hijackloader | b8d13de7a5a240c550f1baf560b0779a8e45e60f06bd73fde61688120484f7aa

Analysis

user interaction
yes
max time kernel
589s
max time network
540s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260620-l9ympsfv7x
SHA256 b8d13de7a5a240c550f1baf560b0779a8e45e60f06bd73fde61688120484f7aa
MD5 c152de54a333ad894d8a39649085b53a
SHA1 754f4f88ba4518c36ebe769f17c21b6c88146bb4
SHA512 c2a36056e2bd3705b5cd80b88e9c5cce6a0881f58329c590ea9b5e59d1105d6fabfacc8cc8244e9d3454a30de05e33e7ca082e568688101c1297fa07b57c86f7
TLSH
T1535166FB20F27005EF17A3000FA67A086293600715AEC8B6F3EC1345CF61B4D55972EA
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution hijackloader remus_stealer installer loader persistence spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\webtracer
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

remus_stealer

http://hebdod.shop:4964
http://carogra.biz:4219
http://myrtler.biz:9549

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001cc94-1061.dat	family_hijackloader

Detects Remus stealer 3 IoCs

resource	yara_rule
behavioral2/memory/1856-1207-0x00007FF7AB3F0000-0x00007FF7AB446000-memory.dmp	family_remus_stealer
behavioral2/memory/1856-1210-0x00007FF7AB3F0000-0x00007FF7AB446000-memory.dmp	family_remus_stealer
behavioral2/memory/1856-1292-0x00007FF7AB3F0000-0x00007FF7AB446000-memory.dmp	family_remus_stealer

Executes dropped EXE 6 IoCs

pid	Process
1216	Y6JAerwKt.exe
2536	80q9D66iZ4Z2wycm1PN6L.exe
5332	80q9D66iZ4Z2wycm1PN6L.tmp
5740	80q9D66iZ4Z2wycm1PN6L.exe
4964	80q9D66iZ4Z2wycm1PN6L.tmp
3732	App.exe

Loads dropped DLL 12 IoCs

pid	Process
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1856	KernelFor.exe
5476	Crisp.exe
5332	80q9D66iZ4Z2wycm1PN6L.tmp
4964	80q9D66iZ4Z2wycm1PN6L.tmp
3732	App.exe
3732	App.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org
7	ip-api.com
92	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 1856	1216	Y6JAerwKt.exe	133
PID 1216 set thread context of 5476	1216	Y6JAerwKt.exe	134

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\Y6JAerwKt.exe:Zone.Identifier	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2524	powershell.exe
4568	powershell.exe
1212	powershell.exe
5124	powershell.exe
4928	powershell.exe
5252	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80q9D66iZ4Z2wycm1PN6L.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80q9D66iZ4Z2wycm1PN6L.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80q9D66iZ4Z2wycm1PN6L.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80q9D66iZ4Z2wycm1PN6L.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3344	ping.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000a00000001cca9-1305.dat	innosetup
behavioral2/memory/2536-1308-0x0000000000070000-0x0000000000150000-memory.dmp	innosetup
behavioral2/memory/5740-1319-0x0000000000070000-0x0000000000150000-memory.dmp	innosetup
behavioral2/memory/2536-1322-0x0000000000070000-0x0000000000150000-memory.dmp	innosetup
behavioral2/memory/5740-1383-0x0000000000070000-0x0000000000150000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2976	wmic.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings	explorer.exe

