salatstealer | 4f0c08a4cef4f90b4b880d4f998a0ea633234361802f18f5976717d8ff229dce

Analysis

user interaction
yes
max time kernel
130s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
START 1.exe
Size 3.4MB
Sample260524-2epdjsby7v
SHA256 4f0c08a4cef4f90b4b880d4f998a0ea633234361802f18f5976717d8ff229dce
MD5 7e51dbcfaf1892f23c8542667e04c121
SHA1 a2e493846ef933077fcea161283af1ac9d629a44
SHA512 7d9661c8836105a11a73fdddb2901c3adb5b28657f806f6907b727b159d697115c20101a0154598621c1fcde9d90f3b36514d990443150d78f4b4cc7c9503626
SSDEEP 49152:bTbKcVXIpbYi9N+nkiCdKQOI6Iguq/XHH/6VpWtD6z+3q+VFCiCFvBa3So:jYN9NfHoxIJEHH/ipWtD6ialvi9
TLSH
T150F53307B59349ADC16512BD91A1C7A5DBCEC40944ADCBDE2EF0827B67273EA884CC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery salatstealer persistence spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 17 IoCs

resource	yara_rule
behavioral2/memory/2144-1-0x0000000000080000-0x0000000000CD7000-memory.dmp	family_salatstealer
behavioral2/memory/2144-330-0x0000000000080000-0x0000000000CD7000-memory.dmp	family_salatstealer
behavioral2/memory/2144-358-0x0000000000080000-0x0000000000CD7000-memory.dmp	family_salatstealer
behavioral2/memory/2144-714-0x0000000000080000-0x0000000000CD7000-memory.dmp	family_salatstealer
behavioral2/memory/4580-861-0x0000000000540000-0x0000000001197000-memory.dmp	family_salatstealer
behavioral2/memory/4580-893-0x0000000000540000-0x0000000001197000-memory.dmp	family_salatstealer
behavioral2/memory/5392-915-0x0000000000FA0000-0x0000000001BF7000-memory.dmp	family_salatstealer
behavioral2/memory/1712-926-0x0000000000920000-0x0000000001577000-memory.dmp	family_salatstealer
behavioral2/memory/4768-961-0x00000000007F0000-0x0000000001447000-memory.dmp	family_salatstealer
behavioral2/memory/4580-962-0x0000000000540000-0x0000000001197000-memory.dmp	family_salatstealer
behavioral2/memory/4580-981-0x0000000000540000-0x0000000001197000-memory.dmp	family_salatstealer
behavioral2/memory/1752-983-0x00000000007F0000-0x0000000001447000-memory.dmp	family_salatstealer
behavioral2/memory/4580-984-0x0000000000540000-0x0000000001197000-memory.dmp	family_salatstealer
behavioral2/memory/4580-987-0x0000000000540000-0x0000000001197000-memory.dmp	family_salatstealer
behavioral2/memory/4580-989-0x0000000000540000-0x0000000001197000-memory.dmp	family_salatstealer
behavioral2/memory/4580-992-0x0000000000540000-0x0000000001197000-memory.dmp	family_salatstealer
behavioral2/memory/5236-993-0x00000000007F0000-0x0000000001447000-memory.dmp	family_salatstealer

