f0094335002d459fe45cfe3eadacb72ee33095cbfcb557490813f4cfa823433e

Analysis

user interaction
yes
max time kernel
899s
max time network
441s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
avast_free_antivirus_setup_online.exe
Size 245KB
Sample260702-rnbtpscz5k
SHA256 f0094335002d459fe45cfe3eadacb72ee33095cbfcb557490813f4cfa823433e
MD5 a51f80e7767f8015a444f12b7f837baa
SHA1 d6398d8520e2ffb2e1562a88b64cd58bac9c65fd
SHA512 b66b4681c798464c1b253773b6b8c17a046012edf1a5e4fe4d10e325c9476f343d55d64a4126fe97871085c35c801ed9558c7e601a002734284c880c4a90a12d
SSDEEP 6144:4rRG+16NMD16oK3bbLuaTBmmXQMeQXzVo5z:4rRxD1rK3fL/mC/JIz
TLSH
T121347C2275D08072F5B31A3019F88BB6983EBDB14F3484DF93945B6D1E30AD1AA35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware bootkit discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\Avast Software\Avast	icarus.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_online_setup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Executes dropped EXE 5 IoCs

pid	Process
5132	avast_free_antivirus_online_setup.exe
5152	icarus.exe
1220	icarus_ui.exe
6516	icarus.exe
6532	icarus.exe

Loads dropped DLL 4 IoCs

pid	Process
6068	avast_free_antivirus_setup_online.exe
5132	avast_free_antivirus_online_setup.exe
6532	icarus.exe
6516	icarus.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_free_antivirus_setup_online.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_free_antivirus_online_setup.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "823"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "0EC03442A4E93B807782D73BF46C389D"	avast_free_antivirus_online_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "823"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA8hSwcYkF50aHiPjMHOQz8wQAAAACAAAAAAAQZgAAAAEAACAAAAAQW11gDXsFoFl+20Aq0suPhCmimdUYguKC5xmDOF/ngQAAAAAOgAAAAAIAACAAAADM78cD/QflCoJRDQidCkS1ySwESxSK4EXOsSa1zg9Ow4AAAABlbmwOQQdswpR0PnXbJr/Y0aETnXerHdjbeD6CZMfZ5CswiMMz4m57oRMGSmUkn9aQaDs12CKoL5mdaY2huspa5O8T4gwWXNP/1T/r0yjnHL5vKlXCybvlaC9UtBoOHVkGTZWpJygK3n4eFuFvp1iSU6RmgwCqZtO136KQDskndkAAAAD1bw/FvfIOe0yjeJkNqfzYlhY/Y0JNOfQ6h7mL4TaIiolZtwCt821W0TqfE7XGLUmxVZ1n6B2tkMZkfDN0qTC5"	avast_free_antivirus_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "634ce783-002f-45e7-885c-66b190137571"	avast_free_antivirus_online_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{0ACB4BDD-6730-47D4-9348-CDD3E3FB6071}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "76"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "43"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "76"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "43"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	avast_free_antivirus_online_setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "43"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "779"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "779"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{36800842-115F-49A3-A213-6782A9F36E3E}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "76"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "779"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "823"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1220	icarus_ui.exe
1220	icarus_ui.exe
620	explorer.exe
620	explorer.exe
6452	powershell.exe
6452	powershell.exe
6452	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
620	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5152	icarus.exe
Token: SeTakeOwnershipPrivilege	5152	icarus.exe
Token: SeRestorePrivilege	5152	icarus.exe
Token: SeTakeOwnershipPrivilege	5152	icarus.exe
Token: SeRestorePrivilege	5152	icarus.exe
Token: SeTakeOwnershipPrivilege	5152	icarus.exe
Token: SeRestorePrivilege	5152	icarus.exe
Token: SeTakeOwnershipPrivilege	5152	icarus.exe
Token: SeDebugPrivilege	5152	icarus.exe
Token: SeDebugPrivilege	1220	icarus_ui.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5132	avast_free_antivirus_online_setup.exe
1220	icarus_ui.exe
4740	sihost.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
1220	icarus_ui.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1220	icarus_ui.exe
5876	StartMenuExperienceHost.exe
3152	SearchHost.exe
620	explorer.exe
3152	SearchHost.exe
3152	SearchHost.exe
3152	SearchHost.exe
3152	SearchHost.exe
3152	SearchHost.exe
3152	SearchHost.exe
3152	SearchHost.exe
3152	SearchHost.exe
3152	SearchHost.exe
7016	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 5132	6068	avast_free_antivirus_setup_online.exe	88
PID 5132 wrote to memory of 5152	5132	avast_free_antivirus_online_setup.exe	89
PID 5152 wrote to memory of 1220	5152	icarus.exe	90
PID 4740 wrote to memory of 620	4740	sihost.exe	96
PID 620 wrote to memory of 6452	620	explorer.exe	102
PID 5152 wrote to memory of 6516	5152	icarus.exe	111
PID 5152 wrote to memory of 6532	5152	icarus.exe	105
PID 620 wrote to memory of 6964	620	explorer.exe	106
PID 6964 wrote to memory of 7016	6964	firefox.exe	107
PID 6964 wrote to memory of 7016	6964	firefox.exe	107
PID 7016 wrote to memory of 6980	7016	firefox.exe	108
PID 7016 wrote to memory of 6980	7016	firefox.exe	108
PID 7016 wrote to memory of 6980	7016	firefox.exe	108
PID 7016 wrote to memory of 1508	7016	firefox.exe	109
PID 7016 wrote to memory of 1508	7016	firefox.exe	109
PID 7016 wrote to memory of 1508	7016	firefox.exe	109
PID 7016 wrote to memory of 1508	7016	firefox.exe	109
PID 7016 wrote to memory of 5628	7016	firefox.exe	110
PID 7016 wrote to memory of 5628	7016	firefox.exe	110
PID 7016 wrote to memory of 5628	7016	firefox.exe	110
PID 7016 wrote to memory of 5628	7016	firefox.exe	110
PID 7016 wrote to memory of 6516	7016	firefox.exe	111
PID 7016 wrote to memory of 6516	7016	firefox.exe	111
PID 7016 wrote to memory of 6516	7016	firefox.exe	111
PID 7016 wrote to memory of 4636	7016	firefox.exe	112
PID 7016 wrote to memory of 4636	7016	firefox.exe	112
PID 7016 wrote to memory of 4636	7016	firefox.exe	112
PID 7016 wrote to memory of 4636	7016	firefox.exe	112
PID 7016 wrote to memory of 6352	7016	firefox.exe	113
PID 7016 wrote to memory of 6352	7016	firefox.exe	113
PID 7016 wrote to memory of 6352	7016	firefox.exe	113
PID 7016 wrote to memory of 6352	7016	firefox.exe	113
PID 7016 wrote to memory of 4120	7016	firefox.exe	114
PID 7016 wrote to memory of 4120	7016	firefox.exe	114
PID 7016 wrote to memory of 4120	7016	firefox.exe	114
PID 7016 wrote to memory of 4120	7016	firefox.exe	114
PID 7016 wrote to memory of 7064	7016	firefox.exe	115
PID 7016 wrote to memory of 7064	7016	firefox.exe	115
PID 7016 wrote to memory of 7064	7016	firefox.exe	115
PID 7016 wrote to memory of 7064	7016	firefox.exe	115
PID 7016 wrote to memory of 3764	7016	firefox.exe	116
PID 7016 wrote to memory of 3764	7016	firefox.exe	116
PID 7016 wrote to memory of 3764	7016	firefox.exe	116
PID 7016 wrote to memory of 3764	7016	firefox.exe	116
PID 7016 wrote to memory of 2420	7016	firefox.exe	117
PID 7016 wrote to memory of 2420	7016	firefox.exe	117
PID 7016 wrote to memory of 2420	7016	firefox.exe	117
PID 7016 wrote to memory of 2420	7016	firefox.exe	117
PID 7016 wrote to memory of 6500	7016	firefox.exe	118
PID 7016 wrote to memory of 6500	7016	firefox.exe	118
PID 7016 wrote to memory of 6500	7016	firefox.exe	118
PID 7016 wrote to memory of 6500	7016	firefox.exe	118
PID 7016 wrote to memory of 3344	7016	firefox.exe	119
PID 7016 wrote to memory of 3344	7016	firefox.exe	119
PID 7016 wrote to memory of 3344	7016	firefox.exe	119
PID 7016 wrote to memory of 3344	7016	firefox.exe	119
PID 7016 wrote to memory of 5104	7016	firefox.exe	120
PID 7016 wrote to memory of 5104	7016	firefox.exe	120
PID 7016 wrote to memory of 5104	7016	firefox.exe	120
PID 7016 wrote to memory of 5104	7016	firefox.exe	120
PID 7016 wrote to memory of 3056	7016	firefox.exe	121
PID 7016 wrote to memory of 3056	7016	firefox.exe	121
PID 7016 wrote to memory of 3056	7016	firefox.exe	121
PID 7016 wrote to memory of 3056	7016	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe
"C:\Users\Admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\Temp\asw.3dc39437bca4f4c2\avast_free_antivirus_online_setup.exe
  "C:\Windows\Temp\asw.3dc39437bca4f4c2\avast_free_antivirus_online_setup.exe" /cookie:mmm_pwn_ppi_008_519_n /ga_clientid:63e67edd-4826-4846-968c-18ccaf4cbe2f /edat_dir:C:\Windows\Temp\asw.3dc39437bca4f4c2 /geo:GB
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\icarus.exe
    C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\icarus-info.xml /install /cookie:mmm_pwn_ppi_008_519_n /edat_dir:C:\Windows\Temp\asw.3dc39437bca4f4c2 /geo:GB /track-guid:63e67edd-4826-4846-968c-18ccaf4cbe2f /sssid:5132
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\icarus_ui.exe
      C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\icarus_ui.exe /cookie:mmm_pwn_ppi_008_519_n /edat_dir:C:\Windows\Temp\asw.3dc39437bca4f4c2 /geo:GB /track-guid:63e67edd-4826-4846-968c-18ccaf4cbe2f /sssid:5132 /er_master:master_ep_7d627d54-2e60-4dda-bfa4-e754e8118b2e /er_ui:ui_ep_b73d2450-b4c6-4095-84a4-05e223580439
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1220
  - - C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av\icarus.exe
      C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av\icarus.exe /cookie:mmm_pwn_ppi_008_519_n /edat_dir:C:\Windows\Temp\asw.3dc39437bca4f4c2 /geo:GB /track-guid:63e67edd-4826-4846-968c-18ccaf4cbe2f /sssid:5132 /er_master:master_ep_7d627d54-2e60-4dda-bfa4-e754e8118b2e /er_ui:ui_ep_b73d2450-b4c6-4095-84a4-05e223580439 /er_slave:avast-av_slave_ep_393cb215-5aee-4501-a08e-5f255b7db63f /slave:avast-av
      4⤵
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:6516
  - - C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av-vps\icarus.exe
      C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av-vps\icarus.exe /cookie:mmm_pwn_ppi_008_519_n /edat_dir:C:\Windows\Temp\asw.3dc39437bca4f4c2 /geo:GB /track-guid:63e67edd-4826-4846-968c-18ccaf4cbe2f /sssid:5132 /er_master:master_ep_7d627d54-2e60-4dda-bfa4-e754e8118b2e /er_ui:ui_ep_b73d2450-b4c6-4095-84a4-05e223580439 /er_slave:avast-av-vps_slave_ep_4f4e9bb4-e8d6-49a8-855f-05d51614278f /slave:avast-av-vps
      4⤵
      Writes to the Master Boot Record (MBR)
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:6532