NTFS ADS 20 IoCs

description	ioc	Process
File created	C:\ProgramData\webtracer\msvcp_win.dll\:Zone.Identifier:$DATA	Y6JAerwKt.exe
File created	C:\ProgramData\webtracer\ucrtbase.dll\:Zone.Identifier:$DATA	Y6JAerwKt.exe
File created	C:\ProgramData\webtracer\UpdateRingSettings.dll\:Zone.Identifier:$DATA	Y6JAerwKt.exe
File created	C:\Users\Admin\Downloads\Mineral.Mining.Simulator.Build.23819184._Archive_get_2860.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\cachedev.dll:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\LoggingPlatform.dll:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\vcruntime140.dll:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\Y6JAerwKt.exe:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\ucrtbase.dll:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\msvcp140.dll:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\mutex_alloc.bak:Zone.Identifier	Setup.exe
File created	C:\ProgramData\webtracer\LoggingPlatform.dll\:Zone.Identifier:$DATA	Y6JAerwKt.exe
File created	C:\ProgramData\webtracer\mutex_alloc.bak\:Zone.Identifier:$DATA	Y6JAerwKt.exe
File created	C:\ProgramData\webtracer\vcruntime140_1.dll\:Zone.Identifier:$DATA	Y6JAerwKt.exe
File created	C:\ProgramData\webtracer\cachedev.dll\:Zone.Identifier:$DATA	Y6JAerwKt.exe
File created	C:\ProgramData\webtracer\vcruntime140.dll\:Zone.Identifier:$DATA	Y6JAerwKt.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\UpdateRingSettings.dll:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\vcruntime140_1.dll:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\msvcp_win.dll:Zone.Identifier	Setup.exe
File created	C:\ProgramData\webtracer\msvcp140.dll\:Zone.Identifier:$DATA	Y6JAerwKt.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3344	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
5252	powershell.exe
5252	powershell.exe
5252	powershell.exe
2524	powershell.exe
2524	powershell.exe
2524	powershell.exe
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe
5476	Crisp.exe
5476	Crisp.exe
5476	Crisp.exe
1856	KernelFor.exe
1856	KernelFor.exe
1856	KernelFor.exe
1856	KernelFor.exe
1856	KernelFor.exe
1856	KernelFor.exe
1856	KernelFor.exe
1856	KernelFor.exe
4964	80q9D66iZ4Z2wycm1PN6L.tmp
4964	80q9D66iZ4Z2wycm1PN6L.tmp
4864	wmic.exe
4864	wmic.exe
4864	wmic.exe
4864	wmic.exe
2976	wmic.exe
2976	wmic.exe
2976	wmic.exe
2976	wmic.exe
4868	wmic.exe
4868	wmic.exe
4868	wmic.exe
4868	wmic.exe
1212	powershell.exe
1212	powershell.exe
1212	powershell.exe
2388	wmic.exe
2388	wmic.exe
2388	wmic.exe
2388	wmic.exe
3732	App.exe
3732	App.exe
3732	App.exe
3732	App.exe
3732	App.exe
3732	App.exe
3732	App.exe
3732	App.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1216	Y6JAerwKt.exe
1216	Y6JAerwKt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	firefox.exe
Token: SeDebugPrivilege	1928	firefox.exe
Token: SeDebugPrivilege	1928	firefox.exe
Token: SeDebugPrivilege	1928	firefox.exe
Token: SeDebugPrivilege	1928	firefox.exe
Token: SeDebugPrivilege	1928	firefox.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeIncreaseQuotaPrivilege	5124	powershell.exe
Token: SeSecurityPrivilege	5124	powershell.exe
Token: SeTakeOwnershipPrivilege	5124	powershell.exe
Token: SeLoadDriverPrivilege	5124	powershell.exe
Token: SeSystemProfilePrivilege	5124	powershell.exe
Token: SeSystemtimePrivilege	5124	powershell.exe
Token: SeProfSingleProcessPrivilege	5124	powershell.exe
Token: SeIncBasePriorityPrivilege	5124	powershell.exe
Token: SeCreatePagefilePrivilege	5124	powershell.exe
Token: SeBackupPrivilege	5124	powershell.exe
Token: SeRestorePrivilege	5124	powershell.exe
Token: SeShutdownPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeSystemEnvironmentPrivilege	5124	powershell.exe
Token: SeRemoteShutdownPrivilege	5124	powershell.exe
Token: SeUndockPrivilege	5124	powershell.exe
Token: SeManageVolumePrivilege	5124	powershell.exe
Token: 33	5124	powershell.exe
Token: 34	5124	powershell.exe
Token: 35	5124	powershell.exe
Token: 36	5124	powershell.exe
Token: SeIncreaseQuotaPrivilege	5124	powershell.exe
Token: SeSecurityPrivilege	5124	powershell.exe
Token: SeTakeOwnershipPrivilege	5124	powershell.exe
Token: SeLoadDriverPrivilege	5124	powershell.exe
Token: SeSystemProfilePrivilege	5124	powershell.exe
Token: SeSystemtimePrivilege	5124	powershell.exe
Token: SeProfSingleProcessPrivilege	5124	powershell.exe
Token: SeIncBasePriorityPrivilege	5124	powershell.exe
Token: SeCreatePagefilePrivilege	5124	powershell.exe
Token: SeBackupPrivilege	5124	powershell.exe
Token: SeRestorePrivilege	5124	powershell.exe
Token: SeShutdownPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeSystemEnvironmentPrivilege	5124	powershell.exe
Token: SeRemoteShutdownPrivilege	5124	powershell.exe
Token: SeUndockPrivilege	5124	powershell.exe
Token: SeManageVolumePrivilege	5124	powershell.exe
Token: 33	5124	powershell.exe
Token: 34	5124	powershell.exe
Token: 35	5124	powershell.exe
Token: 36	5124	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeIncreaseQuotaPrivilege	4928	powershell.exe
Token: SeSecurityPrivilege	4928	powershell.exe
Token: SeTakeOwnershipPrivilege	4928	powershell.exe
Token: SeLoadDriverPrivilege	4928	powershell.exe
Token: SeSystemProfilePrivilege	4928	powershell.exe
Token: SeSystemtimePrivilege	4928	powershell.exe
Token: SeProfSingleProcessPrivilege	4928	powershell.exe
Token: SeIncBasePriorityPrivilege	4928	powershell.exe
Token: SeCreatePagefilePrivilege	4928	powershell.exe
Token: SeBackupPrivilege	4928	powershell.exe
Token: SeRestorePrivilege	4928	powershell.exe
Token: SeShutdownPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeSystemEnvironmentPrivilege	4928	powershell.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
4964	80q9D66iZ4Z2wycm1PN6L.tmp
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe
4224	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1928	firefox.exe
4972	explorer.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
1928	firefox.exe
2688	Setup.exe
2688	Setup.exe
4224	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1928	4272	firefox.exe	89
PID 4272 wrote to memory of 1928	4272	firefox.exe	89
PID 1928 wrote to memory of 5784	1928	firefox.exe	90
PID 1928 wrote to memory of 5784	1928	firefox.exe	90
PID 1928 wrote to memory of 5784	1928	firefox.exe	90
PID 1928 wrote to memory of 1608	1928	firefox.exe	91
PID 1928 wrote to memory of 1608	1928	firefox.exe	91
PID 1928 wrote to memory of 1608	1928	firefox.exe	91
PID 1928 wrote to memory of 1608	1928	firefox.exe	91
PID 1928 wrote to memory of 4840	1928	firefox.exe	92
PID 1928 wrote to memory of 4840	1928	firefox.exe	92
PID 1928 wrote to memory of 4840	1928	firefox.exe	92
PID 1928 wrote to memory of 4840	1928	firefox.exe	92
PID 1928 wrote to memory of 4136	1928	firefox.exe	93
PID 1928 wrote to memory of 4136	1928	firefox.exe	93
PID 1928 wrote to memory of 4136	1928	firefox.exe	93
PID 1928 wrote to memory of 4564	1928	firefox.exe	94
PID 1928 wrote to memory of 4564	1928	firefox.exe	94
PID 1928 wrote to memory of 4564	1928	firefox.exe	94
PID 1928 wrote to memory of 4564	1928	firefox.exe	94
PID 1928 wrote to memory of 2744	1928	firefox.exe	95
PID 1928 wrote to memory of 2744	1928	firefox.exe	95
PID 1928 wrote to memory of 2744	1928	firefox.exe	95
PID 1928 wrote to memory of 2744	1928	firefox.exe	95
PID 1928 wrote to memory of 3812	1928	firefox.exe	96
PID 1928 wrote to memory of 3812	1928	firefox.exe	96
PID 1928 wrote to memory of 3812	1928	firefox.exe	96
PID 1928 wrote to memory of 3812	1928	firefox.exe	96
PID 1928 wrote to memory of 6076	1928	firefox.exe	97
PID 1928 wrote to memory of 6076	1928	firefox.exe	97
PID 1928 wrote to memory of 6076	1928	firefox.exe	97
PID 1928 wrote to memory of 6076	1928	firefox.exe	97
PID 1928 wrote to memory of 4452	1928	firefox.exe	98
PID 1928 wrote to memory of 4452	1928	firefox.exe	98
PID 1928 wrote to memory of 4452	1928	firefox.exe	98
PID 1928 wrote to memory of 4452	1928	firefox.exe	98
PID 1928 wrote to memory of 616	1928	firefox.exe	99
PID 1928 wrote to memory of 616	1928	firefox.exe	99
PID 1928 wrote to memory of 616	1928	firefox.exe	99
PID 1928 wrote to memory of 616	1928	firefox.exe	99
PID 1928 wrote to memory of 2916	1928	firefox.exe	100
PID 1928 wrote to memory of 2916	1928	firefox.exe	100
PID 1928 wrote to memory of 2916	1928	firefox.exe	100
PID 1928 wrote to memory of 2916	1928	firefox.exe	100
PID 1928 wrote to memory of 3192	1928	firefox.exe	105
PID 1928 wrote to memory of 3192	1928	firefox.exe	105
PID 1928 wrote to memory of 3192	1928	firefox.exe	105
PID 1928 wrote to memory of 3192	1928	firefox.exe	105
PID 2688 wrote to memory of 2424	2688	Setup.exe	110
PID 2688 wrote to memory of 5252	2688	Setup.exe	112
PID 2688 wrote to memory of 4844	2688	Setup.exe	114
PID 2688 wrote to memory of 3176	2688	Setup.exe	116
PID 3176 wrote to memory of 5124	3176	cmd.exe	118
PID 2688 wrote to memory of 3736	2688	Setup.exe	120
PID 3736 wrote to memory of 4928	3736	cmd.exe	122
PID 2688 wrote to memory of 3776	2688	Setup.exe	123
PID 3776 wrote to memory of 5252	3776	cmd.exe	125
PID 2688 wrote to memory of 5032	2688	Setup.exe	126
PID 5032 wrote to memory of 2524	5032	cmd.exe	128
PID 2688 wrote to memory of 1888	2688	Setup.exe	129
PID 1888 wrote to memory of 4568	1888	cmd.exe	131
PID 2688 wrote to memory of 1216	2688	Setup.exe	132
PID 1216 wrote to memory of 1856	1216	Y6JAerwKt.exe	133
PID 1216 wrote to memory of 1856	1216	Y6JAerwKt.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\sample.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\sample.html
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {758c423b-00b7-4ed2-a086-9ae7fe89600d} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {980a1d79-3ecf-42d2-a419-8941b9c102ff} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27274 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {611ca4d8-a3d5-4b3d-a1a6-7370c7b6c21e} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27274 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {db144ed3-1644-4bb0-841f-d59a1b8d767b} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34773 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3256 -initialChannelId {766ec7c8-9bab-4b70-9842-013fd91da9fa} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4488 -prefsLen 35010 -prefMapHandle 2908 -prefMapSize 270279 -ipcHandle 5056 -initialChannelId {7cd22217-84a0-4d59-9ebf-1afe45447fcc} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4884 -prefsLen 32952 -prefMapHandle 5220 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4864 -initialChannelId {cdb00b8f-4d62-436d-b551-cf79c19c39be} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 32952 -prefMapHandle 3912 -prefMapSize 270279 -jsInitHandle 3916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {2eb7d350-e732-4951-b3e2-6c615a5dc34d} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {3ee73d30-0394-4975-b4c0-c0e7d6762a42} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5948 -prefsLen 32952 -prefMapHandle 5952 -prefMapSize 270279 -jsInitHandle 5956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5964 -initialChannelId {3cabdca5-3327-462c-9e8b-2b5faeb04bb8} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32952 -prefMapHandle 5992 -prefMapSize 270279 -jsInitHandle 5948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2836 -initialChannelId {d130cab8-1ff5-42db-b9b7-3b15cb87d1d9} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1632 -prefsLen 36766 -prefMapHandle 1636 -prefMapSize 270279 -jsInitHandle 2628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2692 -initialChannelId {07b7a2b7-0ba2-46b2-b5dc-761d676a8936} -parentPid 1928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3192

