exe
Token: SeDebugPrivilege	5052	firefox.exe
Token: SeDebugPrivilege	5052	firefox.exe
Token: SeDebugPrivilege	2828	BCUninstaller.exe
Token: SeDebugPrivilege	5052	firefox.exe
Token: SeDebugPrivilege	5052	firefox.exe
Token: SeDebugPrivilege	5052	firefox.exe
Token: SeDebugPrivilege	6020	tasklist.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 5052	5060	firefox.exe	80
PID 5060 wrote to memory of 5052	5060	firefox.exe	80
PID 5052 wrote to memory of 1876	5052	firefox.exe	81
PID 5052 wrote to memory of 1876	5052	firefox.exe	81
PID 5052 wrote to memory of 1876	5052	firefox.exe	81
PID 5052 wrote to memory of 1372	5052	firefox.exe	82
PID 5052 wrote to memory of 1372	5052	firefox.exe	82
PID 5052 wrote to memory of 1372	5052	firefox.exe	82
PID 5052 wrote to memory of 1372	5052	firefox.exe	82
PID 5052 wrote to memory of 4284	5052	firefox.exe	83
PID 5052 wrote to memory of 4284	5052	firefox.exe	83
PID 5052 wrote to memory of 4284	5052	firefox.exe	83
PID 5052 wrote to memory of 4284	5052	firefox.exe	83
PID 5052 wrote to memory of 3728	5052	firefox.exe	84
PID 5052 wrote to memory of 3728	5052	firefox.exe	84
PID 5052 wrote to memory of 3728	5052	firefox.exe	84
PID 5052 wrote to memory of 4128	5052	firefox.exe	85
PID 5052 wrote to memory of 4128	5052	firefox.exe	85
PID 5052 wrote to memory of 4128	5052	firefox.exe	85
PID 5052 wrote to memory of 4128	5052	firefox.exe	85
PID 5052 wrote to memory of 3332	5052	firefox.exe	86
PID 5052 wrote to memory of 3332	5052	firefox.exe	86
PID 5052 wrote to memory of 3332	5052	firefox.exe	86
PID 5052 wrote to memory of 3332	5052	firefox.exe	86
PID 5052 wrote to memory of 244	5052	firefox.exe	87
PID 5052 wrote to memory of 244	5052	firefox.exe	87
PID 5052 wrote to memory of 244	5052	firefox.exe	87
PID 5052 wrote to memory of 244	5052	firefox.exe	87
PID 5052 wrote to memory of 132	5052	firefox.exe	88
PID 5052 wrote to memory of 132	5052	firefox.exe	88
PID 5052 wrote to memory of 132	5052	firefox.exe	88
PID 5052 wrote to memory of 132	5052	firefox.exe	88
PID 5052 wrote to memory of 4652	5052	firefox.exe	89
PID 5052 wrote to memory of 4652	5052	firefox.exe	89
PID 5052 wrote to memory of 4652	5052	firefox.exe	89
PID 5052 wrote to memory of 4652	5052	firefox.exe	89
PID 5052 wrote to memory of 3408	5052	firefox.exe	90
PID 5052 wrote to memory of 3408	5052	firefox.exe	90
PID 5052 wrote to memory of 3408	5052	firefox.exe	90
PID 5052 wrote to memory of 3408	5052	firefox.exe	90
PID 5052 wrote to memory of 3984	5052	firefox.exe	91
PID 5052 wrote to memory of 3984	5052	firefox.exe	91
PID 5052 wrote to memory of 3984	5052	firefox.exe	91
PID 5052 wrote to memory of 3984	5052	firefox.exe	91
PID 4860 wrote to memory of 2828	4860	BCUninstaller.exe	97
PID 2828 wrote to memory of 2916	2828	BCUninstaller.exe	98
PID 2828 wrote to memory of 1032	2828	BCUninstaller.exe	100
PID 2828 wrote to memory of 3956	2828	BCUninstaller.exe	101
PID 2828 wrote to memory of 2208	2828	BCUninstaller.exe	105
PID 2828 wrote to memory of 1348	2828	BCUninstaller.exe	107
PID 2828 wrote to memory of 5916	2828	BCUninstaller.exe	110
PID 5916 wrote to memory of 5976	5916	cmd.exe	112
PID 5976 wrote to memory of 6020	5976	cmd.exe	114
PID 5976 wrote to memory of 6028	5976	cmd.exe	115
PID 5976 wrote to memory of 6084	5976	cmd.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\BCUninstaller_6.1.0.1_portable.zip
1⤵
PID:3584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {2c6184b0-4a27-43ad-8f6e-fb9c68d927e5} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {ba221bed-abe2-427e-bd26-5474163501b8} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3652 -prefsLen 27274 -prefMapHandle 3656 -prefMapSize 270279 -jsInitHandle 3660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3668 -initialChannelId {a4aa06e7-7262-4c77-a12e-f543da173034} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3816 -prefsLen 27274 -prefMapHandle 3820 -prefMapSize 270279 -ipcHandle 3836 -initialChannelId {661a087f-0228-4f54-86cc-2f70d65f9183} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4544 -prefsLen 34773 -prefMapHandle 4548 -prefMapSize 270279 -jsInitHandle 4552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4560 -initialChannelId {aebe5d5a-d171-4466-9e6e-e1b054ccf609} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4872 -prefsLen 35010 -prefMapHandle 4876 -prefMapSize 270279 -ipcHandle 3660 -initialChannelId {32d02bea-7ddb-42a5-95aa-e7a0fc7ab2e2} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2772 -prefsLen 32952 -prefMapHandle 2776 -prefMapSize 270279 -jsInitHandle 2780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {596da806-ecf2-42ef-9232-bcd8dbd6abad} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 32952 -prefMapHandle 5600 -prefMapSize 270279 -jsInitHandle 5604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {b93be21a-201f-418d-97bc-e8219d5e6180} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 32952 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {fb400047-49d5-4e8b-b490-9bea1ab1ee7d} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6068 -prefsLen 33071 -prefMapHandle 6092 -prefMapSize 270279 -jsInitHandle 6088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6236 -initialChannelId {5d60ec1a-5c35-400a-91dd-8ce805b0750e} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5968 -prefsLen 33071 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {91f6ec2d-9be3-4909-9c3c-c677115d2fc1} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2684