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:7016
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {c83f4934-7319-43b4-84d7-0bf3b661af1d} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6980
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {800039fb-3e0c-4394-b874-08f51ba98ef0} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        Checks processor information in registry
        
        PID:1508
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -jsInitHandle 3960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {3f0dee16-8969-4e81-a3cc-4515cbac356e} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        Checks processor information in registry
        
        PID:5628
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4108 -prefsLen 27274 -prefMapHandle 4112 -prefMapSize 270279 -ipcHandle 4196 -initialChannelId {2ff68064-daec-4927-8930-db818b51c851} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        
        PID:6516
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 34773 -prefMapHandle 3108 -prefMapSize 270279 -jsInitHandle 3172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4516 -initialChannelId {ba25b48d-4ae2-4bee-bd64-36c7bc6666d4} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:4636
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 34876 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 4984 -initialChannelId {91c0e97c-9f78-431f-a39e-a625f21e6d79} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        5⤵
        Checks processor information in registry
        
        PID:6352
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 33031 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {511998d5-1cdd-4502-9f8d-a3bb9bb9d3c7} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:4120
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5692 -prefsLen 33031 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5708 -initialChannelId {42c4e445-ba16-4106-80cb-573675a60cf6} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:7064
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6044 -prefsLen 33031 -prefMapHandle 6040 -prefMapSize 270279 -jsInitHandle 6036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5936 -initialChannelId {ee156dd3-02c7-44e3-8711-6c75d0a7f08c} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:3764
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6424 -prefsLen 33071 -prefMapHandle 6428 -prefMapSize 270279 -jsInitHandle 6432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6440 -initialChannelId {e67a95ba-8cc7-49e6-a15e-c717e54ae86f} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:2420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6940 -prefsLen 33071 -prefMapHandle 6980 -prefMapSize 270279 -jsInitHandle 6736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6704 -initialChannelId {4c8428a6-b4bb-440f-8a7b-398f84504f63} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6500
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6652 -prefsLen 36885 -prefMapHandle 4864 -prefMapSize 270279 -jsInitHandle 6788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6444 -initialChannelId {846e23ab-b983-401b-a84b-3c445dee32fc} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:3344
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6268 -prefsLen 36885 -prefMapHandle 7060 -prefMapSize 270279 -jsInitHandle 7084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 820 -initialChannelId {6082538b-3426-4710-ba62-840b68d5b8e8} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5884 -prefsLen 40022 -prefMapHandle 6788 -prefMapSize 270279 -ipcHandle 4736 -initialChannelId {08ff55dd-c366-4651-a994-1e69995a125a} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
        5⤵
        Checks processor information in registry
        
        PID:3056
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6112 -prefsLen 36885 -prefMapHandle 6116 -prefMapSize 270279 -jsInitHandle 6100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6184 -initialChannelId {2cb77e64-1664-4550-926e-939d1f321ec3} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
        5⤵
        Checks processor information in registry
        
        PID:1928
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7008 -prefsLen 36885 -prefMapHandle 7012 -prefMapSize 270279 -jsInitHandle 5872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {1a4365f6-0574-4e70-804b-22640d81a986} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
        5⤵
        Checks processor information in registry
        
        PID:4480
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7432 -prefsLen 36885 -prefMapHandle 6936 -prefMapSize 270279 -jsInitHandle 7436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6068 -initialChannelId {a12aa37c-fc8c-4197-a067-99a5f8991c0e} -parentPid 7016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
        5⤵
        Checks processor information in registry
        
        PID:5500

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5876

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3152

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4240

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6752

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 92KB
SHA256 95aa1d359178ef2ccd78acfc61e847759a3f1dea931cf8511593755aee512fb6
MD5 416050d789037a9356c19d34e7a1298e
SHA1 d5315f24e0af2c3e651cb47ef48bf1cbe240f515
SHA512 fbf2d00b7c37b18855390ec9c9be3835acf8cf65e6ee3dd360484d03d5b800a497eb6a6587f55894d9aa892a2c8dfb2037b25d11fca63d17bcb0bccb31ff131b
SSDEEP 1536:SZyKt5u9RDeS3dzX3dlFSwQl3q+EvjOP9Vb6PIVA0PmVeJJnc2cwiueIXFB3rt:A+RDe2zX3dlFSwQl3q+EverKcv6dwt
TLSH
T1CA93428F053FB0A623371359E149DF9AD2B2B6571ACC5884331E9B08F37B706658F4A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 92KB
SHA256 058803a3ffcf7dcea30737a3cf95e0ba7d0f1d73b356ba5438185d57c9dd193c
MD5 c152a395dbc33993bc9d5ba3c050ec86
SHA1 3585ce126dd5d858f740870c9a3caf6e7807a6e7
SHA512 81e49dedf3d94582c7c8d9662ae01a10846d65fb3724308a00c8cc00baac0b87d99a1ba41cc0d94ac6ac094f3033efc3069d7bc638839af9a7b1b0e8072c2341
SSDEEP 1536:SZyKt5u9RDeS3dzX3dlFSwQl3q+EvjOP9Vb6PIVA0PmVeJJnc2cwiueIXFB3rh:A+RDe2zX3dlFSwQl3q+EverKcv6dwh
TLSH
T19993428F053FB0A623371359E149DF9AD2B2B6571ACC5884331E9B08F37B706658F4A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 93KB
SHA256 0fdd4a162b0ed74bf0a369bf3d9d59d23ed08348758d6ad6552d52a702b06e97
MD5 c3b2e11766f329d20a9c4ae7c9ac5e1d
SHA1 d458de7c1583e50b75ffb7e8ed993e6e8acb8f49
SHA512 33abd594d3767c98aae7ab4071a20099f15716586709a53678921217285e4e24255e17cd4729cb842b4f7531ed738dd65a6493a7a06c871b397ebe12dfd148e4
SSDEEP 1536:SZyKt5u9RDeS3dzX3dlFSwQl3q+EvjOP9Vb6PIVA0PmVeJJnc2cwiueIXFB3rQ:A+RDe2zX3dlFSwQl3q+EverKcv6dwQ
TLSH
T10993428F053FB0A623371359E149EF9AD2B2B6571ACC5884331DA708F37B706658F4A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 135KB
SHA256 57fcaaec9046556847af7b8fb6c10acf5c413accef25e965230a8fa05f84ece2
MD5 cfb83ce8277efd94b885ad31b9d5f104
SHA1 98c952243540fe5bf979ab20d566425ce73eac60
SHA512 07b86e094254c2f6368523350d5471706f91c3ef43b0e41fe5bedcabe85af2a3165054b087edb771a8ea96e59bb5a09ccfb3ef251cbc25c52a088d921dbfde8b
SSDEEP 3072:A+RDe2zX3dlFSwQl3q+EverKcv6dw2XNUbInNn4iW3XPNGRhv+C19ifWvaW00A0I:Av
TLSH
T116D3628E042FB0A6633B1758F148DFAAE2B273571B8C2494334D7F48637B605A59F5E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.log

Path C:\ProgramData\Avast Software\Icarus\Logs\icarus.log
Size 561KB
SHA256 47c3afd2167cf9c932be35cade50d04f6b5c90ee63fb5510038d69e2e6a03b5d
MD5 54d799e2707d0cd55debba6031675254
SHA1 0ef08022609f69896392d0899aa25a92cf257a86
SHA512 3ad70e20e65cc6cbd6568a59ac11b917ee980d6b410dd62ca390fdf4e0ff7ada54576d6d751a83c48999dc78499d1f4e06a1f54062dc170169ad7240a35a65ac
SSDEEP 3072:A+RDe2zX3dlFSwQl3q+EverKcv6dw2XNUbInNn4iW3XPNGRhv+C19ifWvaW00A04:AY8
TLSH
T174C4848B432F70B5523B0648E148DEDAE2A37727368C1452326D6B447F3E61E61AFED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 12KB
SHA256 edbc94ec6d3305dd68b023f941c5334571c3d957b6c047ed97927067bc452d0b
MD5 ee72cfe94d71474ea67cfbc2aed7b53e
SHA1 23cbe505e552c680408c0ec37714f588caa4d3c0
SHA512 b46717da5cfb7f5ef39e1677a17bc927a259458e40cfc2e03fee9b7ca479aa542d9a24996579f0849ccf54d74c2167614ef331905a75f57d7289be3fb5bbbe68
SSDEEP 192:OjPKGL0XJmpI1/PM8bh4rx1gPBGyHZHBoB/u560H1wH/jcKmjtL7aeE1k3UuDvBe:+UZ3bAqnCWmn
TLSH
T1B142A74A066FB0F3121CB70CF096EA4C77A171074EDD4E91721C7B2CB3168A7EA6B566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sui.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sui.log
Size 33KB
SHA256 2fd04833e4dc1da74beec0ebe0b95e9ef6174c717cf6e7e12eccbbf27db4eae6
MD5 df246da5b6c25f9cd4905072c625d581
SHA1 658a24f5f0eb52099c3cd41873fdb81aba0a8ab4
SHA512 2cc2e1d93bac00573a4b6cb18ec17cf9a59dd8589a241ff05bd468055d88c93949faffbf779b2c58200c6d86b7d9a8c460842caaf457980a9c0681506dcd76d2
SSDEEP 768:py/0zynPQVQJh+OPAVHUPOVdgHqa1aWSAvg1PdgGLwmt7tC16OiOYcquExM:py/0zynPQVQJh+OPAVHUPOVdgHqa
TLSH
T10DE2EE8E0C1F34E9873F5BB9948EABD5C522F112927C6CD1B75E92042735062688FBF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temporary_proxy.ini