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:3568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3816

C:\Users\Admin\Downloads\Mineral.Mining.Simulator.Build.23819184._Archive_get_2860\Setup.exe
"C:\Users\Admin\Downloads\Mineral.Mining.Simulator.Build.23819184._Archive_get_2860\Setup.exe"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4568
- C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\Y6JAerwKt.exe
  C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\Y6JAerwKt.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\ProgramData\KernelFor.exe
    C:\ProgramData\KernelFor.exe
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\80q9D66iZ4Z2wycm1PN6L.exe
      "C:\Users\Admin\AppData\Local\Temp\80q9D66iZ4Z2wycm1PN6L.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\is-DA9CK95C0F.tmp\80q9D66iZ4Z2wycm1PN6L.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DA9CK95C0F.tmp\80q9D66iZ4Z2wycm1PN6L.tmp" /SL5="$A032E,20063369,854016,C:\Users\Admin\AppData\Local\Temp\80q9D66iZ4Z2wycm1PN6L.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\80q9D66iZ4Z2wycm1PN6L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\80q9D66iZ4Z2wycm1PN6L.exe" /SILENT
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\is-9IDJ43VHUY.tmp\80q9D66iZ4Z2wycm1PN6L.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9IDJ43VHUY.tmp\80q9D66iZ4Z2wycm1PN6L.tmp" /SL5="$B032E,20063369,854016,C:\Users\Admin\AppData\Local\Temp\80q9D66iZ4Z2wycm1PN6L.exe" /SILENT
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\is-F9PBADXW3U.tmp\PiatVBullNayApp\App.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-F9PBADXW3U.tmp\PiatVBullNayApp\App.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3732
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c mode con cols=1 lines=1
        9⤵
        
        PID:5164
        
        C:\Windows\system32\mode.com
        
        mode con cols=1 lines=1
        10⤵
        
        PID:792
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic computersystem get model
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4864
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic path Win32_VideoController get Name /format:csv
        9⤵
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        
        PID:2976
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /format:csv
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4868
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c "powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width.ToString() + 'x' + [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height.ToString()""
        9⤵
        
        PID:5368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width.ToString() + 'x' + [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height.ToString()"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1212
        
        C:\Windows\SYSTEM32\ping.exe
        
        ping -n 1 twitter.com
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3344
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic computersystem get model
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2388
- - C:\Users\Admin\AppData\Roaming\webtracer\Crisp.exe
    C:\Users\Admin\AppData\Roaming\webtracer\Crisp.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5476

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5344

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3704

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KernelFor.exe

Path C:\ProgramData\KernelFor.exe
Size 520KB
SHA256 5eadad376b3e1b89009e10892f2a159063192807a71e51f03ea0f8cf19879480
MD5 6bd363af52c2a8251561380fa8f6a1f9
SHA1 0f4b97d44a69aacf41ff96eff84a45703166dce5
SHA512 694a084c92ed2c6813a1e80a59e843cd9d609edd8c62d8e2c021864c0e6958ffc8fd4fa3806288aa0b5c02046e2384fc2c989e557a1f995eea6b424d5d837a13
SSDEEP 3072:l0gnSQXkjUmM09VAg4cr+3BdacjzNi9Rksi2ZPprA+JmSeJD5UFo+jnMgpQ3hcQ:l0VnjVARc63B8zXThNi+JkH+DM/3
TLSH
T12FB44AF73EDE48A5D7637375A852C9F185216C310AAF93CE16533B2A7A323704B2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6e0eec48f718e8ea53f8dc5efaf99051fe1cb3f5fcb7f3ae8d543bbdb573a120
MD5 601dbe36126b29844297b45e7761bc9e
SHA1 48c435b30c72bb23506c8a3c978a2d297972fe9a
SHA512 039f46547b8870109d58453040713d9b04014bb3926b9734fd83c0a7966405f51edff68eafaebfe469490a3bc3e9893e236eda6bda0fa64bdd4003fe90f6ad66
TLSH
T1F5219837F3DC8214CCA9003A10DDAD0036B6C7DB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0d3208b29d28aef4cbd5db15d29335ecaddfd5f353ae22a749b71d3d168ce9be
MD5 fd8d922f3a7793c8540fd6df1ac090a4
SHA1 c8b20e93ba66bd283ea186e2eef8474471e1c3b7
SHA512 cdd4a95cd51a05f0c704d4db779ba9dbe7733d9af2d89d48cd37fa0c9a6340c69148b0f8518550e1062ee036f01481bee0026e14a5c3e34ad33efde42567d743
TLSH
T176317437F3DC8611CC9A013A10DDAC1036BAC7DB90DEDFAB6B80E255A92F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6e16227b3500f394209af194e0da70cdfaeed11bdcc6597ca2c5f61b826af66d
MD5 319965c8c4caa03b20e36f417e8ad4e3
SHA1 cb8fdacbe5eb299eb20d099e6c17457df87d8605
SHA512 dddcab4bac992c46570563cf13d237c562d5b1fccfdf9408557cfd0af4d8b9b8caf2717073d99eaa0fa916f2708cbeb3a881558442a6aff9e186697a3755b90f
TLSH
T122219837F3DC8614CC99003A10DDAC1036B6C7CB40DECF9B6B81E159A42F298CF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e4e5bfb7eabeda646aceb026069e3538244680d354dd2b765766e28bebd1dae2
MD5 15e6e9d2fce6c50ff2a2a981846f0711
SHA1 0c8c7d1392ecc4307af4b94780e991d89b885e30
SHA512 94a721840c82cbbead8a6d88ba73046dcb9caacbc1030f91e08360a1af1f50944c6a1c6d33483b16b8a7d81f8824ca3826d44b70013088e520a5bc7361077272
TLSH
T175219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\activity-stream.contile.json
Size 4KB
SHA256 036321bffb7d6e0cf9bcce45f1aed50e2206c5e5d5f8a7acff6086447fb4e966
MD5 a8f817b3371519e609141804d2d27797
SHA1 3d1f96c858e05bc1373509bd9c85bcc241cc79ef
SHA512 a43a7e8adacc93e0277c973e7e82c4b7680126754fe93391517e25125ec67dd4e511426c7116be06dca612f867948180bdeafa518c995f158ecb3a9c583f44fa
SSDEEP 96:TXe38DYDJe8VWzlYWT+mRSwHKYmc4znF6D8gol:yUce8VWzl8mRSwWrRw8gol
TLSH
T10FA1EAEBA869DC530332FBE07C053759F116E29BDBE48D45BAD19802A4E91BF40ED584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 6bad6d79d1a1d6e5ac0a4874ced3bb9ad7330daaa0e11690df8484bc2241a427
MD5 ff695b939227fb87da2f2a5ac6505b47
SHA1 3e81f7781ebcb5ff2cd4f4644a80ff0bfda8d3e0
SHA512 59517945ebef0672aecda22911e0b6129b1cea4e800dae59e576b528e00345e0a7c321805d7349bccb7a7e1beb92748e4d84b4e60e3c36ca525a663634f6ab85
SSDEEP 384:HPC9iO024Yco6J+Sl1xDnZBPsac4j0lpDII+a/yvT/yvQv:v9ZYco0+Sl7zZlsac4ID8LoyDyI
TLSH
T1C4529DBE9F0238BA1927E1A5D5FE9244CD04E6BFDEE2905619143C04CA447B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80q9D66iZ4Z2wycm1PN6L.exe