Executes dropped EXE 3 IoCs

pid	Process
4580	csrss.exe
5392	csrss.exe
1712	csrss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2144-0-0x0000000000080000-0x0000000000CD7000-memory.dmp	upx
behavioral2/memory/2144-1-0x0000000000080000-0x0000000000CD7000-memory.dmp	upx
behavioral2/memory/2144-330-0x0000000000080000-0x0000000000CD7000-memory.dmp	upx
behavioral2/memory/2144-358-0x0000000000080000-0x0000000000CD7000-memory.dmp	upx
behavioral2/files/0x001900000002b48a-712.dat	upx
behavioral2/memory/2144-714-0x0000000000080000-0x0000000000CD7000-memory.dmp	upx
behavioral2/memory/4580-721-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/4580-861-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/4580-893-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/5392-901-0x0000000000FA0000-0x0000000001BF7000-memory.dmp	upx
behavioral2/memory/5392-915-0x0000000000FA0000-0x0000000001BF7000-memory.dmp	upx
behavioral2/memory/1712-924-0x0000000000920000-0x0000000001577000-memory.dmp	upx
behavioral2/memory/1712-926-0x0000000000920000-0x0000000001577000-memory.dmp	upx
behavioral2/memory/4768-959-0x00000000007F0000-0x0000000001447000-memory.dmp	upx
behavioral2/memory/4768-961-0x00000000007F0000-0x0000000001447000-memory.dmp	upx
behavioral2/memory/4580-962-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/4580-981-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/1752-982-0x00000000007F0000-0x0000000001447000-memory.dmp	upx
behavioral2/memory/1752-983-0x00000000007F0000-0x0000000001447000-memory.dmp	upx
behavioral2/memory/4580-984-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/4580-987-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/4580-989-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/4580-992-0x0000000000540000-0x0000000001197000-memory.dmp	upx
behavioral2/memory/5236-993-0x00000000007F0000-0x0000000001447000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe	csrss.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\csrss.exe	csrss.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\a2de7b3a-6eee-d1b5-152e-af2fcff53a6e	START 1.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\winlogon.exe	START 1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	START 1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	START 1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	START 1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	START 1.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\-.2048.l.Password.-2048.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\-.2048.l.Password.-2048 (extract.me).zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2144	START 1.exe
2144	START 1.exe
2144	START 1.exe
2144	START 1.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
6024	powershell.exe
6024	powershell.exe
6024	powershell.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe
4580	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
776	firefox.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	firefox.exe
Token: SeDebugPrivilege	1648	firefox.exe
Token: SeDebugPrivilege	1648	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	776	firefox.exe
Token: SeDebugPrivilege	1648	firefox.exe
Token: SeDebugPrivilege	6024	powershell.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe
776	firefox.exe
776	firefox.exe
776	firefox.exe
776	firefox.exe
776	firefox.exe
1648	firefox.exe
1648	firefox.exe
1648	firefox.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1648	2200	firefox.exe	82
PID 2200 wrote to memory of 1648	2200	firefox.exe	82
PID 1648 wrote to memory of 2148	1648	firefox.exe	83
PID 1648 wrote to memory of 2148	1648	firefox.exe	83
PID 1648 wrote to memory of 2148	1648	firefox.exe	83
PID 1648 wrote to memory of 1684	1648	firefox.exe	84
PID 1648 wrote to memory of 1684	1648	firefox.exe	84
PID 1648 wrote to memory of 1684	1648	firefox.exe	84
PID 1648 wrote to memory of 1684	1648	firefox.exe	84
PID 1648 wrote to memory of 2680	1648	firefox.exe	85
PID 1648 wrote to memory of 2680	1648	firefox.exe	85
PID 1648 wrote to memory of 2680	1648	firefox.exe	85
PID 1648 wrote to memory of 2680	1648	firefox.exe	85
PID 1648 wrote to memory of 5240	1648	firefox.exe	86
PID 1648 wrote to memory of 5240	1648	firefox.exe	86
PID 1648 wrote to memory of 5240	1648	firefox.exe	86
PID 1648 wrote to memory of 4116	1648	firefox.exe	87
PID 1648 wrote to memory of 4116	1648	firefox.exe	87
PID 1648 wrote to memory of 4116	1648	firefox.exe	87
PID 1648 wrote to memory of 4116	1648	firefox.exe	87
PID 1648 wrote to memory of 1588	1648	firefox.exe	88
PID 1648 wrote to memory of 1588	1648	firefox.exe	88
PID 1648 wrote to memory of 1588	1648	firefox.exe	88
PID 1648 wrote to memory of 1588	1648	firefox.exe	88
PID 1648 wrote to memory of 4608	1648	firefox.exe	89
PID 1648 wrote to memory of 4608	1648	firefox.exe	89