C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\BCUninstaller.exe
"C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\BCUninstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\BCUninstaller.exe
  "C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\BCUninstaller.exe"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\OculusHelper.exe
    "C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\OculusHelper.exe" /query
    3⤵
    PID:2916
- - C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\es.exe
    "C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\es.exe" -size -a-d -size-leading-zero -no-digit-grouping -size-format 1 path:"C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1032
- - C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\ScriptHelper.exe
    "C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\ScriptHelper.exe" list
    3⤵
    PID:3956
- - C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\SteamHelper.exe
    "C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\SteamHelper.exe" steam
    3⤵
    PID:2208
- - C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\StoreAppHelper.exe
    "C:\Users\Admin\Desktop\BCUninstaller_6.1.0.1_portable\win-x64\StoreAppHelper.exe" /query
    3⤵
    PID:1348
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /min CleanLogs.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K CleanLogs.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6020
    - - C:\Windows\system32\find.exe
        
        find "BCUninstaller.exe "
        5⤵
        
        PID:6028
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F657678CDAD5400251B323D207EA54F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F657678CDAD5400251B323D207EA54F
Size 1KB
SHA256 9cbf22fae0dd53a7395556ce6154aa14a0d03360aa8c51cfea05d1fd8819e043
MD5 839a3145057932596326b0129d44a1d5
SHA1 3caf9ba2db5570caf76942ff99101b993888e257
SHA512 5d8af91fa36f786a64e2b8f1e79808aea3013ce47d25cd04668e2fedcf7b2693644e59b246c8c61995c3423276d1bf0866227726d1f0a7af2696678706056621
TLSH
T13231B5C9C1B8D692DA838D616791C2CB7D3DAFD30D10626150CF64A924C37FCCC24C65
MD5 SHA1 SHA512 TLSH

Submit Download

F9C57C8B55E84B295CBBD8CF3D95BF44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F9C57C8B55E84B295CBBD8CF3D95BF44
Size 1KB
SHA256 56da8722afd94066ffe1e4595473a4854892b843a0827d53fb7d8f4aeed1e18b
MD5 ce02a0499711d1f1a3fcfc3c699a6c97
SHA1 f252e794fe438e35ace6e53762c0a234a2c52135
SHA512 437ec6a60032a6e42462975ebc2a071791aca1e082e4a8262587abacd246cd0656f1f90f19a4634551efd5b26f985a5cfbf50c9670c13dc2e0c02c50d8bf7e61
TLSH
T15D41E8DDC9A8590B6C0348C062E8C86BBE3D53B73510A15D1746FFB629E2BC2BB3811D
MD5 SHA1 SHA512 TLSH