Path C:\Users\Admin\AppData\Local\Temp\80q9D66iZ4Z2wycm1PN6L.exe
Size 20.3MB
SHA256 5751c8a858d5b9b7054b3354853da3780fbc0765d4eb26b8f9eaaa1cb9555037
MD5 0a3280b1b5773e398a5caa6c79f5319f
SHA1 40037baabaace8646617bb74036efb575389a6c6
SHA512 57ded76d466b8901d643c2aede05248a1c03b07ac0cb8b5b76fff40365228d6b14add8a4e0e0acc81957d292e28c787e5ab09bc35419378b1c43e76cefa178bd
SSDEEP 393216:Hqr5wR+v2/+6cfVoAmS9FJJ75PNKZk2geumxvZaYLl+g4/EXJeVy:g5wRfcdoAmSFbNNmHxvEqJWDE
TLSH
T185273333B289753DF06A5A350A72E260583B6B616D178D5E87F448ACCF355B03E3AB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91AA6B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\91AA6B1.tmp
Size 1.6MB
SHA256 0331882fb8b5b3bcfeb3201d25fe9ac653cd3158c77688d12eeb63f88ee5956f
MD5 e441c32a0cace23a08ddb6abf2e33c2d
SHA1 8cf52f68ac1a826b42ae6858eb96c6433747d617
SHA512 d700d74fb3dcbb993dab57b22eb3cf212be8e2e41a37561aa28a4403af87b2098eb163c64703a712243d7ae6222071034caa95962a5121958da0cde21f7d05f4
SSDEEP 49152:l99EzOFBKWxfLOvcjcCr9wknTtgoHFarw:l99qA7LRwknuoHFarw
TLSH
T19A7533632F92C4E8D86941FA9FD82B88350B01DAD393025D15B87E16DECD9D7D2B390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91AA6B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\91AA6B1.tmp
Size 1.6MB
SHA256 2e2a065161fae31403d40794b58205573a9a590b05382437fca318e2bb42ffe4
MD5 6f289320302871b18cc5e523514b8b56
SHA1 cd82dba552303c7525aab6d3b3b20648a1913aa9
SHA512 abde457b203b3b721d80b9a58b7a397bd341bc3e72db55135b1f8ffe8371e1b94254638eea747bafc76d0ab8423c570d11ada7da9e648d32a4114e55bdc9f7e2
SSDEEP 49152:t99EzOFBtWxfLOvcjcCr9wknTtgoHFarw:t99qAULRwknuoHFarw
TLSH
T1D77533632F92C4E8D86941FA9FD82B88350B01DAD393025D15B87E16DECD9D7D2B390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0AD005.tmp

Path C:\Users\Admin\AppData\Local\Temp\D0AD005.tmp
Size 40B
SHA256 91460cb5e82b8efd824f5a262ee1352efe9a49551463d45524ebd5574a0c2514
MD5 6eaa42b891f5f7990c9226e53097dfaf
SHA1 fb78c9d3ec2c315bc2714dcdacd38cfea70d2703
SHA512 958c28cc979b015823339434b2e9c9ac6f51d6180328f84eb925f38aa65a1c5e6bf2a7cd8be87b2f821dd2c5aa10f70fac57d6de733817fc858bea5265e88f10
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_anemyc2f.ogt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_anemyc2f.ogt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-8RAWVEXSQI.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80q9D66iZ4Z2wycm1PN6L.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DA9CK95C0F.tmp\80q9D66iZ4Z2wycm1PN6L.tmp
Size 4.2MB
SHA256 41e76e75583bfa5cd9694d78dfb62f839766657d938cc9d491204246e7792910
MD5 c0940cd559f16e81d85c30b703496384
SHA1 c271f874800dfc838a1bd2638e5c62e29c812235
SHA512 c203ea25720e9a3bac00d93b5eeebb75d80338a5597de445da9f31152b4eceaefc6659e0285a0a63658ff94af67e3b520f79c747927193aaf27b91da951aeba5
SSDEEP 49152:GeGyzK5YtS9+SmpPvOwUNSdi1F9Nllz+mTslXkUE/2+X9lHuJBP4jF333SP:GeGwK5YHCNmi1F9NlJ+mwvE/2+BJ333O
TLSH
T190167E13B348753EE4671B3A483BA694983F7A213A16CD4B7BF40D4C8E39640BD2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

App.exe

Path C:\Users\Admin\AppData\Local\Temp\is-F9PBADXW3U.tmp\PiatVBullNayApp\App.exe
Size 35.0MB
SHA256 845e63614750c74ed660974b8c5050a8e30cd586b1586052b7816c7fbfb3be4a
MD5 19d44afbac996a2d528e97681a67a222
SHA1 10092d2fc9da961eaa7be022c7735ad5a0da43bc
SHA512 c23b57da2409c876a933b775d45e800f71b3e84b6237d5d58a10a37aa0d60805bacd526fe034c1caaff94452ac85d67974fbfdf2e3e542d88280866776ccabd6
SSDEEP 393216:79LzGRBc9Z5P7UspbZD2VcoYT4m7zpUwYz0aFeSarNgL:ERBc1UsHv7zpUwq0aFeSgG
TLSH
T19E876C67EACA10D8C89F417C89D98673FB36345182308FEF854989735E27AE0D72A3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\is-F9PBADXW3U.tmp\PiatVBullNayApp\VCRUNTIME140_1.dll
Size 48KB
SHA256 26e470b29bed3d873e0c328186e53f95e9edbfe0b0fd0cda44743a0b1a04a828
MD5 05052be2c36166ff9646d7d00bb7413f
SHA1 d8d7c4b322d76e3a7b591024c62f15934979fe40
SHA512 0460cc66d06df9a2941607473f3eccfd909f2adab53a3328fadcedd1b194b388eca738c2c6c2e193de33606925fbed1fe39efa160015128e93f5e3a03c62170d
SSDEEP 768:qzzO6ujT3MbR3v0Cz6SKLq83yN+iRxw9zv6JmEpw9zF:3q/o1j3c+iIzv6JmEp4zF
TLSH
T181236B9417784482D4AB99B0C0DBEF577D7CF6964750A28F0BA0D1981F237D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\is-F9PBADXW3U.tmp\PiatVBullNayApp\vcruntime140.dll
Size 79KB
SHA256 3646d73ebc95ffb2883c61a10664be1bec052e9a0dbc730dfd5f7f84efe98007
MD5 354555bbe91f4f8540663cc958ca81dd
SHA1 896d0aed4e25c8277587f6831fcf8bbeb6b4b3d5
SHA512 791c83caa166d6a4911f5a8e681f25e83b20d85f132ff2f265a29c4dac47bb38cf79c78121fe36271c11fe10f683958c007641cf6b5b0cad1eae636f21cf71df
SSDEEP 1536:IcRpay2YBygTYKCnZIE9LRzppGuYDPgecbtGglKoz8aaAz9:IrwBnUzppGAecbtooz885
TLSH
T17F836B4A77B48292F17AC13CC4628987E278F54193B097EF13E547A91F837D28B3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LoggingPlatform.DLL