PID 1648 wrote to memory of 4608	1648	firefox.exe	89
PID 1648 wrote to memory of 4608	1648	firefox.exe	89
PID 1648 wrote to memory of 2032	1648	firefox.exe	90
PID 1648 wrote to memory of 2032	1648	firefox.exe	90
PID 1648 wrote to memory of 2032	1648	firefox.exe	90
PID 1648 wrote to memory of 2032	1648	firefox.exe	90
PID 1648 wrote to memory of 6140	1648	firefox.exe	91
PID 1648 wrote to memory of 6140	1648	firefox.exe	91
PID 1648 wrote to memory of 6140	1648	firefox.exe	91
PID 1648 wrote to memory of 6140	1648	firefox.exe	91
PID 1648 wrote to memory of 1832	1648	firefox.exe	93
PID 1648 wrote to memory of 1832	1648	firefox.exe	93
PID 1648 wrote to memory of 1832	1648	firefox.exe	93
PID 1648 wrote to memory of 1832	1648	firefox.exe	93
PID 2144 wrote to memory of 4580	2144	START 1.exe	95
PID 1648 wrote to memory of 3220	1648	firefox.exe	96
PID 1648 wrote to memory of 3220	1648	firefox.exe	96
PID 1648 wrote to memory of 3220	1648	firefox.exe	96
PID 1648 wrote to memory of 3220	1648	firefox.exe	96
PID 1648 wrote to memory of 776	1648	firefox.exe	97
PID 1648 wrote to memory of 6032	1648	firefox.exe	98
PID 1648 wrote to memory of 6032	1648	firefox.exe	98
PID 1648 wrote to memory of 6032	1648	firefox.exe	98
PID 1648 wrote to memory of 6032	1648	firefox.exe	98
PID 1648 wrote to memory of 5792	1648	firefox.exe	99
PID 1648 wrote to memory of 5792	1648	firefox.exe	99
PID 1648 wrote to memory of 5792	1648	firefox.exe	99
PID 1648 wrote to memory of 5792	1648	firefox.exe	99
PID 4580 wrote to memory of 6024	4580	csrss.exe	103
PID 4580 wrote to memory of 5392	4580	csrss.exe	106
PID 4580 wrote to memory of 1712	4580	csrss.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\START 1.exe
"C:\Users\Admin\AppData\Local\Temp\START 1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\PeerDistRepub\csrss.exe
  C:\Users\Admin\AppData\Local\PeerDistRepub\csrss.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\csrss.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5392
- - C:\Program Files\Google\Chrome\Application\csrss.exe
    "C:\Program Files\Google\Chrome\Application\csrss.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {5dab8e21-439b-47b4-b399-6ad18587ca97} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {daae1078-ab31-4390-8519-bf8697518e20} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27323 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {e6a85fc9-4b1b-4742-9c12-266b5d1caee2} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3908 -prefsLen 27323 -prefMapHandle 3912 -prefMapSize 270279 -ipcHandle 3928 -initialChannelId {f6938347-0b6f-44be-a7a4-0a7d04dd568b} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4460 -prefsLen 34822 -prefMapHandle 4468 -prefMapSize 270279 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2764 -initialChannelId {fa6d7d4f-87c3-4f03-a10f-e0b45aa4fafd} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4936 -prefsLen 34822 -prefMapHandle 4940 -prefMapSize 270279 -ipcHandle 4948 -initialChannelId {259a0e68-5b28-4356-b298-3d7580bdfe8a} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5428 -prefsLen 32952 -prefMapHandle 5432 -prefMapSize 270279 -jsInitHandle 4840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3372 -initialChannelId {7db070c6-3875-4438-9a12-ffd96bb5b942} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {166ee21a-b2d7-465c-bc08-ffa8e43a4529} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5796 -prefsLen 32952 -prefMapHandle 5800 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {07c04eee-aade-4aaf-b6c0-5b26031b2ee1} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6584 -prefsLen 33167 -prefMapHandle 6588 -prefMapSize 270279 -jsInitHandle 6592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6596 -initialChannelId {ac0562bd-1588-4949-a7d3-db4bc6116443} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4796 -prefsLen 36854 -prefMapHandle 7084 -prefMapSize 270279 -jsInitHandle 6980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6972 -initialChannelId {327c2637-de3a-4ab2-9a61-b8b33bde5803} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 7208 -prefsLen 39971 -prefMapHandle 7200 -prefMapSize 270279 -ipcHandle 7288 -initialChannelId {e1f15203-f0e8-4939-a7ea-0be08e43f62c} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7292 -prefsLen 36854 -prefMapHandle 7288 -prefMapSize 270279 -jsInitHandle 7200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7196 -initialChannelId {b14d96cf-468f-4e87-8932-7eaddd1402a4} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:6032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2908 -prefsLen 36854 -prefMapHandle 2912 -prefMapSize 270279 -jsInitHandle 2916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6616 -initialChannelId {6701b464-ae3a-41ac-9669-ec103c1b57d8} -parentPid 1648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:440