Path C:\ProgramData\Avast Software\Icarus\settings\temporary_proxy.ini
Size 278B
SHA256 8e511706c04e382e58153c274138e99a298e87e29e12548d39b7f3d3442878b9
MD5 b8853a8e6228549b5d3ad97752d173d4
SHA1 cd471a5d57e0946c19a694a6be8a3959cef30341
SHA512 cf4edd9ee238c1e621501f91a4c3338ec0cb07ca2c2df00aa7c44d3db7c4f3798bc4137c11c15379d0c71fab1c5c61f19be32ba3fc39dc242313d0947461a787
TLSH
T194D05E5307FA0008F1B74A58EBB898F2573378152F4DC02CC0C0121F84F2805892BBE3
MD5 SHA1 SHA512 TLSH

Submit Download

0456AB06434C50E8B693749A85072E5111423C2D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\0456AB06434C50E8B693749A85072E5111423C2D
Size 147KB
SHA256 262f885208c99acb3c964b470d72f963f6436fd05e64e4b8595b734617ac1f7f
MD5 aa553e6048586fdad834031e09c49221
SHA1 633c9e5bd6ceb73f86a9501064205f73892978ec
SHA512 08554f9b6690f386a8dd6c2b6f73f4cf3788fde8fb4b3dc0df40613c2b4d5c75ec52cb8aed72d921bd06684f097667d0d850dd777f5a5e9a8cec5072bb697400
SSDEEP 3072:zihMdwzcdTTFFS7cfw9WUvb/RayZCZ+mdTTFFn7c78xWUvb/RayZCZwSmG:WhMdwzya7cfw94yzM/7c78x4y5SmG
TLSH
T1DBE36ADEB2C1B73589E371F1009B420EA37AB8655C9C581EB945E3F04D7898B913EF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13942B71054516D0D59A55A7FAB4D03B9F19F8D5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\13942B71054516D0D59A55A7FAB4D03B9F19F8D5
Size 82KB
SHA256 27f07d430f5a109325cfcf522344378ee7080c65a071ebf15fa5a7f249ea1424
MD5 91a093a1b465daa6013cbf75ee2598f2
SHA1 2818d576304ba841c47e9951b31ecd0d61bb3af7
SHA512 6c97755110d5b824b5052c021086ca78279fca8aa8f46e3bb3ead214239e2cdb75b3839a9010203a97d85b82657618fec064bc4be25e44161b53a8089fc2f744
SSDEEP 1536:No3tmjQr2/LGdpP7nri8NwDfBrcyD7i1qJJhVOhjfoH:6ZiDIJYmyDDvV2LoH
TLSH
T1B883127B0F526B1004496FC801A83F4C2E759167F5CFECF8AA7C2BC9C51955CA63869E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15FC68BCA9CB6A1622B23451453C6541119692E6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\15FC68BCA9CB6A1622B23451453C6541119692E6
Size 6.7MB
SHA256 aa1e828568d065ff44542a8dfab9e5a6c9aacc35a8a36b9b240aa152db45fc37
MD5 1cf9f3648bd2af6c93a91b3f919f5f02
SHA1 34f20574493d9756c6ae017087c94d984690f79a
SHA512 40e0f328075472813eb3d74dc95d359b9f40b70e4a6bc40892661c630d6e09a92faf8e66b75aee9c675ef2c5a5ab52b9285d16267682245d9a4fcad4c556288f
SSDEEP 49152:dzsszTI44hUtMCNbm2h+E5dXEsAK5q02gP9WgLsZnTunuwHekplHrODO2f2ek+WD:NpkLsWsVF88CfxydSW
TLSH
T19D66E616EE475E23C82002B244EB63313B34E1855B96F33F2ADF7655FC6A2791DA126C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2BED677EA3115F4C7A2B025D6912B683B3357F65

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\2BED677EA3115F4C7A2B025D6912B683B3357F65
Size 6.9MB
SHA256 51936445eab74ab9d65a8f6d1628b12aec474c1eb30afe0831d86701417e09c3
MD5 6c1fe3101bbb0134c3e1c0883c5510c6
SHA1 c933c4d4baca21c68c48c780b4310401696b16d3
SHA512 14f1a35ee01b6f283ac3db4d8d32842f596f591f197756ae8c1eb5a97e664c4331e190b54527eab75e95badd11c2878f4a47eaca15fc11537eb853f678576d50
SSDEEP 49152:DK7VpLlBbikB8sL4NpAybauwKJ9qV8lMpBXYI785e2Lfer/+nF+Q7fZUvYGCe4nF:KVpLlBix06vgGx3zvkQ
TLSH
T1C6760716EE525E23C43403B640FB63723B38D0856B97F32B2E8FB552BC697650DA526C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3A8BAA0E7F545E864F2505B432F28B51B7FD636A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\3A8BAA0E7F545E864F2505B432F28B51B7FD636A
Size 129KB
SHA256 080c03fe115d18dc68b66441ffc65596483d53be8ae784af621612601b04448e
MD5 0a14d4d9a927e60590172acc55a28d7b
SHA1 56cffac6136b492f422f555d65fbc6151172aa65
SHA512 5e1d1d467bbd50bf7261bddfad369b27e11c799f39f013e8116cb4157804497ec9a3fb463661168e81bd9bbfb7d8f80b571629f4f5d851b1b8bea03d026c2119
SSDEEP 3072:hOxrSPz5FeLcdH2RSdHkBzoSEei2FEcEv6Z/YM7xMG9Ma6+b:kA5ActEQukSEeCBiZ/pCap
TLSH
T14FD312279C100C3621B40E27ED75BA9BCD7366EF0C1775B852B829348DE97F895843AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3EDDA4487B7BB0FA688CCAD556998906EC4B89A1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\3EDDA4487B7BB0FA688CCAD556998906EC4B89A1
Size 116KB
SHA256 266c7021115359895b5b81656212b47778a319e6161429d268a2bb6094fb1f31
MD5 f3e6dad1c57ea0d0ec4d5df6dbbd632a
SHA1 b7a5d9b16297c55ffbe1ea09de85fe58c04b27c0
SHA512 64f0e858041f54495df244eaa345e13cccd308d586e321c3baf0b3c425dc4f24dc92587d83b6e7de4c6bf0978e33814c1787bba69b3e8478b212a10c6868ce4f
SSDEEP 1536:0OtyMOxlZ5HkNYGQPjldukaqeAcoanaCSd8GkGgX6QwFvJppQbJkXJqCsqnxE/oc:0OLN1QXmoanaCKQbCZqrYq/oc
TLSH
T1C5C30A67FF526D13C92003B140BB233A3B75E48557A6F32B2A8FB161BC663790D51A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4D2E57F20B84BE53B958860FFF09F5A0B1C5F299

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\4D2E57F20B84BE53B958860FFF09F5A0B1C5F299
Size 1.1MB
SHA256 5c87097ef72a0fffa67fb8398addc12efe30a3b5a96eab9f4f1ba18bfba9c66b
MD5 bcdf75c7f4575cf0a1276d56e20330bf
SHA1 26755f0f6b28eff261eb59aa0b1a9916d10dfa83
SHA512 975744bd09858d8241b1a8c7ffd54802fd26212eb2089c2dfd522c6600c12f61d670e7df82313865d32c6abe3865c7d053dc7eb060ad94024deac44af21d26a8
SSDEEP 12288:DvcLAJg84NcpiJkf2WarFaKC1UyueoM5MWwJRUnCBFw5XoepoVUZIpjHrBzdwPiu:AL42cpiJkf2WarFaKCRuQyVJ0BlbzL
TLSH
T1B945C726EE465E53C82103B240BB53323B34D0856B96F32B2ECF7562FC697751DA52AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6DC89C2C7C61B43F62BA417E36EA29612D051315

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\6DC89C2C7C61B43F62BA417E36EA29612D051315
Size 1.9MB
SHA256 e33af7bd549d15b2861b372bdf092468b523fe3f5f7bcdf9d57b0d8b2a7a4c93
MD5 e76d328f2d7c513b5026f50deeb30b33
SHA1 44e7aff0627219db2d2ef04719de5a1fb5a2eaf6
SHA512 b607f69a70148dd944e4656275841cefb3c98aec076c805341822385719caee92832211f981c3bd3cfce42dd840d5e9fbbce188b32fc57e1e30ae51eef7a19d4
SSDEEP 24576:ZlY+zfETGQQWBMmoQF3S9LmAl2WUeOkmSAOf20glahm:ZldzsTGQQWBloQFi9LmAgWUeOkdGlL
TLSH
T1A6957D57BFB05E67C402057784FB4332323AD2857BC2C72BAAAEB1257C657285EA534C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87A7B3F368BE8B6FF19C61831FC232ACFD35117D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\87A7B3F368BE8B6FF19C61831FC232ACFD35117D
Size 156KB
SHA256 c7f861d48eae794047fe1e2b3a91e9ed920f5623251b40625fa31c09c1bed337
MD5 61d1f86a8ca446454f9f8c21007685fe
SHA1 b463627609da1042a6fbae5ce1d44c1ef82394be
SHA512 6062d955d902c1357050ef626a828f94b0f22dc3210b23e5c49dcc32d1fd88840dc16da3cd2294879f7dceb72deae29405721ec246bb63536ff71f09c90bf26f
SSDEEP 3072:M9uF8vr5h6BYQdgrZumYnYQh6NYidgrZumYdbdN:M9uQ5QCIuZp/QQ+iuZpOdN
TLSH
T16FF35CCFB2C1A339C9D371F24057510D62BEA4459D88196E7E4AF7F06974E4B8827F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

883AB41F4E4C2084A1F34286D09004B613A40701

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\883AB41F4E4C2084A1F34286D09004B613A40701
Size 79KB
SHA256 7f2f1f5b0eec345b75be0be98ca7e263cb772a533f69a69f2430c3d9a1aedc37
MD5 d2082ebf82c95c461b682b62f1d10098
SHA1 52d33afa5be298829f92b8c9a063477293bcc50f
SHA512 a6f715f6d765b3bf50ab869d4afa7f6117e761383526981042e53c6290380e1df8da1467b4515c596d13c5d717b8b782b0874177af16d4462a8be6762825ded1
SSDEEP 1536:17brXHstNBRNDVKxH2MXYL2NlP/d7uw/JhJBAkQRZalGx8vn/:lbbHSNBRN8RRfN5wcHetjalGxw/
TLSH
T1E683023AECEB8812429A7E00C14E23550CD5F057A67FDFA61A64FF28E9C10775FA412D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