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\LoggingPlatform.DLL
Size 679KB
SHA256 996174e56b67ac70b4615569a7fa16f1abf9e7a75666490e4f090da17c2dbc50
MD5 ae2039ae5b6731b6b18b3612e0b61429
SHA1 5d1138ac0ebeb2e78d1876e016292c4b6bd1c3b3
SHA512 aae1d096ecf6693662f67536a98ff739f089d12cc8475b786d7c68cb5532814b44190f22fd45023b47f442023b4fdfe4c210454d727ccbc4cca504fbf7e71d72
SSDEEP 12288:ZPQR8v+FozH+VJTDfAqybaJc9dw07iUpU26R9K6s4b:ZPHv+FozSTDYZA2dw07iUpyR9Kcb
TLSH
T1B5E44B1BA2A801A9D5FAD1B98E674417FBB3BC154722D3CF02E192590F277D89B3B710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateRingSettings.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\UpdateRingSettings.dll
Size 687KB
SHA256 c7b2e8e7b78d1b2b24082e89ce40468be748853526f95e8b9285c03adc959230
MD5 7d4ddfae9553acb0216fa70375ad8cec
SHA1 51a7d85c228582807b1a80efbdaf7b8d33aff4bb
SHA512 49dfa8dbfe5245bc50cf05f4c2c5055852181f25dee1ee0353c3ca564c777a1c6b26c822ee46756913e60115f4994948ca0ab9708ad704d37cece2db4ff5a93a
SSDEEP 12288:ARJP79SbbC+7qjJx8UbvbvW0qRROBu1ryxOO0y:yJP79SbO+7qfTqRcBu1ryxOO0y
TLSH
T1A2E44B1AA7E801A5D1FAE1B98DA74517E773BC154B22D7CF02E0825E1F237D0DA3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\VCRUNTIME140_1.dll
Size 38KB
SHA256 4ccda624528ddca85f970719e1e28f420ee61ab3883839390c81367f56a2b832
MD5 67d14e2c32c300f082165f29803074c3
SHA1 191971d4c1408a6216f5a0ceb2d66d01ea09477b
SHA512 1beb9e0384b06a00927841578e74b70179969c19f39796e494b18866a21f2fde0231a28b0123eabe33a31eed336d640bf78e81629c4d6702c293a2f2c5c78661
SSDEEP 768:xzzO6ujT3MbR3v0Cz6SzVq83yalbO9K9zRJ:oq/o0d3vly92zRJ
TLSH
T11A034A5067784086E1AB85B0C4D76F57BA78FA554B40938F0BA0918C2F62BD4EB3E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Y6JAerwKt.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\Y6JAerwKt.exe
Size 3.7MB
SHA256 1d54860d3589444d09cb5bc7f814651fe636b7a4373606a6a90b3ab94ac90795
MD5 d6d4d4e9e310998dd53c532309eb338e
SHA1 b5971bc69818ad874d54b51488be2f015f1cc05d
SHA512 da2a60f001801081f0a47914cf2799ee96fa2d5f776e34a6bfe9cda373bd1d758feb6f6eb7edd62971602b1716b38c788277ae9f0abcae454d032e3d0a5440a1
SSDEEP 49152:Qsa6glaW9Qe+ZUhWHPrAbF9Xf8w37rVDPCcsiPXvmTsIrJVj:Y3v82POZJd
TLSH
T14C065A17A2B900E5D0BBE1398A97951BFAB2785A873197CF4791471A0F237F09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cachedev.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\cachedev.dll
Size 1.2MB
SHA256 8606e5e2efdfe630dc5bd663bae0a39b4745f41273a5f7a8fcb572e968a0c052
MD5 b2f0be3103414406a0b5a42b4f2c4dbe
SHA1 bbe2795dda82e11880c6b56dd20fd5c38bb2fd31
SHA512 8ba2c7bc3143a9a9c3870e80f92f4e05396f2ccfe118d33db309665c95dbaa813505aaf0949570da6f67120b6ef5e808f49f9b21efd6f5364bd33f479e0e947e
SSDEEP 24576:DEs+o0ZHt3tm+U1cLaKoHH/6Nrg6yyTwUEWkFziuU/:DEJo0/3O1Aa6Ndx70lU/
TLSH
T10445237736C3E100EFF348FA7993F7801B616957BDEC127296C0A608331F28A95E56A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\msvcp140.dll
Size 552KB
SHA256 ee3f89e8460f9b2a27bbe9b716f951e02b6469d49dd3c4b7d8d7dbadee1232ea
MD5 6c494bc65021c075ed6822224e7ffc15
SHA1 417baefc7152c683250dd89a03deecc692073e98
SHA512 bfb38790f28d0526ada2c08cf3a8ffeb17d99bfc752648fd953ddb9d060a09037b1a2000bdd03dc6fd11d1b315376fb778529ecc1fe39800c0754ba9c68860bf
SSDEEP 12288:r9zqgpPAgLqMpP85TAfvULhNaYv0ndIgQEKZm+jWodEEVhk:r4wPrALhAYvVgQEKZm+jWodEE7k
TLSH
T117C40923B74905E0E195E3B891878306D7F1BC4A8312A3C792FB969D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\msvcp_win.dll
Size 621KB
SHA256 2a7825c2925347e0cb767a0dcb611f3eb80d0f71cbec981069b227bdc7cb871a
MD5 ec9f1cdd909f7c0bae4db21dcd2033de
SHA1 4c2a112e048fc75cd4c581836356e881552c9be2
SHA512 924022bb40c542a3ff0d09da35b8156113a83336d57924888d921f070f6192d83fcec6b89bde89957731e55e41118ca2affeb5885541bd345da7857996c22fd5
SSDEEP 12288:KXTCudddboDSf8I+YQtAww7ZQEKZm+jWodEEVM6LZWPn:KXTC/Sf8IdQKQEKZm+jWodEEq6LZWf
TLSH
T1F9D42A26BB4D06B0D166A3BCA1C38706D7F1BC154722A3C7429BE26D1F6B7C56B3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mutex_alloc.bak