Submit Download

1F657678CDAD5400251B323D207EA54F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F657678CDAD5400251B323D207EA54F
Size 242B
SHA256 b8eb10b54b4dbc6f266d0bacdbd8004761ba89da8858c7e4c5defa3f55446b06
MD5 dca5487f55488e061838adef801013e6
SHA1 97f1b77d9d9a4b16983e3d10bd4a627db757261d
SHA512 09fd92d7361716d0205137be7befe3aab433bbd2537bf115439b20b9095f0b7f48a9aa1fa8d08ea2e30903b0a2843936088238e373fc26e54edd1f81552758f5
TLSH
T124D08C0422770722F1C28ABE90E23A133E36A798A516CFC10278020E0928E829DB0F07
MD5 SHA1 SHA512 TLSH

Submit Download

F9C57C8B55E84B295CBBD8CF3D95BF44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F9C57C8B55E84B295CBBD8CF3D95BF44
Size 256B
SHA256 1732a58946d0e1f44487d730613672779b91914e27dad957a672a2313e06ac87
MD5 f772c364202430f9380dbfb7acad4a0f
SHA1 370938909889243738ab2b1aefdf542b504e7e64
SHA512 76fac1d81ad995b52f368aa201e14c283486dea5d72f83cb3cf10906935bcfaebf158616b25dcbe1ebbbc947684428935291df07faaaf95e23112cf9f612b244
TLSH
T1ACD0801822770F31F6B14E7D45D115132D3DA6547551CFD801B0025C4515E41DD71F0F
MD5 SHA1 SHA512 TLSH