C:\Users\Admin\Downloads\-.2048.l.Password.-2048 (extract.me)\Password - 2048\START 1.exe
"C:\Users\Admin\Downloads\-.2048.l.Password.-2048 (extract.me)\Password - 2048\START 1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4768

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\-.2048.l.Password.-2048 (extract.me)\Password - 2048\Instruction manual.txt
1⤵
PID:5440

C:\Users\Admin\Downloads\-.2048.l.Password.-2048 (extract.me)\Password - 2048\START 1.exe
"C:\Users\Admin\Downloads\-.2048.l.Password.-2048 (extract.me)\Password - 2048\START 1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1752

C:\Users\Admin\Downloads\-.2048.l.Password.-2048 (extract.me)\Password - 2048\START 1.exe
"C:\Users\Admin\Downloads\-.2048.l.Password.-2048 (extract.me)\Password - 2048\START 1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c3737wlq.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 765e4e232a081c41854220b17c7ad96bb321a91782e4196ffeb9caf6d837277b
MD5 3c9fb494d113bd1e5fa46a32e0a353dc
SHA1 3a293fbe177de5e890022d91835e4b254e3c813b
SHA512 7eb4d5d7f6a9f03b6e38af01c94008bf4c4f087b52bd4254acae0574c05aff0d2858b1a458344c119cfe51f0f54ef8812a218d3772d8333070309af30571f824
SSDEEP 384:HUr7iO024Yso6J+Sl1xDnZBPsac4j0lpDII+dDOBpiDOBp6:0SZYso0+Sl7zZlsac4ID8LdNx
TLSH
T1F0528D7D9F0138BA2A63C194E9BE9244CD05E6BFEEE2C16605543C04CA847B9F4E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Users\Admin\AppData\Local\PeerDistRepub\csrss.exe
Size 3.4MB
SHA256 4f0c08a4cef4f90b4b880d4f998a0ea633234361802f18f5976717d8ff229dce
MD5 7e51dbcfaf1892f23c8542667e04c121
SHA1 a2e493846ef933077fcea161283af1ac9d629a44
SHA512 7d9661c8836105a11a73fdddb2901c3adb5b28657f806f6907b727b159d697115c20101a0154598621c1fcde9d90f3b36514d990443150d78f4b4cc7c9503626
SSDEEP 49152:bTbKcVXIpbYi9N+nkiCdKQOI6Iguq/XHH/6VpWtD6z+3q+VFCiCFvBa3So:jYN9NfHoxIJEHH/ipWtD6ialvi9
TLSH
T150F53307B59349ADC16512BD91A1C7A5DBCEC40944ADCBDE2EF0827B67273EA884CC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3y2x53wn.ehm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3y2x53wn.ehm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\AlternateServices.bin
Size 10KB
SHA256 0fc88329b1d342342b21bd1a72729d84e95d4a88df6881608ead71953e36a2b9
MD5 0c64289cc08c1a12e0a928f0471aba80
SHA1 bb4c02c46311b3264bf619aebf1e0bbc23b3af14
SHA512 fc30aad2f2a216f8b3098c1a9bf73b0f4633909fd49c2e2d5e55a9acec17b6cc334e1a67b8d8fc1bd3ce601f71f4d23ebe423e0d6308fe4f55e4502280453eaf
SSDEEP 48:VOR7/JSfAJaBTAJN55JHb5J1F5JwI56S5J:kRTJS4JaBMJNPJHNJ1LJwI566J
TLSH
T1BB2276E76BB6B472F0A2CFB08059714CDD33032629ACB594C65484F712D5ADAD13EBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\AlternateServices.bin
Size 17KB
SHA256 d18efae5738c181017b00abeeeb5aa63d48e6f9a48ba9851285134cd41feccb9
MD5 fdf326fc108ec0f2fe2558d9b3337af7
SHA1 5d2cf39855dbc0b1ac23012f6b88da6e0cece75e
SHA512 3f321684c77d1e23b813a75426040bf0fb7dcff90e77736fa7760ec7e29df03abb767bad5c0de85a423527e3234c8f6e1ca726c9b2c3de650f046f469b205256
SSDEEP 96:IRTJS4JaBMJNPJHNJ1LJwI566J0qJX4uJM/pAJjrCZG/2rDtHZGfrcZG:wQshwDtc
TLSH
T1B98256F36BB27462F0E2CFB04059714C9D33061A29ADB694CA5484E712D5BD6D13EBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\AlternateServices.bin
Size 27KB
SHA256 00e3bc1fe19d69b993e5ab9f0402beaebafd8672e949f933d0fc3fff2b51fb87
MD5 6e7d171fdaca802e12cdba3177d858ae
SHA1 c4a1dd3ab783a6d7781d76a8f21491b2d6a247a4
SHA512 51286214e462db45a590107706a76e9b92fa7d58a4fdb25280a14dd2b97cf95ee1470dc8968b12bf37e3a72e6f3551b3d0f0d62c9ea8978acf953e401b7b136d
SSDEEP 96:I3ZJX1JhBxJhbJcCJQAJ3I56hJcOJ/X46JM/pAJjrCZG/2rDtHZGfrcZGDjrFYnE:KxQshwDtc3vFYy7QtkwekZwwk20w7Z
TLSH
T1FFC272F727F2B562F0B2CFB0406D748C8D33061A29ADA294DA5484E602D57E5D17FB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\cookies.sqlite
Size 512KB
SHA256 57eccd7f096f0135fe62c3375de8d3b9ada5aea46184fb27bc255677f8ef2189
MD5 171dacc4e3b493053d48a39baed066d7
SHA1 d60db2b7c2a6623d578de77a933e0b77dd7dc307
SHA512 d6fd2aa9d0521519c6a04835d0d629b4170051dff5c83e1e8fc14d12c74dfa0a3f7b974324a96341b67d6a90c46f836c2ada3a5d67a7b736554fddbf97993812
SSDEEP 48:DQnS6rh9WTadtTIFIVOdyjT2+pmpZyDNeQHCIzxhCFagRMnP6Z4Hz:DQnSa3VdtTI7sjtMODNwuh4aG+P7H
TLSH
T1D6B4A8D329B69226DDC14EB68C582149553C9350C48FD6EEED1E22720C6DB4B8730FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 cb477947dcc784ca823fa71d99a415643709d6545efc19f7424f362e702b211a
MD5 08c35c64ed4c90c77a2ce68a985405ad
SHA1 e95f42817fe42c2b0c34a340da997f5f2afda23f
SHA512 844e1794cdf4c3faa612b5ee241e86fddb0c68f07244c5cab396f0bc4a5d593d662c13842f37f4ee24c8f0f0c1b2e6737201bdc937a8c8b5b402a9c35c64098c
SSDEEP 192:u1d66Joz0dzgCl6mc0dnOv5zboHaZHVyjv3Pu:Id66JozQzgC1jabo6ZHVyjvm
TLSH
T118E11EA8E728863FC418427BCDA21F454F35389A984E7F19359C741C2D572EE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b21e5c0acd50c64bf186f916d0d4719ff1e5e350d071c9445589767800ea22cb
MD5 92966acae9d76f871426ebcb22a8f12a
SHA1 4fd2250edf097667d11c2e4f05479b9fdfe5feef
SHA512 4490903df335d5588c1f6d0607d602ec48ad6936ccd8656d8be17f2d5d22e13e1e035b381070ff4eac96d748aa98b3286f5c8f00eb0f16f79cb4ee9bffd50fc2
SSDEEP 192:HOv5zbojZHVyjHxo1d66Joz0dzgCl6mc0d:4bojZHVyjcd66JozQzgC1j
TLSH
T16BD1FE68E739863FC458423BCDA61F400F76389A984E7F29329C741C2D962ED768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b36b5d72efc1572672c7f49b4fa2c6b6915c42f22b7ef30f337c028ced18e267
MD5 78fb926a71e904427ba4c86634789160
SHA1 ecba7336c18122e2a293198a9ec725fed9c57e02
SHA512 a19adb8e81a33da07d631278d26971badf66cf082a8b512a3eb436eafd7a807d86996329a88e022dcfa1472293d0bf7e807edf0afa8ad2abd14aa669515b5264
TLSH
T15A217F8D35B84E2A58C7E26C7452128E53558E0728C72C938D43DF8CCDD5AD9316E439
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\events\events
Size 4KB
SHA256 198f2a2669ee6b30b3bff18b6ef701e88a14adf037c15313b0c19317644b2155
MD5 6854a599e6cef0704be46db2d5b6e70b
SHA1 99150aff1cc8f44e97b11c58f54d67742318b12a
SHA512 d40a6239733cc8158b242da4331cabf9a2bb3d891155f32f39af39e04954954c156901c6d644ace3b8c610414e4688e3715dbe4d1551a5d36960669a74d70102
SSDEEP 96:vNbFPQL+NJmHAxYxEjIE4BmhsnapF3vdZd8km:vNbKolxYxgLhAapF3vx3m
TLSH
T11AA1E06C75B90C7E19EBD39DB842068D87DD4A0398C62C938DC7DE49CCCDA9A325E538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