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\mutex_alloc.bak
Size 11KB
SHA256 edd4a67b833426db681465ea970a5e2f25a8c1db91dbbabffe5bfb540b6ca1ca
MD5 a6d89ae20dd50bae2c3b66e80b696137
SHA1 2b855d2c2e95a45012bf46e351261fd83f1d9c86
SHA512 10b503367657f3420c54208f4ccf5e731a0e44d333dbfac83c46abc98815199a9b11457f6901c077f95736bbff665dc258cebdd86d54d0d0351e99f7ea83a4d5
SSDEEP 192:IhYdNphbtIydoKMEnaN1ytr+Hzidl5dTfGoyhHmsDIlZUw/QD:FzpINK1W1ytrBvdJgDIlaWQD
TLSH
T1FA32F6CABEEBB8335F1D4020AE15B61ED3618321790B6D2187705FC6A6C7A89DC11D2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\ucrtbase.dll
Size 1021KB
SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
MD5 4e326feeb3ebf1e3eb21eeb224345727
SHA1 f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA512 be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67
SSDEEP 24576:L1foGwlaDT22+Pk+j2ZXCE6cctEMmxvSZX0ypCD3:JfoBR2+PfXWrT
TLSH
T1F725AF64FA5C0AA5D57BE17CC95B550ED5B2780207708ACF03EA4BBD2E2BBD91637320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\vcruntime140.dll
Size 107KB
SHA256 26a4ba571a0ab391c61ae0182e481469e85e4d43a31bfb202bb653f0ce1f7c62
MD5 3adcc240dca5c9fbc5f2f2ba83deaaf2
SHA1 5118fddee7b4efd996562a2dc787b7d9c719bdce
SHA512 61716878f603d7cdcf3fe33f959bafeb5cbf1490ff2cbb8ffc0fa6ddf97bbe930f8df716f4270adf547eab880cf6af5142828393dc5778471c1a955ff82104dd
SSDEEP 1536:09TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaPXoecbdhUogAJXFbvzTH:0EnsvReGsWyxLizXFQecbd1gAJX9HH
TLSH
T1D4B36B4672A042FBD16AC279C1A31A16F775B84487B0A7CF03B54A660F53FE09E3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-01611-6k6mWjoZnxBc\vcruntime140.dll:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z2YB1MWKKEY6N7OFNZR1.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z2YB1MWKKEY6N7OFNZR1.temp
Size 13KB
SHA256 c1f4fc7eac30024b58f12f51c0d2b384db2601426b6eceae61e84a109f09e708
MD5 b46b278d93dde91c2a709cae45e8ebeb
SHA1 289c144ba9aac180adc6460370b335bdad548e04
SHA512 275a50be97ba0ef924bbcab11f19846b9c1609426725ed4a034279406c2894415ecd16bc90429f2388508a1575f62361396022ddf9228bced9afb6f874487ab4
SSDEEP 96:aWOWezn/5WedR/pWeI8PmRUyqWe/d8PPhRUyHzRQWe/d8qQx9O/We2A8pSvWez:l45/fPUQePnNGeppppSz
TLSH
T18B520E020BFB1769F4F3A7313A71376656B3BE01A62B871DC1959245483336086B9FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\cert9.db
Size 224KB
SHA256 5f962db6281b738b7914134c8886f9712434ad54c2eef079295ec53baf614a3e
MD5 5fd7a75fe39079b4f330b3ccfb433eb3
SHA1 99ca2fbf8dcc406f0ccb765616bb88119d9d7cae
SHA512 a291654972a2956f6dc330fc50a78c6017407294adf274273abf61f41d3e6d098969739c261f5a2cd5cb2602079b763438ecb1d4bef38e0e5dcc0f13ab00f7f8
SSDEEP 192:zOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vgFHaRPNnKoP70M+:K1zkVmvQhyn+Zoz673cPVPQf
TLSH
T194240EC2F820745ADF8A6D31B662DCF23D7627414385A422CE289D3F1D64A1F67A68DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 d8c87d100608125e0b918e74d3b224832d499969c6e09b27d1260aabd098af17
MD5 fa61bde19fa8479627081d4d315cd491
SHA1 85359d71b208f1cee2c2f8d438284299e95bf9d5
SHA512 6c9c247d60d4642e568147acf00e216f1fe00b783c3860b07676484354c670d4f5eb69e782fe97143e2c8b623ae5114c360fe0a3ee4946b1e07b3225c1a655c3
SSDEEP 1536:O9BsVaFz/FQwgG3mtLQnPUYemXMUJjZbqY:O9BsyLSwF3CeHebUJlbqY
TLSH
T14F630244EB1E553FD82802BA9C921B143F79F8894A1A2FAB375C54782C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 1eb1eaf7bf8d0f1533d42cac6acadd0d56d48d08265f607d3f854c1bb0ac8464
MD5 798def4cd8f118fbcb61a5a3f0d29745
SHA1 a25a55eb37913718942c53e96a12713f9ae7d814
SHA512 9fe2570b17ba66380ed6ff6a7e4483f257cd4a363f2dc19135773e6fad37254f1e2cce2a98a22ae7d6c0aed7f8c881b96b09162d1a2c0256db1ab249b3170fb2
SSDEEP 1536:D9BsVaFz/FQwgG3mtLQnPUYemXMUJjZbqr:D9BsyLSwF3CeHebUJlbqr
TLSH
T113630244EB1E553FD82802BA9C921B143F79F8894A1A2FAB375C54782C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 22ca04bd12569fe682d23198c6a82afdb63c6d165307f50831df1b40c0f9b65e
MD5 a93543050114cd22075c5b5311f2ce89
SHA1 8912920b7fcbac3b7e287692b587aa777c710ef7
SHA512 8a7be295ab70ed86bbee5d0694e5219369957545743dcea5cbaf35b84237b843c750727414bb6d1bd353456f795ae7d7c246eb4debfccf6ecc3d161653727fe7
SSDEEP 1536:n9BsVaFz/FQwgG3mtLQnPUYemXMUJjZbqL:n9BsyLSwF3CeHebUJlbqL
TLSH
T197630244EB1E553FD82802BA9C921B143F79F8894A1A2F6B375C54782C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 0284254eee99e40144e272605711bbf3b12660e2584a6b29aaf0cbda3d839955
MD5 30f0a3b0e6f4169f91c09a608c683675
SHA1 33b569c71993d8aaeea9e1ca52274366bca50c8e
SHA512 94652c349cc7cf2e25d91585f379374d760e9311dccfe97664f84f6cc53eba25a805304ded87da4c24f3bb666796f41dfba499920f09f24dee0096d2d80dca11
SSDEEP 1536:e9BsVaFz/FQwgG3mtLQnPUYemXMUJjZbqM:e9BsyLSwF3CeHebUJlbqM
TLSH
T1F9630244EB1E553FD82802BA9C921B143F79F8894A1A2FAB375C54782C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5cd954585e881ffcefd2c7624af509b62ccf474dbdbab36b2405103fb5c2e6b2
MD5 12deeebdfb672750a6aba6d7fa0faf9b
SHA1 3d7a2065bd1d825eb09a0147c89999f54c072780
SHA512 9a955a45e0627af509a6677a4209ac6a8a31b587a2c2ecd7fbfecc90cb5411966302b1e700c56650b5f13378eaa91e0c421c903f78eaa64c4a00f5dbb7a5c710
SSDEEP 192:l1d66JoztdzgCl6mc0dgOv5zbo7iMOCyjp+o:jd66Joz/zgC1jhboGMOCyjb
TLSH
T14DE10C64E628963FC418027BCCA21B454F76349A988E3F19359D704C2D5B2DE379E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 68c606601e2e6532fd9e001e2d06dbf46fa169fe920a6d04f3fd3829aae74e19
MD5 aca3f152e60a7444ddd92971e0164253
SHA1 93d1d045d37a0acf6da4ac63efb2783cd848cf83
SHA512 ac57901d610abfa005148e97b22abcfff7ba769827c1e5d53380aea47d6dfccd1c7c1c8d74f5cfa032a0f29ed51353efc7ea0b61999e5a0e225b71cdbfea7508
SSDEEP 192:o1d66JoztdzgCl6mc0dGOv5zbo7ibOCyjhx:Cd66Joz/zgC1jvboGbOCyj
TLSH
T14CD1DA28E739563BC458023BCCA65F400F76749A989E3F29319C305D2D5A2CE7B9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4e44fb9dd5d218efce90940e03cb2ef0081d9669fd07894773da67de010d91d1
MD5 6a7b043c57b2afb8c68bd719538226c7
SHA1 1c7a80c476164f333fcede20a3585cd0d5b5e098
SHA512 c4ca286f67399659f191bf442c5a6762177af88b27a7502caf0c0105763b406dd83a3c31f955fbd1cb6eb8e6bb3907b2f09258ad9a8f130da84326ee3a966744
SSDEEP 192:oOv5zbo7iZOCyjp+a1d66JoztdzgCl6mc0dz:TboGZOCyjPd66Joz/zgC1jd
TLSH
T187E11D64E629963FC418027BCCA21B444F3A389A9C8E3F19359D704C2D572CE379E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e081eac9b0d4bcfdc9ebd7084b4bcbdf51bc3c307fc2e577a5a7f0c1025eec1c
MD5 ef035f504468a35f80847b680cd44b4a
SHA1 b97132886af24401353f62b62bca51e72971fc42
SHA512 84eec6bae64b25e1a31b66968c67531eead2ed72904911d928cd594d93913aa816461bfc600204d214e5851a0efbafea49c18c7ccad03bddac2f4357ffc038e0
TLSH
T1FF21AF4C3AB88D9E58C7F65C745106CE93404E0B04575C8F0D42EF8DCEA1ADD316A539
MD5 SHA1 SHA512 TLSH

Submit Download

94608114-2a4e-4c9b-b51a-29f85eff7764

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\pending_pings\94608114-2a4e-4c9b-b51a-29f85eff7764
Size 2KB
SHA256 b2f52c08baf6dc4edf10ea3b6642401df5b3aebdaf76dcd8512b14398c22effe
MD5 10243fdcc496f081ee5c990cfb87d534
SHA1 03c255d28bc29c4ceced5d461a6a05885c8aa884
SHA512 91de54832ef67a79db5531749db152bc167af99d551a5a8c64f8e0ee563da0fd8dbb849c89fbcf211ad0ee1c89df40b701ae272c9b5b0786036f2f4aedb72f31
TLSH
T1D641535835789C3B8CDBF65D9082334E53A0DA4384C21D876D51EF4C8D9769E376A42F
MD5 SHA1 SHA512 TLSH