Submit Download

AB18A2ED9B854EDEC89397AFB897A630A72972F1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\AB18A2ED9B854EDEC89397AFB897A630A72972F1
Size 71KB
SHA256 ea3d597acd62e8aa46a1e9508d0b6d4862c0bd26561e7d714f34695b497eb79e
MD5 018dde26c1e34c7a7f1c80524d492230
SHA1 b95dd23d188181f302798ea43fc131652d6f90c3
SHA512 7207b42ba9d4dd681ec0937bbc94ac6212cba17cca4dadf7ab1bbe1cb46aebead911ace181ff3d85bb6887d6382ebde526e6051f2a4704ef7f769ee608e1f4a6
SSDEEP 1536:SWCqj+7UWb74ctUhqnfMI3kqx+l13QKhYivxup:SfqjsUE74sZezUOBvk
TLSH
T15F63C0D0A8321C6C2B328C21E97D33D82931A567D585D8EA8075B5ACD9D073773CA7BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 752fb67e4c72f80790615251f8e9d86dc62b10b469600f7ac41efc1bb77d3b05
MD5 74647a5d5c8eaa0a9217a1cf343e4372
SHA1 aef04f8712e842fa1cc821687490f73a671027d9
SHA512 9cacc90785078ff21202cc761735daf50eee7ea9825f7f94ad5d584486dfb25fb2959d12f6ff53f268e663135d4b57d251656093656225e2a7817a7f308db1ca
SSDEEP 384:HHMO0iO024YSFuhw+5EL1pPsac4j0lpDII+eI1IG:nrZYSFuK+5EB9sac4ID8LX
TLSH
T147528D7EAF0238BE0A27D194DDAE5219CE04E6BBEFD2D06215043C45C684779B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\AlternateServices.bin
Size 12KB
SHA256 72fca96324781831b2591efe21f6c4916bb5407052111ca2397dff3dca9912df
MD5 9de2cd2c262eef40313454436adcbf56
SHA1 bdc5f3a7b2fc33fceacc9d931d3d7e2f9b2a5649
SHA512 d675b72326644d394af9da91ade9382d9368162c484e21355c604c61e89e1eab9093d3289e8c52f0faaa9557cb39d08b3ac7ae464b9b37f64cddb247e5aee91e
SSDEEP 48:GhQqRxbRwIRSI566RzT5RPB/RX9fR7M/pERr4LO64N:FOx9wwSI56+P3PBZX77M/pEr4LOv
TLSH
T10C4284E76B756462F1A2CFB4C46C30DC9C33232555AC91C4CB24A0E762D5BD9E03AFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\AlternateServices.bin
Size 10KB
SHA256 505ee35fbf86a846a7170dfe73e7acb09f9b9c418b20051fd7a6328843970c20
MD5 f7e2a729e36ea542c8e54f6fcced2f71
SHA1 d1c458d4405ef7add17d42046daa47f1c91c4684
SHA512 862c7cc07403fc550f8657dd32653c34607b1a90a6ea3c1f0600a743fccd990a1f8075257edd81d7bd3979f428741444421727ef0f26642707b7fde5102b3466
SSDEEP 24:gUuhMZ0U391oRHT9BQCRBym9xrRth5q9F55A5LR7E9FGRLE9VvCRUq9BbrR:qsaRh7RLhRRI56LRakRyBCR79rR
TLSH
T16F225EE76B76A432F0A2CFB0846C719C8C33232515BC91C4CB5590E752C2BD9E02EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 101KB
SHA256 6dcbc72331221a82d8c6564c21ed83bad73873d10caf5c4d34a4e8c3b27d8a5c
MD5 cd9a1e03a7153a96688cdb56105e1149
SHA1 fd8275979ca79f6f1bb0cb9628d422018e0ec553
SHA512 3201d8cd5466e32dcfcf08d2c5b6a6d99cf7571793fe0c6e74596ec23ff0ebd3ca40ded28fde9a1ab1950eed2bd06d00b9a601fdd19b3fc7561a5aa8995b1271
SSDEEP 1536:iTCMyV9uA3IDPPtdoQ9irE/iBn9f2FQT5ZT9Iw7HRIkrAJ0GgWVj:iTCh3h3MPPwZqiV9Ttl9h2krAJ0GgWVj
TLSH
T198A3F194DB1A403BEC2485BFB495573C2735F8254A595B0B3AAC04762DCB3FF2D0E62A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 14e7b92dab8faf33441e12b82c201c9054e49987ed3f61b949253f2fbd30c933
MD5 fc5e41c9de515380a69273bf4f6d56c9
SHA1 476fe6678fc6c8be6a07ca4e55534e298862d5de
SHA512 449a4a5323e20af527739b8f75c950a0deb3eab8a3d2c8c554495238ff3e845b110b163da5f11609032717c968f68a34c7d30700b28615316168eb2b5634559d
SSDEEP 192:dOv5zboH7ZRJyj980K1d66Joz0dzgCl6mc0d:SbobZRJyjwd66JozQzgC1j
TLSH
T1D4E10C65E628863FC40803BBDCA61F440F36389AD84E3F1935DC65182D562DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a1daedb68c453bf1cf72ef7ea5e7083771bc477e03cef03f810562c3c5d5c004
MD5 1ec869dd3a07d098f060bd8639cf78b4
SHA1 2af795138522c977394200d69cf1e2e7acc761d7
SHA512 5ae78c6a0c105642e5fe8424ea4d6fac1852682ce0c84dd6d821498a11abfe1f592354a7e07a5578cd97bab9a171fb72d8de71d194c6938552dcf4ce153fd292
SSDEEP 96:JGShSdF95/7bkW6QXjrcEq0JyUR6FmWZwV52FGFiFNF3/dd66Joz0dzgClKtmc0d:ROv5zboobRJyjzWK1d66Joz0dzgCl6m5
TLSH
T129C1BB25F638863FC408423BCCA51F501E76385BD85E3F2932DC64492D6A2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ef726ea6302eafc1c0e5b25a44a4c8f2e09d18a79f349f92e90d1875e0fd8771
MD5 367b2911cd142919b657c72614c2e29f
SHA1 42b60be86de5400b248db8390e41e02a9cfe463c
SHA512 0271aaa4a14ab3f4934f6f4055b895eb30d1c95df79d1fec7bb9cf6b43805b40e9ce9e3cc44dda38aa6d9d39f5f63896883d3813340aa06ac272249596c2c0c7
TLSH
T1E321799C39F94DAEA9D7E29CF99102CE57154E0204C71D834D23DFCDED85AE9326A838
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\events\events
Size 5KB
SHA256 1733c07b9422db72435560c72dce1b37aefb23f74d2e107eb1f855394bd6293c
MD5 b472d25524788700aa57f9102f818fa2
SHA1 a016db07922a4190fb5253efa938b9a95c1ba2f5
SHA512 abc8d71cd065b024464458f8dbd5a5e0859f4997c6eb51a35f061cd513baea74cb061c1dfa9bb3d3741b9c4b59906ee273a6a3ed826cb1247167916e73095e84
SSDEEP 96:AKIRNeGK4MjLliP8X4bdr9Bdnp8fHuRNel:A5Wc40r9/n8HuRNel
TLSH
T190B1EE1C25AD0CBF69DBD29DF89046DE479D4702C0C61D474CABDF8DCC5AA9A322E839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19076b65-3226-4f43-aa9b-27ec05fb80b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\19076b65-3226-4f43-aa9b-27ec05fb80b8
Size 2KB
SHA256 c1f817dbceac1af14b41517d73ee51891cf72758988e1cbcad86ee5cdd405350
MD5 44b4817606266140ea964a0c796f21f6
SHA1 5e6abb04db1f67feebf9a104ff662f091661be85
SHA512 dc2e89838f80554c89fa7840eecbf741de0ad4c9aa5de9dd84d042c306743cc5a4d5431a89ca49b1849cb6f6e23c708937f98a1dc02d05bb9923c67661f94e8d
TLSH
T16741215831785C7B9CCAE69D8481328E57608A1300CA1D533E81CF0C8CAA6AE736B82B
MD5 SHA1 SHA512 TLSH