073eb989-d76d-4475-9223-856c5970f0a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\073eb989-d76d-4475-9223-856c5970f0a6
Size 2KB
SHA256 f76ca9c5fc0836f5609e0b7cf9ce50ee2c10ed26b93e038720020fde22e405f9
MD5 96e98f74c1d861bb9e5bb8384e5ae817
SHA1 a12ff67efe825ffbe16a64fbcc790c5bff59f53a
SHA512 b6eaf3f4618ac382c2b2b3f8b714a3390e3cc5ed4c3c560ab0d3ed08db69f38883060b4d60ccf36fdb94fb88d93327563041f746af5e26304d6b758c488792f9
TLSH
T1AB41306CB67488B64D9AE19DC542374D47748A5300CA58832D61DE0CCC9666A33BA63B
MD5 SHA1 SHA512 TLSH

Submit Download

07e4d1de-6cd3-42cc-a716-71c035ea43ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\07e4d1de-6cd3-42cc-a716-71c035ea43ea
Size 235B
SHA256 bbc56bec7c654dc64902e7f83fb5bb8ad7c74b5d6ab929dbed575871185f69d3
MD5 b4aac6427c32086db714ed8916862588
SHA1 866a17b5083462dd0c5abda517510456f717306d
SHA512 dc423f0e15f10c2180c7cf29f7b120e021983dfea4e29b4ab8acecd7290e1278985b2555b1d0d5611429589660a944f63561f5896b45f3a596a8f1d4d7483b9c
TLSH
T14BD0978024D82B5C08180F07F0B128CA30488C3320759C10C59248B8EAF89C84292D57
MD5 SHA1 SHA512 TLSH

Submit Download

090a4299-20e9-4bdb-a066-20e0cb4fd256

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\090a4299-20e9-4bdb-a066-20e0cb4fd256
Size 886B
SHA256 defe04be84841a09906328d71ce91275431fb69e02b43ea8be233fbd3a70999f
MD5 132aec1a473b7ff90c66d0b47a438da7
SHA1 a8f0e27d2ba147ec254120459e51e7e7666c7e8f
SHA512 151eae0aec13e72c8ac2cf952b8d915644da38030b9ed8650f26a2f1c9a5980522c46488e0aca9d5a9b3350170810a9ba29069f1b66d208a93fa82d112f6bdad
TLSH
T146110090C634B6738D7CD38BC6A17F428BE4747380CA4D182E606A084DEA52E73AA307
MD5 SHA1 SHA512 TLSH

Submit Download

9ab37b71-0edb-4626-a663-7d6e792ecdc3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\9ab37b71-0edb-4626-a663-7d6e792ecdc3
Size 883B
SHA256 4b856bcc496f7ec516de99be0af67694ea9ba6c8ca6990991e555623d6019d57
MD5 a4070e7496eb17b2222cc6082cd7a3bd
SHA1 d9788afb3ef88b13a8f4af25137a349b61e73934
SHA512 d65abfb9ea4cf216f207b54cc2856f6196c2dac0471b6926872034cb99bb44ff9f04d557381b1bea134be5b1ab50f10bda594846f3bc969b648e93bcaa2ba23c
TLSH
T16B11D081D730B5B2CD7CD24BC6527B054BA4752380CA45182D615A044DBA52E636A207
MD5 SHA1 SHA512 TLSH