Submit Download

9e68b359-f441-4960-9ddd-af46872d1eab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\pending_pings\9e68b359-f441-4960-9ddd-af46872d1eab
Size 235B
SHA256 7da766dc8a1dd4d1c18c7aa5882c9731dcfebe433d93d7090f2e0d61a5e1e68b
MD5 e839eedfdd958e8a83faef7a9a8fac33
SHA1 8568e3048597c0fd9661ebe256418ac1a4bb2baf
SHA512 0d2b43e8efdf353c8a3620a2e4dfb407454406fb86db644c05d1d759796d62e095fa14812c1ffc9be4eb0ba911353a7914b04416a2b1d5eafd3b9729b996792d
TLSH
T11AD0978114D8232D09248F46B0E068CA71884C331860B810AA5100B88AFE9C882A1867
MD5 SHA1 SHA512 TLSH

Submit Download

a4410186-7c1c-4360-9bbc-3faeadf8d1ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\pending_pings\a4410186-7c1c-4360-9bbc-3faeadf8d1ae
Size 235B
SHA256 3a98959cb26ee5945752ccf96a7212a572c40141c4e8272e1c190ccfc1354e49
MD5 dc5d0fcc6716157d045e9452d1001364
SHA1 4d032aafc17326a0bd415a807b25858f0c424c67
SHA512 26c058dff92d9d9b76a174155e67ded03442890246764290e3bdff61e08f0c849d47b2d7650ca02e3b9a68a224873d71f2d25d08d27a55e4a70bb379b7ce10c7
TLSH
T1E1D097802888676C08200F03F0E0B8D630858C3390B4A820EE6640789AB9FE511A1806
MD5 SHA1 SHA512 TLSH

Submit Download

c4c97818-6f19-47af-ab35-a5f98b9c7e47

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\pending_pings\c4c97818-6f19-47af-ab35-a5f98b9c7e47
Size 883B
SHA256 fe25a48fa4cda64f51379b4fb08135cca046dd8dba64248ca1a8ee16ce80ede3
MD5 0e52cc86d222cb4b3d98601edfe9be41
SHA1 575818a2503e2d9397567de1d271176c1e55bfac
SHA512 54319413a4f9c2326600148895d70e3e9baed0214a8474511dc472076605e67ccea9155b2204e4a4d9bebe921a4df59e0d99407585502d18acf33dfc7a9deb80
TLSH
T132112350A630B9B2CCBC920BC595770687F87423C0CB52143DF15A180D3E60FA3AA60F
MD5 SHA1 SHA512 TLSH

Submit Download

ce751116-fd0e-407a-8fe0-a5b7144f7d0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\pending_pings\ce751116-fd0e-407a-8fe0-a5b7144f7d0a
Size 16KB
SHA256 78053bdff8ca5f4f69f4f7edcec1eb30cdf3eecfadb8e0a6d6422ff1117be59a
MD5 d24443775e17f17f44b3f0aefb83cf4c
SHA1 193f97f496c747796407f7c478717e3eed6a3bf2
SHA512 3b88a73e4af5cb8aeae3bf51da1df0a30f685925f605f39e76f192ec8831510d23b3c7221a3efa66c34cb9d7309a00fa2f28788b56b36fba2fec2b52436ae1ce
SSDEEP 192:jHghhoS5bJEuzb5TC74QQ1LyIrJ6qnELuwteWSWi/zxDEGD2Ywl148Ls7YBQcanF:rghhoS5bN35TVMK8TycwP4+3TAq
TLSH
T1B972C956282055BA8591E3A994F8BFC3E2F538CF4C419FCA9BF4BD0869DF05E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6b54480-64e4-4da0-8c69-536d5eb6a13f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\datareporting\glean\pending_pings\e6b54480-64e4-4da0-8c69-536d5eb6a13f
Size 886B
SHA256 cbc4cd31b64ff72a40ff3acea4128402d01c775eb1caa47e67262d89f9bd4d83
MD5 d98d5cda99d671041d817a6e74025f52
SHA1 0233afc1173a7969390aafa9cc2f0a66ae6040f2
SHA512 d265626697bbfdae05ab89f49ce88c51b1b993d512e999c747728e551745bdf263375e743c0a3718e425173415feddea3fd3e0c8b9b6a61ad8e536cb63fdb6ec
TLSH
T1211123419631BA73CC7C834B94E1BB468BE4B02380CB1A147D655A180DBF65F63B6607
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\extensions.json
Size 16KB
SHA256 311fcc84e655513d6216b658c692c5220684582805037b255eed1a0fc4342b79
MD5 97c7e5654a277fb75e118ce18e41bb43
SHA1 8155fb37f02f53d26596c8f7b6ff9e292bd34b99
SHA512 f14142639c2d2bd7542744fed9b92744d1812f711622341cd647b3fbbdbb21197bcbd246fc8de872daadde558fada0ecb0477b12754d50a285aa9f697683868d
SSDEEP 384:rkI4v9Umldvqx8dhWP94zz96o0L4HQL4PVL4HAL4H8L4H1O4hZ:YI4lRfCKXa4F6V4y4N4C424A4v
TLSH
T1A772421545048EB8294FA79AAA367E01C37D473B60845C78F4DD8FCC42FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\places.sqlite
Size 5.0MB
SHA256 8dd1d0611c07e54e8247998335dcfe952c0a2dbf7db0221a26d788e222ad1228
MD5 1212f22ffd3451d9896c8213fa78b8eb
SHA1 6011019fd4f65c775609de28140e116fdaaea168
SHA512 f1149be86d1f08ca00fd15d9e02d8ce0fb0b915f546520ee33dc30cfdfd85cbaf3956630adf2cbf62dc0a141de7399ed4e54f5b4db68171ec73a529a3bd4966f
SSDEEP 384:M8r54w0VW3xWYTP1qIQ/Rv4n3jSIcOt5dn01wFVl23b:rqVW3onnjUt
TLSH
T17036855F7A202050C4DAA232EDE36F14283F711686367B923DA4156D4DE0763B96DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\prefs-1.js
Size 8KB
SHA256 d094f2bc81da0d6ef703b5a4bd13142d6a8f7f46a125a40bef3a181cfd7ea16b
MD5 fe4ba083d8af12638fd2a235d25437e8
SHA1 4caa8539bd489dab27249ed91940a5abb323e97e
SHA512 f1695e6f4921ddaae50034c13041c5f35884c18e740d71297d58d68863870c606e7ed6e15256ca04b83bf7e7d383ea0318e3e694ff2d6c79d2d13a3ce8ae04a9
SSDEEP 96:xHtlNTUyNHqGqyFfHFAObzSeSSlAdv9jEnO/WRNNGkhBw88ZUaL08L4cn1t42:ZnARyFfHFA4SS4ORe+Bw88vLv
TLSH
T12E02F0385504CF7F64B6367D6C244D705AA2423B7ABF6CD650B988C5051CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\prefs-1.js
Size 12KB
SHA256 5ee9766d01cd499d5b5fd491ffeeb1f6d43454aa4b386d4291056a9a3f17a9c6
MD5 269acda29cc53508200bd42cb2843d10
SHA1 215c1aeea9e41ac25e308af62af7bd2c3f3b7600
SHA512 99e862db02ee54e7a2e1799ee80b7950207a43b196abd2eb0abe507d4efda6e26d14bd03df98aa4f12584065a5c1a00f1ecb25063efd6de9df12dab223f89a55
SSDEEP 192:ZnoCRyFfHFA4SS4xLReRObe7OBw88vsxB4RLm:IFQlREObewwkOq
TLSH
T1B442CA386440CB7F20B6327EBC254DA019A142277ABFBCD605FD89C2455CF6841F6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\prefs-1.js
Size 12KB
SHA256 6c0a6aadeff7b8a4cdcac31d7cda2c4ff515302eb7e7d5ec5de650182a8e4c32
MD5 81ad837c6ee6fd6d7262224bf115a4b5
SHA1 b9c177c5b3c086e7bc74cb5782e1878357ec2bff
SHA512 366d344430bcecb261333fb7f902a7af318003e69f7b828b01c378720ead6e608db2567d6da5b22ca3f4678ad21412c8d1b18d4c3b51d5410487f05e99ae9a0f
SSDEEP 192:TnoCRyFfHFAkSS4xLReROje7OBw88vsxB4RLm:WF8lREOjewwkOq
TLSH
T17A42BB386540CB7F20B6327EBC254DA019A14227BABFBCD605FD89D2445CF6441F6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\prefs-1.js
Size 6KB
SHA256 e0d81dadf293615719310a5bfe0cf241e946720c7e468b7361eb936c4111e060
MD5 16f5cbf66494c097589252ecea910775
SHA1 996a8c5b37ca85e007ef1b882b4cf26104a213c5
SHA512 0bd0111397e74bed8472edeedd059846588d79abadfd03161c78bfa5f423da0645de304db5b25916c41f400ac1c5141eb3a5a98f346549d1668270e759948eb3
SSDEEP 96:xHtlUTUyNHqGqyFfAFA1zSeSSlAdv9jEnO/HJ1Bw88u8L4cn1t42:ZCARyFfAFA3SS4vjBw88Z
TLSH
T1FEE10E789508CB6F64B677AC6C688831AAB2013B77BF68D750B544C8051CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\prefs.js
Size 6KB
SHA256 56c928b388275e7fffc507a8f7da5d3959457fe36969160441796cbfebb44576
MD5 d4062682bf4f51840bf2be09b62d4dc6
SHA1 233c151d94394cd8af683b4b3e4da3ca1ed62f89
SHA512 77f896feeab1e761d982055474b4e66e8e0835a2804e100c56330c119ff55ce7a6cc985bb7b2c76084454f5b2e662c0ebc2a55fcdbd3c44a47cff1f6b74f1f29
SSDEEP 96:xHtlUTUyNHqGqyFfAKZ1zSmOSSlAdv9jNnO/HJ1Bw88u8L4cn1t42:ZCARyFfAKZVOSSzvjBw88Z
TLSH
T171E110789508CF6F64B677AC6C648831AAB2013B7BBF28D750B544C8055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\prefs.js
Size 12KB
SHA256 3f995df611ada9ccc9dd198ee0211fdfda951cceefa1825ef89477ea977dbc39
MD5 f064658f083070519b25a0c00cec1e2a
SHA1 76212e55b8ff1675cad0da56025328806e0aaa65
SHA512 b63c03ea218d54253b9f42fc8acb1c3fe16752a95feb15df6cd7642b38cf493fb9957fbf924b6c05920e166a03afcbaa778e693ef4ccc2c67291e84bf57ffc28
SSDEEP 192:TnoCRyFfHFA4SS4xLReROje7OBw88vsxB4RLm:WFQlREOjewwkOq
TLSH
T1F742CB386540CB7F20B6327EBC254DA019A14227BABFBCD605BD89D2445CF6441F6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 eaa3ee7826f1dfc5b352bd3022a57346931214a4fd9b81d8a02b888ca7d38c8c
MD5 7d143729434c25390cdce06adba52d5d
SHA1 ca092ec261766a26fb6216162926985454ac5597
SHA512 c01e15f6267d6cd600accd98763650069579e76b533570e4af2dd600d31468e635cc63465bebd2fa1e1c3335bd3731bccb61eb443376649599094d34b516652f
SSDEEP 192:S/89Pf97mF1V0S0mhem+VB9WsQuXKe2Iz:SEVfAfFODdQGK6
TLSH
T185D18D8BAA8719AAF954372BDDB03ED48B2C70A1097387E4D2F5868C467F62D821114D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 85e7e800d73235e21281d4b01e27ba9b6fdd5f45dbc24840fdab9041c188321b
MD5 1b41082893f13e1d7697210bbdf877c4
SHA1 8cf6ee363cc24c99208f26f75354a0819d872919
SHA512 9e5c584b726d8fd74f4231863cad358fb53e6f8769ee3d85324e89409cf7cb5af9aafa1834a0cae782d7d65c6007b88ef3a5dd4db77508e39d466250e4d03cfa
SSDEEP 192:b/89Pf97mF1VbRmhZm+VB9WsQuXKe2IaTI:bEVfATWLDdQGKJ8
TLSH
T1C7D17B4BAD8329EAF9943B27DDB06E848B2C70A1043387F4D2E4868C463F62D821215D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3bbgqa3s.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 536ab90fc294eb3d67118063bab3bdc43db3f4042f7baa71290907d1b69fe6d8
MD5 bebe8c9fd8963993e77a09038b10da20
SHA1 813a91e8d76ad887a4bef226675e71a9fb9de5d1
SHA512 bf6fe2e991092d8fa9f62d4fe78137ce7934a10dae14250ac13ec29b14e5e3f4f709e9e78adba8b1db01fb8d04cfb2781181ad4a11571aa47e00e9e881444e94
SSDEEP 192:S/89Pf97mF1V0L0mhem+VB9WsQuXKe2Iz:SEVfAyFODdQGK6
TLSH
T1AFD18D8FAE9719AAF994372BDDB03ED48B2C70A1097383E4D2F5868C463F72D821114D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\webtracer\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-1062-0x00007FFD936C0000-0x00007FFD93723000-memory.dmp