Submit Download

5982cb01-b680-413f-8b31-4583caa36eeb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\5982cb01-b680-413f-8b31-4583caa36eeb
Size 16KB
SHA256 5cb300a34aa77ca7846860da07da3ce2e7175f6f8b181c26c120cf2d9764d4bd
MD5 4fec39a419d2163fb587058d00f39925
SHA1 54dd2d9dc73a3fd6624f138471adba5edabc0297
SHA512 52bb29dfae612488f4615e7b4f2096b63ba4ec06423ade0d04814f00a092ab3d030d22b38b5e15c9fb29d05efade39ff9753d2f86bc676bf211659d542d6ccd8
SSDEEP 192:fGLSbzidSRCtKXJ8Vf57NhVjaqynJW1OVZVxUnYUTAJ1/cnBavIta75nUWLrcc1m:eLSbuSRCtK2V5tmqynJVa/jsxXFZ0
TLSH
T16772A956686049BB8691E39894F8BFC3E5F528CF4C418FC99BE47D082DEE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

830529fd-0475-4f3b-80c5-7a63d901089f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\830529fd-0475-4f3b-80c5-7a63d901089f
Size 235B
SHA256 acfdf62d51373b62477fc43cebf262455f97e2e79142e1adc1eef7e274bc5843
MD5 f1f8a60942c40aa3031ec34197a76b3c
SHA1 a4f90549e2ac532ce0473a23a8aebcaaac671912
SHA512 710bb488d3edcb1f5e016b6ab259f90fcf603abbf308b93ae421f17a99b8137e221079ab46e4e400cb5005816894746105229bc8ad3a4b8e8a38133da6c35920
TLSH
T1D8D0979118D8235D28100F07F0E02AC631958C3358B49810956841748AFEEC8416295A
MD5 SHA1 SHA512 TLSH

Submit Download

9dca6a11-715f-4026-a8ae-e86fde6d57bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\9dca6a11-715f-4026-a8ae-e86fde6d57bf
Size 235B
SHA256 b016a5e499a737ffc6e95f8f85a120a9b073a16031452096b27d6757e742ec8c
MD5 08425e843ebd9f3df64548aed29bbdfd
SHA1 cd9391b24b94a815c199757fe50fb3d8f5e1151e
SHA512 ae94ef71a586bb0505eb5f2711f476b1d8a5032037c87a1e8bf8c049eb0c1a772a8b473d5d56bd6aa7c678bbc0c370b038b54ce498bc0b7efa5bfd82307a813e
TLSH
T196D097C034983B2C4C040F0AF0A0ACC2B0484C73D0B0D85089A248B88ABDBC902A281B
MD5 SHA1 SHA512 TLSH