Submit Download

9c510498-4b27-4324-9ea7-a7e8d56d046b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\9c510498-4b27-4324-9ea7-a7e8d56d046b
Size 16KB
SHA256 3b4dff1b2c45622647f263946e6da17181fc8edcc08fe0223758aa381a5a49cb
MD5 01d54dd53611966fbbe728f7ab66d847
SHA1 525deca670901de9681e44943344ec1c563a1b81
SHA512 3876835b0f3426740efad90200aa2e0e63a91902f590aea9218d3087e939daee6c282f30c2e0ad22f58b3fc37b56edf283ca21b1ffe13500e10ade7955bbba11
SSDEEP 192:J3GIAj2kMW0e9y0zGXV1KbJgUVKsKFkMgDBn13IQP8nQSy95N85kGWH7QNlkB:1ojtMW0ay0qXV1KbiyTKFZgDpMy9ckH
TLSH
T1C272E956242045BA8691E36894FCBFC7E6F538CF4C419FCA9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab539c5a-8795-4bd0-bb2b-303f06168fce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\datareporting\glean\pending_pings\ab539c5a-8795-4bd0-bb2b-303f06168fce
Size 235B
SHA256 f39043bc1f670a987e5b950d2efb08ccaa693243209568da3d484dd0c147e407
MD5 b906d3db90256d4c65cda530a844dd8f
SHA1 08079ef9a4fb6aaa790aa3d51c72216d7e317312
SHA512 cdb439592e7bd5f57999d2de1277318380fb614e2c811271a45f3c41130bafbd3f8daf8d8f2cb7e85fdf4517dabd3a63f37064557ec238a369e90909f0a0e42a
TLSH
T120D023C85498777D28544F0BF0F56EC6314C4C3B54B96C10DA5649789EFDECC52B2817
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\extensions.json
Size 16KB
SHA256 bf7366b17477a0bf9d4def921fae54ac39ce0079e97af390f8f1c2a50d7b6600
MD5 638530aeff9ceb20c74c520eba18ab7d
SHA1 6805d2ae505e60f64012c6b1d0769cea1a423815
SHA512 f34f78406e9cd6deaf863730a6c531aff7705841c048576b6757b19397a10ee71339392e94655cd8bf6f9b453a81f4b12cb8ca68d9310199c578b42b050418d1
SSDEEP 384:mkI4v7UmldvZ8dhWM94zI96obL4HSL4PvL4H5L4HnL4HI94hM:pI4TRf6XZ446w4A4r4R4r4I4q
TLSH
T1B272421545048EB8294F979AAA36BE01C37D573B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs-1.js
Size 8KB
SHA256 753f7748d2a2928af982d178b93153987d20f25051c60f75b3dde0f0318240a6
MD5 5868bb88cca2f528fa4e2c7ece67ed46
SHA1 425cc49806c7dde9b9ed68b2ad44bda169a19e01
SHA512 fb2a40f4493fce12c73a35a21161aa807b807312649a46f91887c9ef8e57622f19381cd124e55c0a77caf8fdc92b21dc638c051705e4c591d21921ef51cdda4a
SSDEEP 192:eH1CRSfZ/6OYSSSRv6Bw88T/w40pZ0303B:8bRvIw4lx
TLSH
T1B802FD785114CB7F64B276BCBC2449716AA2013BBABF78D740BA5885054CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs.js
Size 6KB
SHA256 d34c844c55e9fe8dbdea1de2a44489c63eef0254c8f381a331110e3c23fb9390
MD5 5bfe9392970c11b7b9e06ed0a4bc5262
SHA1 ab90672756328f41e29c347e0d156467dbbff30f
SHA512 64638c275025887467aa58a6afc1b93a8250ebed030d5cde482dea8875c44abd3e83c6833ebc6b41394805431a93a3b1dcc1b07dd64dd2ab8647d0bbe1db78c1
SSDEEP 96:xHcHUTUJqGqzfBt08S1zScSSlqdv9j/nrH1WknMBw88H8L4cnzu1:eHERzfB6VRSSsNMBw88p
TLSH
T13BE12F7894088B7F64B677BCAC688C316AB2013BB7BF68C710B55484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs.js
Size 7KB
SHA256 72c9ec3b22bb4d4847bba0fe3675adedbf658e78e7ce4f13f3f0965a81c51626
MD5 6a82815a3aa7980a019c7ec2218e91e6
SHA1 9555a289569bd2f0078520e0f9ad2de82c96d052
SHA512 5ca7d68027415d464ab8a853c6cf9c7572d885b340c9458970e483108d2df987d776b7fec3b06bd48a64cf6eb96b825692d42978c5b954bb4d27a84391c2637e
SSDEEP 96:xHcHUTU0PqGqSfB/6NbzSfYSSlqdv9jQnrH1WknMBw88H8L4cnzuAGS:eHECRSfB/6OYSSbNMBw88i
TLSH
T160E10F7891088F6F64B676BCAC688C316AB2013B7BBF68D750B55484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\prefs.js