946418805A9D1333C2CC505547E798AC7AADA2FF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\946418805A9D1333C2CC505547E798AC7AADA2FF
Size 69KB
SHA256 affc95603059b0f3d8b67a8ce44a1253dfed1cf738b0f389b0fca3866f2fb489
MD5 f3c39af992ed14e1a8a5c4ce4184caa8
SHA1 c5d221dacd94157affcec14ee6c1215e9ada89e3
SHA512 0be973372f5e3b6a69461ccbbd46e6f2a9acf2b133e541fe9c22f918dcbcfac6c74e91b98039c23149f2ca79be4eab9bb21940a7f721e0a7bbf81ac0647c7be2
SSDEEP 768:ZckWdOrmmnHGOho5NBbtWlL4q1EC5GqHj4G+EMnafqTu77dfHxZCQSq7lp9yG2ki:ZckfqmHOBGfR3HIiSnzY9HEPYx7ne
TLSH
T1AD635D7135723943C1120875829763677E9FB1876BCB8766AF88F7A17CE09241CB2F68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 09e5b07fcd3e36b1e0f708fb5ff1dbbcafbffc3242c2cbf7656aa0f9ec3ccccc
MD5 d9a1f6c87860a880075634bad1c376e4
SHA1 ef3ba4eb17c13832ffbb9eb46b687554d5966f7a
SHA512 e45251d269f60709b856c62f50a645dc02f7081ec268da4c7d1bcef3960131545fdcddba1719a92a092387bc6b9315717e75c0cf9cdf5b0bdae374e5f8cade34
SSDEEP 384:H9XghOiO024Ylo6J+Sl1xDnZBPsac4j0lpDII+khc:dX+ZYlo0+Sl7zZlsac4ID8Ln
TLSH
T172527C7E9F0138AA2E67D194D9BD9254CD04A7BBEEE2C06616143C04CE847B9F4F648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BDF3684E33D285D68CCA0FF7ED9943305B279D6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\BDF3684E33D285D68CCA0FF7ED9943305B279D6F
Size 135KB
SHA256 24ce916fc7a3f198acc945dcc3ac33d0ea3a17a4dee05c85a122b57969dcc29c
MD5 3491780df7621357f9ec718301f19ac6
SHA1 d584f4dd4c0b55943188e710ed82b34e52f37876
SHA512 0f7dbb1f67ca875684a35fb575cc10149de096e597a48493701a60b97ec2a19bc775b3864f432e176233b4b5a817b54d0c9ba0fe3207b7214623ab7f996da714
SSDEEP 1536:aUoCcu9ioTyoagvenodwF6K+V7GOqBfFtABaGxG7cmJODV6kQb6vxRmkd5cBOoW:Gp95LIK+V7GOqBfFAa7ZK2MxR/OOoW
TLSH
T156D30A6AEF615A23C92003B540AB233A3B75D4C557A1F33B3ACF7061BC6A3750D55AAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C8DB6518E895C40C220C8874933B82A019115546

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\C8DB6518E895C40C220C8874933B82A019115546
Size 64KB
SHA256 1f304b78ec3a17c0f2c97c7f657c35e0b22c16277cf0442ac87c8b2d78a23feb
MD5 ccf6d94516e090fd0cf5a228dc961445
SHA1 c7f9402371b06d1407fcb707fd9aba2e6301763e
SHA512 d26ba9734cc07e242bdf5546300cc37bebbb1fb4c3902627b3b9c41cc426ce2f9c42350a940aaaf93cbcfde5aa4c6dd0177042345133d3ecb284ce23a95470a2
SSDEEP 1536:niR4dIhtHN9I+Gk25e2IgQqIbNxI+Gk25e2IgQzP0:im+G+zuVIDS+zuVIDP0
TLSH
T1CE535CACB593B479C2E3E0B1046B040DE5FB391185192898F345C2D95FB0A9F616EFAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2E41CA3E48D2627D2A1C76828444D9215432E1A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\E2E41CA3E48D2627D2A1C76828444D9215432E1A
Size 14KB
SHA256 b2852b65d7d0071cc1643a05763352e08ec08b349a6b56911f1dae28e0019acb
MD5 95298f62e52af84a687fe5e30fbbca7a
SHA1 6fe1b5cf4619d92084c735c1941aed8369e5920a
SHA512 17870de35ba6786d705bf293d604e2f5b9313712d09128866b87e243092d355a71513e92f5291b23b8de1a094dd57dd1ca873f034592e6dce1e4de839a11d461
SSDEEP 384:7yMBmpFiG/06veO5np9UtKX5hlHKKX5hlhHKKaPOGnAL:7zBIeO5EtKX5hlHKKX5hlhHNaZ8
TLSH
T15C52AE379F013516879294E1CC0B5AC83F696A93E69AE0FD58007A00D29D77EDE97CCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E8414CB72687F0C99A49649051DA4CC8DC475842

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\E8414CB72687F0C99A49649051DA4CC8DC475842
Size 2.0MB
SHA256 20b8acadaae3c8702adcaaa68bc9db479d444c6f31fd6d4e97f7787ebb7d8b3d
MD5 24efd4e0ab4b4e49e2b74b1aa3de92b8
SHA1 0a785759b260d0327f67be84eccabbffe77686b9
SHA512 6dc1014c6a894d1dc1b6d980f962053e4e65250761bc8d6737c3d5cc649e85ea0a5687e0f1ace83faa5e6ce68bfaa92ab370be3d17cc93129f0cabb828391891
SSDEEP 24576:lKsvxqwABga+D5F/XUdW+D6dvczfRZLdY+CjDdavLC:lKHOa+FF/XUdWa6mI
TLSH
T184A5FA16EF565E13C82403B240FB63313B34D0855B96F33B6ACFB566BC6A3690DA526C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FF0073E2E1318338C07738BDAC30165315B19B70