Download

memory/1216-1066-0x00007FFD936C0000-0x00007FFD93723000-memory.dmp

Download

memory/1216-1072-0x00007FFD936C0000-0x00007FFD93723000-memory.dmp

Download

memory/1856-1089-0x00007FF7AB3F0000-0x00007FF7AB446000-memory.dmp

Download

memory/1856-1210-0x00007FF7AB3F0000-0x00007FF7AB446000-memory.dmp

Download

memory/1856-1207-0x00007FF7AB3F0000-0x00007FF7AB446000-memory.dmp

Download

memory/1856-1074-0x00007FF7AB3F0000-0x00007FF7AB446000-memory.dmp

Download

memory/1856-1292-0x00007FF7AB3F0000-0x00007FF7AB446000-memory.dmp

Download

memory/2536-1308-0x0000000000070000-0x0000000000150000-memory.dmp

Download

memory/2536-1322-0x0000000000070000-0x0000000000150000-memory.dmp

Download

memory/4224-1405-0x0000025517550000-0x0000025517551000-memory.dmp

Download

memory/4224-1406-0x0000025517550000-0x0000025517551000-memory.dmp

Download

memory/4224-1407-0x0000025517550000-0x0000025517551000-memory.dmp

Download

memory/4224-1399-0x0000025517550000-0x0000025517551000-memory.dmp

Download

memory/4224-1408-0x0000025517550000-0x0000025517551000-memory.dmp

Download

memory/4224-1409-0x0000025517550000-0x0000025517551000-memory.dmp

Download

memory/4224-1410-0x0000025517550000-0x0000025517551000-memory.dmp

Download

memory/4224-1401-0x0000025517550000-0x0000025517551000-memory.dmp

Download

memory/4928-973-0x000001FA7AA60000-0x000001FA7AB12000-memory.dmp

Download

memory/4964-1382-0x0000000000E70000-0x00000000012AA000-memory.dmp

Download

memory/5124-957-0x00000236DE350000-0x00000236DE37A000-memory.dmp

Download

memory/5124-958-0x00000236DE350000-0x00000236DE374000-memory.dmp

Download

memory/5124-941-0x00000236C5F30000-0x00000236C5F52000-memory.dmp

Download

memory/5124-955-0x00000236DE490000-0x00000236DE542000-memory.dmp

Download

memory/5124-954-0x00000236DE0E0000-0x00000236DE0FE000-memory.dmp

Download

memory/5124-956-0x00000236DE310000-0x00000236DE31A000-memory.dmp

Download

memory/5332-1321-0x0000000000440000-0x000000000087A000-memory.dmp

Download

memory/5476-1220-0x00007FFDBCC20000-0x00007FFDBCE83000-memory.dmp

Download

memory/5740-1383-0x0000000000070000-0x0000000000150000-memory.dmp

Download

memory/5740-1319-0x0000000000070000-0x0000000000150000-memory.dmp

Download