Size 6KB
SHA256 f4fcdc4770a132c12307696433bee3a554e4e225eccd487d7d77698ac57a0f11
MD5 0dc763e6bca0b3949cab93845f368e35
SHA1 51a9222c49d2644caab6e6f630ba2ae388c8976c
SHA512 e55d902b76636faad14c704f2db6ef9e622190151ef3bcfdbdb386ae3d5b7816d19dc9b248e0b6106ea01fe0a5202df0f19b70b94dbf890c1f495d703d451ea6
SSDEEP 96:xHcHUTUJqGqzfB/61zSfYSSlqdv9jQnrH1WknMBw88H8L4cnzu1:eHERzfB/6SYSSbNMBw88p
TLSH
T159E11F7891088F6F64B677ACAC688C315AB2013BBBBF68D750B95485054CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 fb7941ef241f6a0352508377e881a1760dfe361904285e715f4da28119536522
MD5 f35cb5efe3bba4a643b1bf0d792f7952
SHA1 09d03be2cf82ce84c687e2f5c54e455e6a1ee08f
SHA512 4e671107d94f63ea8d432eded0a48418484f3c58f18d60ee7333a4fcf7ae91542a8e1fbc649fd09bfb90ce77af113861d2ab859ed5fcd17467c13d00cee05166
TLSH
T10C21A793653B2AF5FD66D221E48A4FE6DB8C3432407A68B0D49E5E6202AED4D338711D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 342eb6203bd76324efc1559ae1d46ddef5d1bd42361c24b3ea96ef88ebc9dd65
MD5 974673f9d1aeccc8c6f0de92e1014d94
SHA1 2cdf69aa150791efad2dfad1fa8667f336ff251f
SHA512 f9b832cd3c4b7ee79092b5bd4f6fff5e2530af189898422c44b4d233d0fb23d52e01cfbfd6ef4f5f36796971c4b335c2288292f21ca82f5379ca8b9a5c2116d0
TLSH
T11B515CB71C1F78FBBD65C5559CDB0FD08D92241001BEA4727D25A97301DD7066087A5E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 76b2dcba0d889203b9968d64071e13b735625f3e02e77f94ed02fede06ac8403
MD5 5cc0708d0f96ae7f82df620f115396eb
SHA1 656751fafd7ae8f5fd94d193f49c71a2757a3be4
SHA512 04e52ea56f930036b2b261336602e3259291359e9472474ab834a08514c60e1658195c7540ed7374e2491d0c294462cc4fd8cc78af67eb26f8cb7e20525b1ab1
TLSH
T154716CA2FC275EA34B72F6A548A91E34EA655986C4FC1680CD20322D45B0391B7BC0DD
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 2579e1419b5d4cfbc6fd16d04b84a08edf1116abf99807ebc536ba59e925fd48
MD5 15d899cba6cbc7a6de658ec5c0d31aec
SHA1 cf17af59f6428e2e9b72b58d1d1c4c21129060e2
SHA512 41965f0b38111dad66eda8ea5c953b43d8d70643477672e0890ab2af5c881872f4f323c9cb063e9937a498013808995cc55b4db7dc5575a2aa3d7bd2896f348f
SSDEEP 49152:hXg3QAjgjKR7bWqYKGFUGwF1+BXtVRzh4oh:tg3QAjgmqFUGS1+1tVRfh
TLSH
T1801639F824D1A257F3818037668563EB21AFD00C6477DD444BE966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.2MB
SHA256 8fbac4161064878583445929c6a2481cd8345ab923e1d4720dc5db5e85a4d3a5
MD5 434725a38b68d4192514bb0d5d45055b
SHA1 abae17c9ae435e7794d42861beef0de7e561849a
SHA512 fcded7eb19aa860ae221c6521a28a0cfc250947e6536d4eb42378f7dafe0fbba3083c20d5512d9d6cef5a0f58125bbb297b8d815229b73bcd667189f84f68f7e
SSDEEP 49152:YCvCHijgXRJPlYrXmKO2V6BRHPn9klmgv8AdMBeU8n3E6fdHtF66QshVli/xDIau:xvCHijgXkmKfV6/HPnK4gvrJ
TLSH
T1CE665CE420E29252F38140B3719A53FB11EFC01C6076CE44579896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.2MB
SHA256 37752800e80805f2a499dbcc95bb579f2ebf5383c792f40686ba372210018fd1
MD5 cd41903f32fc62a88ca5398141dc0298
SHA1 ccac3474658ccac591ed13027835eacacc2d7874
SHA512 66a582340ce52f5885fda3d8f6e5cbd90731cfd204455333cb219038f634e84ae2e172a33a706001634af21ddcf079ab22de3d0d38903f7145ca77265c7ab2bd
SSDEEP 49152:arkURVaAIoW8zN6wlD3vvlxoIaTdXiF4qGa3budCICnz7HuOPCHijgFRJPPYh1mt:Z+CHijgFSmKfV6WHPaK4dvrJ
TLSH
T1A0665DE420E29252F38540B3719A53FB10EFC01C6076CE445B9896FAA5B8CEB4D977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