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m1lvo8db.default-release\cache2\entries\FF0073E2E1318338C07738BDAC30165315B19B70
Size 71KB
SHA256 1c4224060527c97f1a7a73d4ff7431630e15dedb2a75f18eec061c99bc81cdd4
MD5 2c7e963a0769499472148989793c1612
SHA1 60b23f8ddff4cc733dd43e9cfd5262a6a2e12aba
SHA512 ef7fe3ce3ae53b9b0e14060c96c2e8d75c4f5cdc6cc6c1623beac96639adf3f4751dd74da688fe11207be421de49dca6fc168e8d1346c68f1a5def7019926b94
SSDEEP 1536:sOuI5d6ora9ZnX0WFEjzvYZiZU1YWkcsAc/wXM6ruSsGP:sOuRora9pUrYZioTc/wX3u6P
TLSH
T15073F13DEF418EAD0BE112C5C857A7A63E78F0538CEED97A3018319905E13D98BB8197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
Size 10KB
SHA256 6663c330a94ce181c039a5b58952d5f25628b60550f39c33a4581dbfa0992d5a
MD5 37acc9b957a209d382a793b2ca023fdb
SHA1 685889ee039e9550c42d179531533509adbc3c96
SHA512 9959b1b60a06e558074031e0201fc97443394fa7f39d3438a84a59afe0386cf6de272726a832b23ba51840e717c8116b955b82244c2d03fa274d8a5ecab6d673
SSDEEP 24:kBuhMZTbc91Y5P9x1eC9B1LP9VvDXON9lCMb9F22T3M5q9F55A55:krOO51jew3L1BDXOHEM5IS3OI565
TLSH
T1092283E76BB2A462F0928FF88068B64C8C331725057996C4CA5484F706C2BDD917FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
Size 16KB
SHA256 6f7d67a9fbceee0fc7a516818231e433d2204c951d06c6d47920b4f7c73156f6
MD5 7a06dc69f0ec9012d212a19ff896ba82
SHA1 1223b3f58a1eddec958f92960622e92c7ddd2f84
SHA512 831c12dd0d8465cce30a5befd1a9fce25f571d0c8121e1e36cb405785c7acb5e194aa2dde5f296d38c459ddfc26cee0eff53db5e4e13b54e474d6217a2aee596
SSDEEP 96:k4OP51jew3L1BDXOHEM5IyOI565dCM/ptPFxe22er8yx2zekzyuZze:k4koeidRYCQPK9o822zXzZZz
TLSH
T1087272E72BB268A3F0528FF88068B54C9C731325586D9684CA5494E706C1BDDD17FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
Size 17KB
SHA256 288d968921d4c98089db692b1a3709abc8b7aa81f24fdcf6a1a69b29677a58b2
MD5 7fa739adc1c115915e5d8529216205bd
SHA1 93dddf61d705e1522dcebba249ff2a07a8ab6954
SHA512 5b633574dd392bee67352ee08c9576b345ee6cd2feba460ac3a38ab68840772ea04be8f5105cdbcf125a08af644733acf1d4ef47ef6869a215dd4737a7c6c8e3
SSDEEP 96:k6O551jew3L1BDXOHEM5IyOI565dCM/ptPFxe22er8yx2zekzyuZzemzy8tU:k6ioeidRYCQPK9o822zXzZZzBzFt
TLSH
T10C8285F72BB26863F0528FF88068B55C9C731325146C9684CA5484E706D1BDDD17FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
Size 17KB
SHA256 b2d5ce3b72aa376344b90556a67375207953dbf96e8fd854c00728fbd54d58e1
MD5 79af8cdb3d1993efc89b74ed1e84dad3
SHA1 04aa03ee9e12292b50e8c391a7d0e9f2ceacdcc9
SHA512 9aea82f9ac49209446bda7385b734bd0b4e674aca71c5f8b3bb53c754d44b96e7b7cbb6f70dbae33ff699226a9665edabc6ecceb87f0f20fbe321bc5d5c32ee2
SSDEEP 96:kv1jew3L1BDXOHEM5IyOI565dCM/ptPFxe22er8yx2zekzyuZzemzy8tU:kvoeidRYCQPK9o822zXzZZzBzFt
TLSH
T1738285F72BB268A3F0628FF88068B55C9C331325146C9684CA5484E306C1BDDD17FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
Size 21KB
SHA256 d0264ae0a4e5c2da7cd900ca6a8551dd1eac1568d72903a2f80d98244377df80
MD5 2fbb17008793a9b86c639b881b44a746
SHA1 87a527836c5291fefbf12f8cffdb85e32f8a9af1
SHA512 97a202d8e0370623b4dcb3ffd58fa7fa09bd8636536f99c1922d48b2b149a5e7f8613443f166e19b90961d10e2137aae928e98631884d6b39c32d704fbe1e0be
SSDEEP 96:zxwt11BBHHDh5/yOI565cCM/puyFqA2198yx2QkzyuZzemzy8tUm4xh4x8m84:zxSBVI5CQnd+8225zZZzBzFtvoc
TLSH
T191A295F32BB26862F0528FF88068B59C9C731329447C95C8CA5494E703D5B9CD13FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
Size 21KB
SHA256 5d320afea662a841759e0b8944ce6d07fbcb40c873e632dee6e86f4fc7c56e1a
MD5 21d3787be9d09017f015e29591f0d302
SHA1 a5dfeb7d010c58002b6d680fbe7ce039db7531e4
SHA512 3c3372ede5acc5fd14878e7a2c598484d4b357c300326445748f0384a6616f64b1682562b54272f7189aef4022c3fee60423f99438cf0d1e8aa41a5e0cdf675b
SSDEEP 96:zdCM/puA2198yx2QuzyuZQmzy8tUm4xh4x8m84:zdCQZ+822TzZZvzFtvoc
TLSH
T1A3A294F72BF25862E0528FF8947CB49C9C731328487C95C8C61594E60395BACE17FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
Size 21KB
SHA256 ee63b4d22e3fe112bac917eceb7b19bae968cf47099194458d9c631e76bc986a
MD5 df112d2df924134fb86080dd038d5f25
SHA1 933ce2c125c5d33f5991e240b73f29f747b62a05
SHA512 aa5e7fe648c2b195ebaae223bc0bf14aec70d8467fa5de2da483680d686b702dae37821e1ed77f72c32453e5e2f9c18979f61a91e80547c8f12e7feaafece8c5
SSDEEP 96:z5Jcmve6JQU0EPbEbEo0jPQs4mfI6yM8cCM/pu44/h4x8m84:z5B5hIgtjosjKWCQVWc
TLSH
T191A2A5F72BB26852F0528FF884A9B45DDC7307255868D5C8CA1494DB0285BACE17FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\AlternateServices.bin
Size 21KB
SHA256 bedb8f0cb1e426968270d17bc3b3b7326033086b1649e07537f463cbe77adec3
MD5 6ac12dbd493473236e463840e408b8df
SHA1 374dd5000671ef990d699d7ae8705ed1ccde0f7e
SHA512 caae0b075d456aace3e3bc1d18e7caa276052d3083e8d9236bf556f2ffeef684abacee30e55b1579c63ab2fb826f224940fac58417075f0387cc9e83984e4b5d
SSDEEP 96:z5Jcmve6JQj0EPbEbEx0jPQs4mfI6yM8a7scCM/puRN4xqr84:z5BqhIgCjosjKU1CQ2n
TLSH
T17AA2A5F72BB66852F0128FF884A9B45D9C7307255878D6D8CA14D4DB0281B9CE17FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
Size 135KB
SHA256 52c14f006792ffb6b58bd206d30c216754bbad5549f8fc6541990426738840b8
MD5 ea86898fdc50d0708fef73e75cb31a47
SHA1 fa5c8663a300338197e34449c6bbc4e14b774803
SHA512 d1f835c44c1010a25848f907be9d88914fa4eca947f8d9b6afe798eac6c0e454eee8d1bb01f8304f3391d9562358b86528e26f3cb3dc617ffb624505c90a65dd
SSDEEP 3072:AP/UAoQeW4RjohMHzBgmOb4wRcFVRGSlfH9EUDdUZO6a:APMAoQeW4RjohMHzBgmOb4wRcFVRGSlj
TLSH
T1DCD38ED4CB17407BFC1485BFB496573C2635B4614A589B0B3AAC04762DCB3BF2D4AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 69538dd2292e3b3c23aaf8af9db72e48972487e804a4ad73c96f28c9126a988c
MD5 f03a9ae7929706ef58f78123ebc8537d
SHA1 c986d974403aafac24e3244df1b2401812b18a8f
SHA512 ef0e6e04b66776f465ccadbc575eec1bc0d99dd69f8558721736d429f7e674c36edb69d772a7b11b910f3b2a0806069dc6eba9bc56803f2c53a827dfd1ef0420
SSDEEP 192:MI3Ov5zbo7zhZuOJyj5Rx0eDRhN1d66JoztdzgCl6mc0d:MIIboRZuOJyj5Pd66Joz/zgC1j
TLSH
T13DE110A8E629463FC418027BDDA61B400E36388AD84E7F69359C701D3D572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\db\data.safe.tmp
Size 37KB
SHA256 56e794613c678dee15c1585e847a0232f92a9914dc9cccf7661cb4e6237690ee
MD5 fcbb9efcdefbbb1f1ce33e0e9cd1b460
SHA1 472de5b05424eef96e9d8b9fd866f2025537b596
SHA512 fd7ac04af481cb469cf79112ec601931413702aae9da5c7415ddf6bf848b4b267df94cb9b9302c9eb1831bc5f096a8bc0c4d89c4181fc94de6bc28f3e9658aaa
SSDEEP 768:yd8M/pYKjvXaSolGcm+urrKR6crpyqU7bObXb+bBb4c0MG1/:yd8cHjvKsrCh
TLSH
T1B0031244EB2E553FD42812BADCA51B102F79F88558192FAB3B4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0723934fed6ff99db6530a86b5a3922eb2faf991db3efc94347618bd26f90541
MD5 1481082d8ca1206bf67925edc9318a9a
SHA1 90e9b5b954c5e6bd9a4a0d0d4e36b77a4ac6dec4
SHA512 b511c458aa3c8eabffa24a57b4265f65e7fd2b278bfec6159203462b92ce65d43439eadaab475ba9c41057fd690d34a6f0e4997d181e94853b7791fe87af1030
TLSH
T12E213A5C39B84D6A68CBE2ACB5501A8E93A54F0B05971C830D12EFCCCE95BDD337A439
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\events\events
Size 4KB
SHA256 085d73038296b611c3b121c6fa993bb8b5a984a6e4b83bd5cc6a2a8767382285
MD5 fb25e4f9f6a9379ceefb196ed48e04d2
SHA1 df30951904a6e7ed3ef7ac85617471fed17cd269
SHA512 bb054da4da369c7751f2867996877abbb58e9371c9ef775e69daf233b183887bb7ad8f5ccd9c0a449d70c08c6da06852667bae2ebd41027f1b2024d05c071f48
SSDEEP 96:10ccj95ljYrYp+c4adXHd6Y010VwY95c2u:10cmMs3N6YUs95c2u
TLSH
T158A1011C39690C7F38D7D29CF4500A9D96ED4703959B1D874C9BEE8CCD86A8D336E129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e7016f5-e2e7-4a13-a33e-a0b6cd93b69e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\4e7016f5-e2e7-4a13-a33e-a0b6cd93b69e
Size 12KB
SHA256 edf59b921169f66612c155801c8869e2cf747de60e44f62613526bd114c39668
MD5 cc0640dd71e968b94a45a748eb0f8f5a
SHA1 c018e1c2851234b2718fe4c3aa92cc0048458471
SHA512 232093c4740c337b9dcb721c0300a9db737d7caf5c1ada33b5f941b9dcb1db8426f042e755393747c06393a92a75ad52f8d494b120fdcf668f99ba7cb11d893c
SSDEEP 96:xSuv0NbaduXUz6+REI4hiE/GwQdoH/qypm48ezeJndokxcKBafz198/m7hdo9k05:xSuvKacbK0FR2+HD16MSSmnMPmVp
TLSH
T13542CAFDCD2240433A6AF62DF5A9BEAB005629314AD8C79C6AFC4C3A32D29B71117344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4efd012c-d75c-40d5-9bf0-c8ac1986b6c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\4efd012c-d75c-40d5-9bf0-c8ac1986b6c5
Size 235B
SHA256 38b3dd7d60f31f563e04836119e108afabf3bb7717c78cf05c10945f159ff98b
MD5 9b10964ece987c080fa2b7bc21f8bed8
SHA1 95cfcbf30c6f95846f0bcef55eca072f774f582a
SHA512 81951449ef96c4836bc6a6d674ab1ce9264e8b4d43bb6f1a4ac9bd0c802cfde0ac8443dc729b57b7622f4c2004da6d8766d1c04f2bd2a5881b70be13e05060b5
TLSH
T1C9D097E02898376C09109F0AF0A428C770C94C3310A4D8A0866040789AFDAC40212C2F
MD5 SHA1 SHA512 TLSH

Submit Download

570f4e52-717b-4a21-b164-20cc3e44687c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\570f4e52-717b-4a21-b164-20cc3e44687c
Size 886B
SHA256 8e347e79e3a6f2dc13ff74f50e2262df9bd1a3c8f7db3f9d6570bc322fa778b7
MD5 5b6c14a46e296b86a619920070cb2a14
SHA1 93f58a6412eaf042b703a5841610ea3a91c6367e
SHA512 da86d0593b222ad429e3b1e44d66757ab6e54084c88a1d543623e5a54665e3bd8100d955228b373aba70cbf2fc22b294a78a68754747f378df781d7534ddd6d5
TLSH
T1D611DC949634B9B2CC3C828B99A2774246E06013C1CAAC143D61BA084EFE10AA366207
MD5 SHA1 SHA512 TLSH

Submit Download

717a4617-da34-4340-bef7-59a6653b9324

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\717a4617-da34-4340-bef7-59a6653b9324
Size 235B
SHA256 aa3bf5b2d563fb6d0514da4eea1a6d98c59c57dd28f8e09d94fc11aefc1b060f
MD5 93b31debafbed0f0d653b4a84ebc22d7
SHA1 79aa66a275cb7fb52d9e564db8fa0e24b0d61139
SHA512 69a6a8b74d6379fb0ccdc0fa474c3dac88c134f397d0ae1b49db5259158e8c1e69c9d2c9b7c3431db41107a18360677efdd533a164ba9f323d9c1f2ebb3c7cdd
TLSH
T153D097C0248863AE08200F12F0F66DC632848C372868A820969046B89EBDAC86262906
MD5 SHA1 SHA512 TLSH