Submit Download

be83e6cc-5a93-4518-b817-0817057d6720

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\be83e6cc-5a93-4518-b817-0817057d6720
Size 883B
SHA256 58019c61ed69205819ac360ba320a54b8fde67baf7fe3df76935d90d5da5b931
MD5 da1727dc487551b46e48080f983ac200
SHA1 2730b4da2ef8450c2a3e94321cec9fc743b45413
SHA512 9010f6c674c618c7ede5c7113728b23455636a6f37ecde1a2de428d190da9dc86932ebf18cf744526f549bdf9ca1f8cdcd8c1068e6ffd78acc1c1d71d2849183
TLSH
T10C11C0529334B9B2CC28838FC595774697F47423C4CA44147EE55A140DBDA1EE35670B
MD5 SHA1 SHA512 TLSH

Submit Download

e70ff9f9-784b-4442-a296-013c219460d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\e70ff9f9-784b-4442-a296-013c219460d9
Size 886B
SHA256 b0afd79c3135a63020fcbdff1e4314c635eb80ffe08a3856b0953a27340cde73
MD5 459c761ba48d6d3586fa42d0fc441cc6
SHA1 f1b828092738dd65a7d2b77a15152e050bf4f697
SHA512 434bdf253735992c3404b5447b1633d5564fdee56e571995a8ccec7b8d82ed0bd4ef2a6283ef1322f0c0b73c988000577dcd25304d61b52dd86f71d3484bfa86
TLSH
T17E1100528630BA73CC2892CBC5E1BB469AE43023C0CA0D147ED59B180DBDA2FA357607
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\extensions.json
Size 16KB
SHA256 a30026863e6c34ecaf159ce816860cb27b4b062868cc5192fa1ac5cb0398f190
MD5 978e55fa6ff1a2eef5df82b56a983e69
SHA1 604812d4a8b4e956c0749607dbd22ccbaf0ed1e3
SHA512 eee63f83edf679a66a0274d2764dae6e64d22f461d6fe208d5a9f1258445c33143d7f1edf5529a27be25056fbd9b3799ed873384ffdfd363704ce851c4277444
SSDEEP 384:MkI4voUmldvM8dhW894z896osRL4HmL4PKL4HGL4HJL4HlSy4ht:DI4QRfVX94U67J4s4A4M4B4n4X
TLSH
T1BA72331545049EB8298F979BAA367E02C37D473B60845C78B4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs-1.js
Size 6KB
SHA256 0d9445f7097304356dc32c0e9c9739c2e7b8c33983e8eaa32fe33355b472d22f
MD5 5592285c87c690de8c85efe506a16f01
SHA1 1b4c8dcde309ac9d9941b41c56330c9c5ea0e87b
SHA512 edb1b86751f09ccbbb84174612aff588b204acf9f9fcbc1d9d37cfcae7cdbb1ca02ea5bb4cb4e6a86a837aad2c679d56f0f3e7c0a4c5a786b69bc999d5b5faad
SSDEEP 96:xHHJUTUtBoqGqV0fY031zSDvCSSlldv9jCenYtHFLkBw88H8L4cnZhLMsGS:njRmfY03CvCSSybFoBw886j
TLSH
T1FCE1107854188B7FB4B677ACAC6888316AB2013B7BBF68C750B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 fceb62a255c07317e9e5597578b2b5eb79f983d861d5a91e7845d16778076f74
MD5 5e49f54892635d4a4d9297436b46c1e6
SHA1 1a0d0744454eef5f4f2a15430a9e2dcf25246d5e
SHA512 943f0c55d17150ed27ca597dd5d3fb187b0633f405d3595aef6bf1e5063531ad684ecdaa1c489249abe2688b2a07e09058425c64648aecf867886f36d09f4056
SSDEEP 96:xHHJUTUtBoqGqV0fYKjzDnjb1zS3rSSlldv9jUnYtHFLkBw88H8L4cnZhLMR:njRmfYcDfmrSS5FoBw886s
TLSH
T136E1217895088F7F64B677ACAC6889316AB2413B7BBF68C750B544C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 7KB
SHA256 f7e6cdf729a018d5f30fc8c8a3f84b9322eac836732448d9b446d78d7df85290
MD5 23381ecde74a20de00a92e116cb989e0
SHA1 59d76f65da8d5b76e6fbb3e02bad8345038083b5
SHA512 30f70a3cc935d1e0799e5aebd83c88261ab7f4337a158ca5b4c52264a10c05527daf9807d65c0584f3e06faefe19e91902c2081c98eddb66fc58cb615e60bd82