-.4x3G4DMf.2048.l.Password.-2048.rar.part

Path C:\Users\Admin\Downloads\-.4x3G4DMf.2048.l.Password.-2048.rar.part
Size 3.5MB
SHA256 5c69edced6ff118f4ae64853e6bb43a338df1e126fd424146c9f5bf6539a901a
MD5 1b66e7badfeb3b5890eec3407f7681b0
SHA1 9b2fc3f77c78aa0ecf717567549f471491215c31
SHA512 4db26d2c1edce2ef80da6ccc6110b3de530e9ed58f590fb1ce3f3a90dbd2c4b11953c5357cd29a0ac31d5c5b2de641deb3786bcef63f9f265a88f559370b516d
SSDEEP 98304:ElxX1EWd47tz6NSFL0vQCz3N3eK608yv6:61E5BmNSFLHCB3rb6
TLSH
T1AB06331EEA36465363C9ACFD2389B198908C50C0B224647B48D36B75CE1D32DEBD5F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

-.JRnCPU3M.2048.l.Password.-2048 (extract.me).zip.part

Path C:\Users\Admin\Downloads\-.JRnCPU3M.2048.l.Password.-2048 (extract.me).zip.part
Size 3.5MB
SHA256 3503a7c53bc0f82cb517c753b019279af9cf466f853d3b91707a99f3ae76f4ca
MD5 d950cb3f8a221e94de722f95ecf11908
SHA1 8a4eb0256122a470a0720a8c1c1fb135704698e1
SHA512 27c2c22065718379ba4f4b4034a520dbd9334f75e04d655173b388e5dd344077a0e3bf230881e82388b20ea5f82cf4764e56076c2572a0307453281ef26a0d1d
SSDEEP 49152:viDbQczXUL3SqPPSHcq2DKmOO0mmKsNRDB565lW576b2BYEPF+0CN/1eNSEINvGe:vySTPPVHW7mx6DB5IlW576qCB/OZI/
TLSH
T185063307B44348BDC16513BA92A1C7A5DBDFC119689DCB9E2AF0C17B67172AAC84CC4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-926-0x0000000000920000-0x0000000001577000-memory.dmp

Download

memory/1712-924-0x0000000000920000-0x0000000001577000-memory.dmp

Download

memory/1752-982-0x00000000007F0000-0x0000000001447000-memory.dmp

Download

memory/1752-983-0x00000000007F0000-0x0000000001447000-memory.dmp

Download

memory/2144-1-0x0000000000080000-0x0000000000CD7000-memory.dmp

Download

memory/2144-358-0x0000000000080000-0x0000000000CD7000-memory.dmp

Download

memory/2144-0-0x0000000000080000-0x0000000000CD7000-memory.dmp

Download

memory/2144-330-0x0000000000080000-0x0000000000CD7000-memory.dmp

Download

memory/2144-714-0x0000000000080000-0x0000000000CD7000-memory.dmp

Download

memory/4580-989-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4580-962-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4580-987-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4580-721-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4580-992-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4580-981-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4580-984-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4580-861-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4580-893-0x0000000000540000-0x0000000001197000-memory.dmp

Download

memory/4768-961-0x00000000007F0000-0x0000000001447000-memory.dmp

Download

memory/4768-959-0x00000000007F0000-0x0000000001447000-memory.dmp

Download

memory/5236-993-0x00000000007F0000-0x0000000001447000-memory.dmp

Download

memory/5392-915-0x0000000000FA0000-0x0000000001BF7000-memory.dmp

Download

memory/5392-901-0x0000000000FA0000-0x0000000001BF7000-memory.dmp

Download

memory/6024-894-0x00000000031E0000-0x00000000031F0000-memory.dmp

Download

memory/6024-936-0x0000000007DB0000-0x0000000007DCE000-memory.dmp

Download

memory/6024-940-0x0000000007F10000-0x0000000007F2A000-memory.dmp

Download

memory/6024-941-0x0000000007F60000-0x0000000007F6A000-memory.dmp

Download

memory/6024-939-0x0000000008540000-0x0000000008BBA000-memory.dmp

Download

memory/6024-942-0x00000000080C0000-0x0000000008156000-memory.dmp

Download

memory/6024-943-0x0000000007F70000-0x0000000007F81000-memory.dmp

Download

memory/6024-944-0x0000000007FB0000-0x0000000007FBE000-memory.dmp

Download

memory/6024-945-0x0000000007FC0000-0x0000000007FD5000-memory.dmp

Download

memory/6024-946-0x0000000008040000-0x000000000805A000-memory.dmp

Download

memory/6024-947-0x0000000008020000-0x0000000008028000-memory.dmp

Download

memory/6024-937-0x0000000007DD0000-0x0000000007E74000-memory.dmp

Download

memory/6024-929-0x0000000070E90000-0x00000000711E7000-memory.dmp

Download

memory/6024-927-0x0000000007D70000-0x0000000007DA4000-memory.dmp

Download

memory/6024-928-0x0000000070D30000-0x0000000070D7C000-memory.dmp

Download

memory/6024-916-0x0000000006E90000-0x0000000006ED6000-memory.dmp

Download

memory/6024-913-0x00000000069B0000-0x00000000069FC000-memory.dmp

Download

memory/6024-912-0x0000000006970000-0x000000000698E000-memory.dmp

Download

memory/6024-911-0x0000000006420000-0x0000000006777000-memory.dmp

Download

memory/6024-903-0x0000000005B20000-0x0000000005B86000-memory.dmp

Download

memory/6024-904-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Download

memory/6024-902-0x0000000005980000-0x00000000059A2000-memory.dmp

Download

memory/6024-899-0x0000000005C70000-0x000000000629A000-memory.dmp

Download

memory/6024-895-0x0000000003150000-0x0000000003186000-memory.dmp

Download