Submit Download

8a9c511c-ef86-4190-bd50-00f0b6003f34

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\8a9c511c-ef86-4190-bd50-00f0b6003f34
Size 16KB
SHA256 5230c398963faf71935cbc7b846ff3176855def082e21b8df70919f856175a5f
MD5 6dbc9a9b4d468fef382fc79f56bd406d
SHA1 655811bcdc375064ab58e8fa9a9617c4818bd8a7
SHA512 fa63980f71c4fe1237436f683b66b4f67b7ba92dcf1eea9c0b835d3cd785b71a12e25eb9174c4ff3a20de79652ae885e4e7edb5216c731b3e959b8a3a93704fb
SSDEEP 192:ISedBr1374FdCLzxgtvdu7Z4omqqpA/J6RTxhggtEbMjWl9Q7yhLNi1eOuGHf:GQjCLlgtvI7Z4omBeNTvi1eOLHf
TLSH
T11A72C956586049BA8250E369D4FCBFC7E6F528CF4C419FCA9BE0BE085DDE09E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9029ec9b-7b30-4fd1-b0a0-af4878b2572f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\9029ec9b-7b30-4fd1-b0a0-af4878b2572f
Size 2KB
SHA256 11eee059a9043554dcc766dca1db899563293ddab7faa1eec42cc722ef68e7e0
MD5 2cd45122f18b345f7b46b375d9b5f1d1
SHA1 03c697a67844a03138f0e91d4f5803b8a7999f6d
SHA512 9cfd87fcd0572207ef57aea4db1c9f6e50a0a08767bab92f74cda3d58866c626d657c47a3dce7df581a110cf35412cf771a34049f3e5d355d52f2d25ebe02ed6
TLSH
T13841749C38B45C769CDAF54D9582334E43619A0340C62C433D51EF0CCED769A736E42B
MD5 SHA1 SHA512 TLSH

Submit Download

cb31a4ed-12fa-4148-8729-b139f88d1d84

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\datareporting\glean\pending_pings\cb31a4ed-12fa-4148-8729-b139f88d1d84
Size 883B
SHA256 af7e2bccf4e3645d99730a72c64af7789ec7a76af063329bd1a1a8989e29f9ff
MD5 e38dca66af31b6644ec63d9013311618
SHA1 ce2cd290b00a4d23b97b2aa1de40aa1815f25ccb
SHA512 bf29e8ee84b59cb90d32ebd5dc6aab360f644560016ab5838730cd9f2f17641b35d402763587fbc63b63a9ba23a1402c04c6cdc4fb8c2497a755e8b3468d424b
TLSH
T18211E794E2717AB6CC7CD24BC555770647E43513C0C7D4143DA57A084DFF51EA366207
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\extensions.json
Size 16KB
SHA256 31b3f71452752f7fedf9bfb46e1cc230982f3d62e4eecd153ccac21732a3f001
MD5 0fedeef392b5f355307ebbfa830f7604
SHA1 df823a6ec21781cdf4a72a4e98945d6cbd5dbad5
SHA512 fa9afe9ea01b1f0251c6d5dd15b14cf01b6489d4c8c1a56af3368a465fac2254178f1b19ed48707aa572712661417403179bc3c5e8da1ea3a7a8786a8a7f3530
SSDEEP 384:PkI4vyUmldvr8dhW994zx96oeL4HqL4POL4H2L4HmL4H314h0:8I4KRfIXU4T6H44484c4s4F4y
TLSH
T10372321545049EB8298EA79BAA367E01C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs-1.js
Size 8KB
SHA256 4a0723a81e3b54cc9e234a36b9cb33e993953686d47f81d1081793fc164b8841
MD5 f98b28481b1e4e1238c6408043d16ab6
SHA1 d2656878fccefc70220b1e09300dee9f61e4ec03
SHA512 2cc8cfca9bad1ce1520caeb9cb20f8373fceaf29a8765efc15b729e29f6e6074c18a145c6dc4893fc652ea33a09185c184682c168aae447dbeefcfbf04d2d913
SSDEEP 96:xHYVTUsqGqCfZeINbzSEMSSlndv9jinSRWR9f1GuBw88HGjglgew8L4cnKVdPWxg:qqRCfZeIRMSS78RfTBw88Zu7Xkg
TLSH
T1F702FE7891048F7F64B6776CAC244C716AB2023B77BF68D610B994C5055CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs-1.js
Size 6KB
SHA256 4bcfeecf0555c757e21d4baff21a7e77e7aca9da5085de3d0e83a7c6d8de9948
MD5 022b834e0a26f7bece08ae1c94467636
SHA1 df92a1dad538a407524d9c70cddcda6d31506c82
SHA512 cb2ab0e49a302bc128e447984fe69ce7979faecbc312b752fc6d17bee52a1c49be3160b485b822f9c0c24fd2bbaea781db822f2411b2b8cceff5458366970742
SSDEEP 96:xHYUTUsqGqCfZeI1zSEMSSlndv9jinSRHb1GUBw88u8L4cnKVmPWxGGS:q/RCfZeI9MSS79p9Bw88A6kg
TLSH
T14CE11E7890088F7F74B676ACAC688C316AB2013B77BF68D750B55485055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs.js
Size 6KB
SHA256 bc1d3e84ce74dbbdad8489dc913c066d64a704f19459f41207440d7dae28b28d
MD5 6e2f3fc967ac740027184900549572cf
SHA1 dfed32a93e284eec89a7df574138dacd95844730
SHA512 1c4de1e5b1eb8285299b879e8b16e9d7fdd16f7a72464dd6e9e6829bf2ae64f66c84cc6ac6b2be5dcb813ab9aa7ded650889920f0620ff21fd4d05c52cfd1c2a
SSDEEP 96:xHYUTUsqGqCfZcS1zSgj9sjNSSlndv9jGnSRHb1GUBw88u8L4cnKVmPWxv:q/RCfZcSp92NSSj9p9Bw88A6kv
TLSH
T1AAE11E7894088FBF74B6766CAC688C316AB2013B77BF68D750B55484054CF3452FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs.js
Size 7KB
SHA256 97256a578368b75747008a8fb72e4a6f444dac659e5fdff75a07a6cc1ffd88a7
MD5 bd24569ac9bfc81f0108b9122e34679c
SHA1 7f593466f168536b6d35dea9fd054554e253593f
SHA512 55eac52cfcfaa2f0769630910f78b474c3c29c83799e3ddfdcf2c57e508498ea16d3acfd18f6ef3946913c775273857ee5ebc15a3fbde556f4733841baa06524
SSDEEP 96:xHYUTUsqGqCfZeINbzSEMSSlndv9jinSRHb1GUBw88u8L4cnKVmPWxGGS:q/RCfZeIRMSS79p9Bw88A6kg
TLSH
T10FE11F7891088F7F64B676ACAC688C316AB2013B77BF68D750B554C4055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\prefs.js
Size 6KB
SHA256 8c20403ea70bdcf8a7d0164553c5f650bcb70e5ee5aa7b9f42bbe3da683adf2e
MD5 c858a29b9c03a00d71125a39344999b4
SHA1 f91dfa13152a1a7d25b36d5151050d863c5a16a3
SHA512 ee43c418c9b5f94d99b168917ed092e79430cb2545f66c406a18baacc7ca22b07645ec62155a085b2fdddbf40629b0719a4f815baac4049632c6aafff01fa22d
SSDEEP 96:xHYUTUsqGqCfZeIkzSEMSSlndv9jinSRHb1GUBw88u8L4cnKVmPWxGGS:q/RCfZeISMSS79p9Bw88A6kg
TLSH
T1B7E10E7890088F7F64B676ACAC688C316AB2013B77BF68D650B55485055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 37bf5b369eb530bccf6331abb0a0f1f536396c8ac7039a052593603c298f5f41
MD5 9313f4aa47548bfc9c346b97a2ec48e8
SHA1 f41db19dd62a50e5bd28a4aab9b6228bc8455192
SHA512 9500b438ae54938915fa87bad3eeaabc8dc517bb69fa9d5980e9e3214fa65f82c3c7abbba19fbfa3680be0632e409ef8819a818479b2cee0535014bbe97bfd2f
TLSH
T130516E7B0C1F6CF73832C19E6CDF0FC1C571201444F99476AEA8AB1101FD5096A95A6F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 f2019b58b0fc5d13b50ab8be6991f8b47a0e34a7c35c2c9d437c1df8a87e38a2
MD5 b0c32e6ac3dd23cde4e320dc2b03e0e5
SHA1 61ad8b1db4a987999f985c2446dcec9c9c5827d0
SHA512 6b4dbed0ee4831aa1038b3e01b7128af4c1700bea588a2663f311868ed6d8ed7efbc4f5b8accd662218d7813bc75085edbfffbb3931a1f32166608a1d799ff19
SSDEEP 96:d2qF2zjZIBV9CVUdhoXO/ZeCd01VrqM4EcZZi6rLKJyrHd9:dtgzIV9Cyf/Zei0v/4d/
TLSH
T1AB917E7F5E17BCA36EA2C148ACDF0FB947E2155408F8522519786A2702BC50E981CB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4681e3ac-3f71-4e90-8bea-e39676f736a7}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\cache\morgue\167\{4681e3ac-3f71-4e90-8bea-e39676f736a7}.final
Size 404B
SHA256 ba3629c199956f51e9256ed5da1375954a0197263210e8f39a4e002329b71af0
MD5 85051cf42305694e9081822a85c9db9d
SHA1 9a0d7f1155462e0d8ffdf08d3d82057b538726e4
SHA512 3f9214d83f9c947d8f52e0ce2905f67192e15774a1f79a03729b2c32e955a31d2375c4213277e2623cf1f3f5922dece3733a89981e1eaccdbca1a9c89ae3c848
TLSH
T131E0F11BF3E974DC100D5B80BC6E7602ED4034FD83E840D9C5D01D33B364EA25242B98
MD5 SHA1 SHA512 TLSH

Submit Download

2171031483YattIedMb.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\2171031483YattIedMb.sqlite
Size 48KB
SHA256 2f325027e713e2b434072e33dea1d62d119672414d5cc029ace89bc5d3569505
MD5 e209a7789047e696c8aa3199b086f7bb
SHA1 c9d690f5b03e92b13df90e2b37d8cc403176d080
SHA512 b281a68f9d47e0f887198191d556fe22665e50f422ec492c2f2081eb750125340a8361a2fe21104de3b515972cc066e379c1396c249eb656821a61efb3f00760
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyETBM7ES:Oa16S6CKnqlizbxV+2xVeU7X2B0TBM
TLSH
T19923A18E3F06F511C53AF0B1B8A48C52B85E321D07222AD579D0DAE4C8F2116FE5F976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m1lvo8db.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 6397bf0b23dbd08912674acff2e41ce7d9dfade742ed97ea79e2f3f4fb73a6d2
MD5 b967b2f2dbf55a450a7a346691b4b73a
SHA1 74c5e7a21f78eaeb7ba5ceefdfaee436a862747c
SHA512 b2b201ba8eaebf9fae9880de6c7a446c054ff0120b434b377772b8a05b2c246fe9d1692578ae682a96405817b2d0bc6ffe28bdb56c5c8f04d68e91568c863cc2
SSDEEP 49152:hx2gozYJFuUGD/Yf9/9RvrS9jorvxCCPuYX:DDZlFrS9jiJ/PuYX
TLSH
T1B3362AF820D1A257F3814033664593EF21EFD00C6027DA085BE956E9A578CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.def

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av-vps\config.def
Size 561B
SHA256 35399608c4d9a10e093b28095dc917891daf3ca37d9e0629ec8a72b66d9b14f8
MD5 0eeab83c0188952d4db11ff2b11e9b07
SHA1 d0b790d1efbf283e07bc7d15eac356640ce78b8f
SHA512 3f7f31fe1033ad0381df3fead547e55d06d70a7462797daae7f43bf4768e1abfd5a054430e8d089fefc71d37b0a00733c90c0c7b5d845d1f8205f2b1972359fb
TLSH
T1EDF026F74949640F4961D9D891265AC4AB90028049C2DC219B51774B9FC9BA41CFF5B9
MD5 SHA1 SHA512 TLSH

Submit Download

icarus_product.dll

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av-vps\icarus_product.dll
Size 1.3MB
SHA256 f72207de8ffeb10b514238eda0e70200436887c91c459456ad1b80fcfe4fb23c
MD5 e6d6c536da124ead887723cfca93668d
SHA1 ee0f4eefbc6c8e134f9f3f5efa4624f58b0b6494
SHA512 fd172d46afdf29eec974c7e8f7231f732cf455db09848996e3b3d7f738853b6798f6e076122acf1afb4bc1e7957e9fc87c32cb2255a8fd5d8b4cdf761606af1e
SSDEEP 24576:X+alDv4KOL+a62q2idq1hIRNnz5Wgh0lhSMXlGHxceqV:ualDvNgp62q24qQRLEN
TLSH
T1B2558D1A7AAC41F5C6BEC13989A3891EFAB17451436197DB66EC8E091F13BF11E3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av-vps\product-def.xml
Size 66KB
SHA256 e6d80482efa10f6a2061f281039c7c224c028293461a9a8019a7ba68cce72724
MD5 5323d39e89e93d639d12b4da18eb9864
SHA1 53df5c68be79f8558663390c140026a6f5d9c8a6
SHA512 cd1111c69b33c6d16831097eb1b1a81758a36929964c144c96e079bc46ee271644bd243f87a588bf79d95194dc4af8042d4a9a9caf57a468bfddf6fff4e4d0ef
SSDEEP 1536:fbtZqt7rI7Ih7p76IZtBb3M6mqdF5wAaJu5y3K1nJX0l9qB8vipvyNx27jg8AtpA:wnypZ+WR7u
TLSH
T12F63E36A77DF7D6A318B50D7E444BC84A3CFEC788AD80853B5337580991ADE29D2CA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av-vps\product-info.xml
Size 5KB
SHA256 c39229c4e0e31f3895bb3b9dd35ba0c406613713f2c04e90b594346f343b9244
MD5 0d8cf0e84a981d139f182e8bc33bff47
SHA1 595a59954d2e3cc0bc66687339bd876a483346bd
SHA512 544858cff02b49c33287987e043eb861ab1f7863ddfd064efad9fb2b940f36e1a53372ed23631ff09514e71f35e1f1037f5b29a74142ce216c72a95da7c5c82b
SSDEEP 96:AzYThOOX1SszOy7noU8w2OkQuzEsj33Bk0UdffCDm/eySVpV1+3M:AzYThOOFSsqy7noU8w2O/uz73xk0E3Ch
TLSH
T149C1CBB2282DFF37711F80D7B4D9B982629FFC5D9EC40C17810B3680A3AB969690D975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.def

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av\config.def
Size 975B
SHA256 cabc23f92527687c014ed8697b5deb1ee5975eaff8d98cab9250cf7b99caebca
MD5 31223052055645fdac8d7bd1db14f9b0
SHA1 8ded25087ae703cc7bb7eb376fb5c5432baf2dbb
SHA512 b6db45d07541a674bfbbe79b6b047cf83e6095cd1991f39b1b4cc7cb959d7878e26aabe7b7e87c64b155ae582b130ae9a2a7bbd42e34817c1f7683f660435823
TLSH
T1F01114A7C110941D1D21A4D5602FD2C4DA9001CA4DC6D8518A51464FFF92BB429EF1BB
MD5 SHA1 SHA512 TLSH

Submit Download

config.def.edat

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av\config.def.edat
Size 42KB
SHA256 c9d4d0c55084bc8f3503fe91d9415ce9d9a6e7aa761ad06a10aa64d099bb0de9
MD5 99b9510bded48e43794861228494fc2c
SHA1 1cc0b15f91ef4aa74d9ad8cca1a5a23988938d08
SHA512 3c53ae62edbe42f2e9075505fa880cf4a9daf583e67fdcf72cd7774854a2ced7b75f23453f6a9628463b435dc982b7c45af19235a29c07fac2994c2e36099f69
SSDEEP 768:fll1bebRmco72DSrbxJu/kdYqbqo1IzJc/E6v562PiyoNG:9l1SbRmcoS2yOIzJcM6v562PiO
TLSH
T16B136BE347510A6C9DD6D2EA9DA6F2511CB774C998C0C4A1C7C0DCDEAE70793708E26B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edition.edat

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av\edition.edat
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

icarus_product.dll

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\avast-av\icarus_product.dll
Size 7.7MB
SHA256 ab0fb39f65a7764efbe552689300b5ff25115600d17707233ba83c894d81829e
MD5 3ad62267fcd509bf5938bfbea7123eb3
SHA1 2c5191e748444927cb3460f50425487bd15c8370
SHA512 55a99226f4bf2cf8139080a119f65890482465f9395ac432d90a0b9bd78c2175fe7c991448922708e22d85a7eac11993eeddfc785bd8c1b55f1a572fa90edeb4
SSDEEP 49152:P2dWHbl4Lz0wofcBnvS8QRjQ7UErDU5idSei0C1nR1AOY0Rq/OQjxqbPMulz0KfD:QytLl8XMy7GLVolwV2jeHQJUKQD
TLSH
T18C865A1E7A6D00A9D1BFD1788657950BEEB178A94335A3DB56E08E190F13BF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bug_report.exe

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\bug_report.exe
Size 6.3MB
SHA256 f60160b99f07fe70454382d6f74eeee21264a3f8f853d10e305a8909cb6a4c92
MD5 29789a9d6df79a9445f5bf5fbdd87fe2
SHA1 1b6bec57661ffecf2394f41198c373eda37d33d2
SHA512 804a8efba4cc55956190dfea884e1573374d8e9575483e433742d2de8295e7fea36b4ccacb9201e74f0f72118ccd2db9a7aa5f1d58a77708358b2f44a9da22f4
SSDEEP 49152:92dJHVl4HiAn2UheYeIQDtJ/SUeB1k6Y26Q2or6cR4GCivE/kWQT5BRHxysfBuyY:b1iekJ8rr447Eb9KOoD1/1g0mqcbI
TLSH
T1EF668C1E7A6D00F9C1BFE1798A87950BEAB17852033597CB66E18E550F13AF19E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dump_process.exe

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\dump_process.exe
Size 3.9MB
SHA256 bd9a56bce5fc2345355d10a457414fcc6e275daee24337c2da0c88ce1af6cad1
MD5 aeb6910cbaa7015a90371eb989d296e2
SHA1 dc81f0575c9cc0f2f7321fb41452090a653ab833
SHA512 e478fd6189dc6f43abd872173ceaddfcf022abc638bf4f36bbdf4525e0e7ca0e67f1473722ce6b668a78c720f0e194bcd1d9e67f5658c114bce38edcd7688983
SSDEEP 49152:IuXGfh+DIJ3wv7oAQ4ki0ixM0H7wfdyTfD5TAlNtNtMtU+pfTy1dyGJCXN0b5ntg:II7v7ThN0
TLSH
T1D2166C0F7A1D00E9C1FEE17D8A8A550BEA713C96433597CB66E09E590F23AE15E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\icarus.exe
Size 9.3MB
SHA256 97427e9692e0c5ec88752a2a048c0ffb4d534a961ccb762939e4efb0bdafe7d5
MD5 97a5abddd81705a39b6afb080cd3a2f2
SHA1 576680b61d850f57b7638960a834d6938cc6d24f
SHA512 88bbf95a41eed263c59684a115a522a89ba0ef18073012382b186d8303a7460708e047147c3f1cd229c8e4c4bc55b09b62f549722fd34a329ad4e69aadd73aec
SSDEEP 98304:+j+3Tf+cUvglKasRQazXER/h/PPy8HSLWD8Qj:+j+3Tf+pvrmUXER/h/PPy8yLWA2
TLSH
T186A66C1EBA6D01E5C1BEE1788647940BEE717C95033997DB66E08E561F23AF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_mod.dll

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\icarus_mod.dll
Size 16KB
SHA256 52e07dfe261985b53d95759721c6ec3dd7af79d6a8ef646058f825f009aeaa68
MD5 65f14473143dbe869bc2627084534616
SHA1 be26a21b83035c8e97030685327d78be618a3f23
SHA512 3f4967aab7904ae1c20b390a9758510a64669ec568949fdd38f90c1751768bc0b5f2734ae10b3592837aae2ff05fbc4cd829a3e6ddc1fe09fd3ea38b64c53795
SSDEEP 384:3DYO+foCqpwKNsZqnkwn7ldei2WSx7bLus+:7CZqnfuAmbL
TLSH
T12F724A473F246642EEC78D74B4C88BB7AD7072726F6144D719304198ADA1BD23F6902F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_ui.exe

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\icarus_ui.exe
Size 12.4MB
SHA256 0e76cfd4740a474d0a6ab8732b29b59b7628cf486fb6a96887c4d1badff3f33e
MD5 e6c14d4f0aaf707addaf35bdfa631463
SHA1 03f9ac8496ab135cf338035ea70d82384510da82
SHA512 580be70958908162373d0c1a4df93291629d68e3f1ca8414f1f7ad933c504494710506620dc1b69e04f73d2835c8ab0f8a66fcc2ec02d6995cb7fda710b77ef1
SSDEEP 98304:Ixh9LfRtNqt/u+HKLoQXZgrwLX2zXm2dlA2SnnPFCrqNvIpE:IzJfRtNqc+qLoQXZgaXcD74PFCrqN2E
TLSH
T1BED68D6A76A480D5C1BFC07CCA5A950BEBB37895133097CF12E25A5A1F276F09E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\product-def.xml
Size 2.0MB
SHA256 6f602eeb3bfd60d490712d3b06e5034c7c8856c0a21959feb3e90110a0a5aff4
MD5 d093d298df19a3b76ac948192c7e46b3
SHA1 d72b869f9f425e7e389b78426bf9ffbb1b14fe18
SHA512 e5ff7c76fdb8da07fd00703a3b5e68a818543726d6b58d0d1d55df4e79248f66c3fb7f2c0a07bedf43638db043a0e935008ff56c79816f3722510c7e98a57a8c
SSDEEP 24576:7zcyzlo9d33UpVKuZsTctAAfFELojOBV0LM2Y:7z7znVvEqxDY
TLSH
T1AA955F76359E7DAB714B50E7B880BC80629FED788AE01C53F1B33240A653E725E75A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\product-info.xml
Size 12KB
SHA256 14e3ac160cf77f731aa891b556f4624f641a1198f9da9a542554ce9f99da6ce1
MD5 57dceb27d5c01526af77df1c75bb48e1
SHA1 5ac541a3f0b83c82e9eec910ddb45a396eceb284
SHA512 3c976544bb4a146998ee4706f12d8077c2e06309adc51a10e955902ce736f073400555b02b4a7af20e05bce7904d1070941d62fb2ce4392a99ba8509edc5713b
SSDEEP 192:dYlhOQFRXmZmNp49Sjgb+uNHmU8w8On2zB3xe063Cw/eY+Dzv9W80ajsWcNvGPkO:d6NomNpezNX8JuB2/1WpaICsB0bn
TLSH
T1F6424372251CFF2B761FD497A5D1BA81229FFC3D8BA80807F1273180B26F579A909974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupui.cont

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\common\setupui.cont
Size 605KB
SHA256 bc1a77abf724afdcc8a78bb2b66883bcc5b05ad381e6b114a2bc10876318e29e
MD5 24bb90bf58e001e8ae6082d6b26b4142
SHA1 ef9bdaf7fe74b37f41b1a8f969db5b6ffa68772e
SHA512 e9fed88ddc63d09f52f797b53ffba6a769c5057d8966dfde1ea1277527b8a16b20519afd610071808dcfd6604925ce067495b7897e246ddde95a3ff7abca175d
SSDEEP 12288:e9c///Q43ebnYx6C7g0+7yQcRsPF2HSiGcJu+Y7nPb/ET9OxjO:H/QdnY8C76VcIcyPPbcT4jO
TLSH
T19ED423E9F2AA1852924D921EF7DC3C962C1AD472C45F8BAF9C3F784408C161D8CBF665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpid.edat

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\gpid.edat
Size 7B
SHA256 98b48cc449adda0174b82b5bc4ac9179cb8fff98add04dcc14d0422d5b3908c7
MD5 585c03383897322264239eed29ffb5cf
SHA1 949cbae2ebbfbdb315c4eecff6be0ac8bd83b88f
SHA512 d23ab0becc53c5ce98a45afff600ce178339eac91889b3867baeaea424c7044a80218ea1752f1195d2c397f06e910a5c68ac1e465263598433f03524ba676568
MD5 SHA1 SHA512

Submit Download

gpud.edat

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\gpud.edat
Size 6B
SHA256 3f42931cd0bbebbe3198dd8b8c11305c50a63f9575254c9d44aacc918eb7ae09
MD5 252842cfac83631f3184d7c071b2c26d
SHA1 d27b6cb5675c99421885a51676be9658de336b46
SHA512 b641dc789d6ab8d9c80d11cfce7a639f74641366647a565b29167ceeef055f7df4561bae6b6065e084cc12f3b0618f654f833bf9957d7ab49c15d176551bd6f6
MD5 SHA1 SHA512

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\icarus-info.xml
Size 2KB
SHA256 63f2eaffaffa8ac2e9b77f0188ba4c9ee2a2f66d156731748499f809c8c652f6
MD5 b6514380e900a51cf626640cf1d1570f
SHA1 8061383c3db77fd07193fa97c195b53a6260302e
SHA512 667e235ace523b6d68ef719bda174de1e3af8550f4271211383f954bdde048b0957b83a22688a624edcdcde9ddc0e6bd0f77332ccc798199e12b7d963f983e12
TLSH
T1A7515F78723D9E5B772A68EFB084F8C137DFBD964BE44653120BB111EC2B6F92941120
MD5 SHA1 SHA512 TLSH

Submit Download

package.edat

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\package.edat
Size 2B
SHA256 27a26bca625b223971909dd88fc93faeb050dc5b34d91c0871661740dcfb9d18
MD5 aac1259dfa2c6c5ead508f34e52bb990
SHA1 8ccb8a3f7ac5bd9c4f1ab74cb453f7f32903fb1b
SHA512 2a404c9768dc86190bcc7c98645afa7b6f74488371b974d14da48d7379b2cfae6c8c5bc878ed17d0f9f4c4e62138bfe416cf9a1be31eab07e062c0f5f55ef811
MD5 SHA1 SHA512

Submit Download

skup.edat

Path C:\Windows\Temp\asw-63e67edd-4826-4846-968c-18ccaf4cbe2f\skup.edat
Size 8B
SHA256 21e21939386de29943d6a7128d10c9bb4cbab8ca949698394c6d583912e74e4a
MD5 e3d5dd4fa9db9ef78ce048492c97739c
SHA1 e974733d553cf23430023f4b7b770dc7c17378ec
SHA512 678a9776934cecc34ce353bcaf624d5800200e76d01005172ac816d217d9172f8dc590a2f3e6e117144ee56c4746b2d57103d72bfdd19e4b48400f611675a170
MD5 SHA1 SHA512

Submit Download

avast_free_antivirus_online_setup.exe

Path C:\Windows\Temp\asw.3dc39437bca4f4c2\avast_free_antivirus_online_setup.exe
Size 1.7MB
SHA256 a9231f1b9e153385a6c815f083f8c94d5b727fe87b78baa14b66068fe2014f96
MD5 a03af46fe1f96531483dd8e752f2107a
SHA1 52e00286a8e306eb3776bfabc56196eeeea49eb6
SHA512 00b05fab22395832fe60a9adbb6292e33de02826213d0fed0817e8f80ccd0423f16d71789c96244aea5374af0496e30525e1e0711f2dfc51812f8e69e077d4c5
SSDEEP 24576:9PyCPzxe5WpAjgDgygip+7q5SqCTPMRHWr0Ih0lhSMXl6LqXpBB2VZwIrekbCu:hPLxe5WRy7MSPIR2r0d6IBSZ9rekb
TLSH
T16B859E303E46C13AD49A05B2A56CFBAB866DEEB04B6140C773F07F6D6D305C22A35667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eclk.edat

Path C:\Windows\Temp\asw.3dc39437bca4f4c2\eclk.edat
Size 32B
SHA256 277dc660d235ad541b0c6e3975bb3aa97495bedb33ebd111d1eb811709d6353b
MD5 d41463955d361f795d3ecf636973da2c
SHA1 6d37f5e32f0ecf5028435d5f2226def3f621c7ae
SHA512 d5a4e691be15205921046d1aae7b90fb37a0f010998c96cedac643461a1e596c4cf4b32f69527e04cb86ebb5e359e63998c618083675e6fe8593ae199b5914f9
MD5 SHA1 SHA512

Submit Download

ecoo.edat

Path C:\Windows\Temp\asw.3dc39437bca4f4c2\ecoo.edat
Size 21B
SHA256 4e8cd3171db050b69b6c8847ca1dd4739a0aaac0050f6c510f8bf894fff39b00
MD5 78489803e8ba47cd0a873c9c1f6bdcc5
SHA1 71ba954b60443992e598adb073ce91691cce71c2
SHA512 2fa388bd711b1f4210c4ea907f770961d32fe2aac5b7a9c00920d733cce3a7f4560b45a4ff474b0e6ee701e303bdf8d81404d09a9b65a01ca95af5d0d8381c0c
MD5 SHA1 SHA512

Submit Download

memory/620-904-0x000000000D7C0000-0x000000000D810000-memory.dmp

Download

memory/3152-656-0x000001EA9D340000-0x000001EA9D440000-memory.dmp

Download

memory/3152-111-0x000001EA940A0000-0x000001EA940C0000-memory.dmp

Download

memory/3152-67-0x000001EA801E0000-0x000001EA802E0000-memory.dmp

Download

memory/3152-66-0x000001EA801E0000-0x000001EA802E0000-memory.dmp

Download

memory/3152-65-0x000001EA801E0000-0x000001EA802E0000-memory.dmp

Download

memory/3152-92-0x000001EA81CA0000-0x000001EA81CC0000-memory.dmp

Download

memory/3152-70-0x000001EA818C0000-0x000001EA818E0000-memory.dmp

Download

memory/3152-71-0x000001EA81CE0000-0x000001EA81DE0000-memory.dmp

Download

memory/3152-336-0x000001EA97000000-0x000001EA97100000-memory.dmp

Download

memory/3152-1046-0x000001EA9DFF0000-0x000001EA9E0F0000-memory.dmp

Download

memory/3152-774-0x000001EA978A0000-0x000001EA979A0000-memory.dmp

Download

memory/3152-1044-0x000001EA9DFF0000-0x000001EA9E0F0000-memory.dmp

Download

memory/6452-1363-0x0000000004930000-0x0000000004966000-memory.dmp

Download

memory/6452-1373-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

memory/6452-1374-0x0000000005900000-0x0000000005C5B000-memory.dmp

Download

memory/6452-1369-0x0000000004F40000-0x0000000004F62000-memory.dmp

Download

memory/6452-1378-0x0000000004B70000-0x0000000004B8E000-memory.dmp

Download

memory/6452-1372-0x00000000057A0000-0x0000000005806000-memory.dmp

Download

memory/6452-1379-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Download

memory/6452-1365-0x0000000005070000-0x00000000056BA000-memory.dmp

Download