SSDEEP 96:xHHJUTUtBoqGqV0fY03NbzSDvCSSlldv9jCenYtHFLkBw88H8L4cnZhLMsGS:njRmfY03evCSSybFoBw886j
TLSH
T126E1207855188B7F64B677ACAC6888316AB2013B7BBF68C750B544C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 8KB
SHA256 0c5e3342cedadf0b201ccaf46788e964d8c250dd2c9813045a5b6c7da378b9a1
MD5 1be1f68831d36439a8c30e4db195ea15
SHA1 cca94fb0cb5b842e87e1c878e011353bc433184c
SHA512 953acc10535ea6e3f4e9f5d08720fb4d19c6071926e7850a1471b37845b263bab8abeaf5c42d51a3b53e6e7dbea4acb87f13f20a93bd2a6275242d028a9f2905
SSDEEP 96:xHHJNTUtBoqGqV0f903NbzSDvCSSlldv9jCenYtWRUxLSwBw88m1i8L4cnZhLMs9:nWRmf903evCSSySR8ewBw88olj
TLSH
T1FD0210385404CF7F65B676BCAC6449B15AB2013BB6BF68C750BA44C5054CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2291fda03e583fd18ec861b126be40e0f845c208ed225523f7edcee2fa84d2d5
MD5 67fdce57e431bcf99bc0e140b08557b4
SHA1 70263e254d05650951b5afdca0aaf93ac6259878
SHA512 3ea50c33398e7896bae44d05bebb449961ab4387fe96245ab155d4a81a064dd7180ab8dd568b3b1c0c4c4d60a938614de834a8f80ca8db95f3802bd356d0d9e4
TLSH
T194210A07EDAF1CF81196E28BE0C15FE4CB64146282F494F0D8548A0306AC759FB8F31E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 5df20ee021ca54934e4d8e423ffb8ea8c0a2098de0b975506aa0fb1c4039e11d
MD5 e9a8f2c6949c7cb64107f4ab00914546
SHA1 1bc1b82ddf2c49686d3d4284e3ba0b85fdbdb0e6
SHA512 2d989f207cff5f3683a823a0bf3aefc391df1eac5a93ae020c28cc65f0e42d72a79f618a246f7d0e90a309c88250afbb1b77bef2ba463d2411dac3a619b61a73
SSDEEP 192:T8iNa9r9e35lxtyj8WQFrFdLWX6vLOcOLmg:R8rIpTxbWCOLmg
TLSH
T168D17E0FE56DEA5B98A434D448DC770C76C9505A9EE20ED8CA284B3A0071308561F1EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 df535f2606a045421fa895c078e56dfb3416ca48ae173b62a9516a4e5f214262
MD5 6d49c07487820420088eed36ee70bfef
SHA1 b75bdbe73c3b34d9f5e6cb920c405db0dc305166
SHA512 34ba4a88a299128198a5540f417159d79bfe7a7ba91aff426fcfb50248e9f6a4ad51c319d7ba93452b9c4d14928b5f19c2d7bf0e418386e64195d3df9c93dc48
SSDEEP 192:h8iNa9r9e35lxtyj8WQPplhG2X6USMsHhdLP:b8rIpTxxw2VsfLP
TLSH
T127D15D4BE568A9AB88B875E048DC7B4C76C95046EFE10ADCC67C467A5061704671F1EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 17cfca3ad18f9a5f86f65d9c6727e87006b4bf1d2b71a594c090d541926ad9a1
MD5 9d9ecca92d62887a64f4d82a3f6ff2b0
SHA1 f22da37cad2dbe97693dd990abccca158fd2aa5d
SHA512 cfd3347407744640da45b1328717eaeecee2a4b2b532a10ba859ce724d75edbf2ad68002ab4c0cbe14da2ca73311adbdb93a8f0335957acf67e7dc45bdd37ba2
SSDEEP 24576:tNXGl209jHKe09DuyO6FDqX+RIq2XRw+fZnXV:tZsjKe09D7O6JquR6u+hnX
TLSH
T1C8F52AF82092B357F3418033A64553EB21AFD00CA467DE044BA956F995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1348-1131-0x00000279D6870000-0x00000279D695A000-memory.dmp

Download

memory/2828-1215-0x000002D3286C0000-0x000002D3287AA000-memory.dmp

Download

memory/2828-1216-0x000002D32A300000-0x000002D32A30C000-memory.dmp

Download

memory/2828-1239-0x000002D32A300000-0x000002D32A30C000-memory.dmp

Download

memory/2828-1238-0x000002D3286C0000-0x000002D3287AA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads