b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

Resubmissions

03/07/2026, 22:47

260703-2qgsvac18n7

03/07/2026, 22:28

260703-2dtxmsgy9x8

Analysis

user interaction
yes
max time kernel
641s
max time network
646s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/StdUtils.dll
Size 100KB
Sample260703-2dtxmsgy9x
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
180	5852	firefox.exe

Executes dropped EXE 4 IoCs

pid	Process
5096	hwi64_848.exe
5380	hwi64_848.tmp
3036	HWiNFO64.EXE
828	HWiNFO_x64_215.sys

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral6/files/0x000b00000001c7f1-1213.dat	upx
behavioral6/memory/3036-1220-0x0000000140000000-0x0000000141EDD000-memory.dmp	upx
behavioral6/memory/3036-1233-0x0000000140000000-0x0000000141EDD000-memory.dmp	upx
behavioral6/memory/3036-1248-0x0000000140000000-0x0000000141EDD000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\HWiNFO64\is-1MU5M.tmp	hwi64_848.tmp
File created	C:\Program Files\HWiNFO64\unins000.msg	hwi64_848.tmp
File opened for modification	C:\Program Files\HWiNFO64\unins000.dat	hwi64_848.tmp
File opened for modification	C:\Program Files\HWiNFO64\HWiNFO64.INI	HWiNFO64.EXE
File opened for modification	C:\Program Files\HWiNFO64\HWiNFO64.EXE	hwi64_848.tmp
File created	C:\Program Files\HWiNFO64\is-TD29U.tmp	hwi64_848.tmp
File created	C:\Program Files\HWiNFO64\unins000.dat	hwi64_848.tmp
File created	C:\Program Files\HWiNFO64\is-B8G9T.tmp	hwi64_848.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\hwi64_848.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1008	4684	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hwi64_848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hwi64_848.tmp

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral6/files/0x0005000000000558-1158.dat	innosetup
behavioral6/memory/5096-1172-0x0000000000E10000-0x0000000000EEB000-memory.dmp	innosetup
behavioral6/memory/5096-1191-0x0000000000E10000-0x0000000000EEB000-memory.dmp	innosetup
behavioral6/memory/5096-1223-0x0000000000E10000-0x0000000000EEB000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 37 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\hwi64_848.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5380	hwi64_848.tmp
5380	hwi64_848.tmp
3036	HWiNFO64.EXE
3036	HWiNFO64.EXE
3036	HWiNFO64.EXE
3036	HWiNFO64.EXE

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5852	firefox.exe
Token: SeDebugPrivilege	5852	firefox.exe
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeDebugPrivilege	5380	hwi64_848.tmp
Token: SeLoadDriverPrivilege	3036	HWiNFO64.EXE
Token: SeLoadDriverPrivilege	3036	HWiNFO64.EXE
Token: SeLoadDriverPrivilege	3036	HWiNFO64.EXE
Token: SeDebugPrivilege	5852	firefox.exe
Token: SeDebugPrivilege	5852	firefox.exe
Token: SeDebugPrivilege	5852	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5380	hwi64_848.tmp

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
5852	firefox.exe
3036	HWiNFO64.EXE
3036	HWiNFO64.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 4684	5968	rundll32.exe	90
PID 5876 wrote to memory of 5852	5876	firefox.exe	108
PID 5876 wrote to memory of 5852	5876	firefox.exe	108
PID 5852 wrote to memory of 2376	5852	firefox.exe	109
PID 5852 wrote to memory of 2376	5852	firefox.exe	109
PID 5852 wrote to memory of 2376	5852	firefox.exe	109
PID 5852 wrote to memory of 3484	5852	firefox.exe	110
PID 5852 wrote to memory of 3484	5852	firefox.exe	110
PID 5852 wrote to memory of 3484	5852	firefox.exe	110
PID 5852 wrote to memory of 3484	5852	firefox.exe	110
PID 5852 wrote to memory of 3176	5852	firefox.exe	111
PID 5852 wrote to memory of 3176	5852	firefox.exe	111
PID 5852 wrote to memory of 3176	5852	firefox.exe	111
PID 5852 wrote to memory of 3176	5852	firefox.exe	111
PID 5852 wrote to memory of 3408	5852	firefox.exe	112
PID 5852 wrote to memory of 3408	5852	firefox.exe	112
PID 5852 wrote to memory of 3408	5852	firefox.exe	112
PID 5852 wrote to memory of 2944	5852	firefox.exe	113
PID 5852 wrote to memory of 2944	5852	firefox.exe	113
PID 5852 wrote to memory of 2944	5852	firefox.exe	113
PID 5852 wrote to memory of 2944	5852	firefox.exe	113
PID 5852 wrote to memory of 6892	5852	firefox.exe	114
PID 5852 wrote to memory of 6892	5852	firefox.exe	114
PID 5852 wrote to memory of 6892	5852	firefox.exe	114
PID 5852 wrote to memory of 6892	5852	firefox.exe	114
PID 5852 wrote to memory of 3800	5852	firefox.exe	115
PID 5852 wrote to memory of 3800	5852	firefox.exe	115
PID 5852 wrote to memory of 3800	5852	firefox.exe	115
PID 5852 wrote to memory of 3800	5852	firefox.exe	115
PID 5852 wrote to memory of 1364	5852	firefox.exe	116
PID 5852 wrote to memory of 1364	5852	firefox.exe	116
PID 5852 wrote to memory of 1364	5852	firefox.exe	116
PID 5852 wrote to memory of 1364	5852	firefox.exe	116
PID 5852 wrote to memory of 6220	5852	firefox.exe	117
PID 5852 wrote to memory of 6220	5852	firefox.exe	117
PID 5852 wrote to memory of 6220	5852	firefox.exe	117
PID 5852 wrote to memory of 6220	5852	firefox.exe	117
PID 5852 wrote to memory of 3416	5852	firefox.exe	118
PID 5852 wrote to memory of 3416	5852	firefox.exe	118
PID 5852 wrote to memory of 3416	5852	firefox.exe	118
PID 5852 wrote to memory of 3416	5852	firefox.exe	118
PID 5852 wrote to memory of 4712	5852	firefox.exe	119
PID 5852 wrote to memory of 4712	5852	firefox.exe	119
PID 5852 wrote to memory of 4712	5852	firefox.exe	119
PID 5852 wrote to memory of 4712	5852	firefox.exe	119
PID 5852 wrote to memory of 6324	5852	firefox.exe	120
PID 5852 wrote to memory of 6324	5852	firefox.exe	120
PID 5852 wrote to memory of 6324	5852	firefox.exe	120
PID 5852 wrote to memory of 6324	5852	firefox.exe	120
PID 5852 wrote to memory of 4120	5852	firefox.exe	121
PID 5852 wrote to memory of 4120	5852	firefox.exe	121
PID 5852 wrote to memory of 4120	5852	firefox.exe	121
PID 5852 wrote to memory of 4120	5852	firefox.exe	121
PID 5852 wrote to memory of 7160	5852	firefox.exe	122
PID 5852 wrote to memory of 7160	5852	firefox.exe	122
PID 5852 wrote to memory of 7160	5852	firefox.exe	122
PID 5852 wrote to memory of 7160	5852	firefox.exe	122
PID 5852 wrote to memory of 4832	5852	firefox.exe	123
PID 5852 wrote to memory of 4832	5852	firefox.exe	123
PID 5852 wrote to memory of 4832	5852	firefox.exe	123
PID 5852 wrote to memory of 4832	5852	firefox.exe	123
PID 5852 wrote to memory of 4852	5852	firefox.exe	124
PID 5852 wrote to memory of 4852	5852	firefox.exe	124
PID 5852 wrote to memory of 4852	5852	firefox.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 588
    3⤵
    - Program crash
    PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4684 -ip 4684
1⤵
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4944

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5016

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {683b5114-e7e8-4957-8765-751efb522584} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {2422cfc7-4e45-45b3-a9fe-1fb32e6caad7} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27274 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {c229a29b-aa50-4ab4-9777-4e9d21969e8a} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27274 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 4012 -initialChannelId {acde6c50-08e7-4bab-b2dc-af3e6a9d773e} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3164 -prefsLen 34773 -prefMapHandle 3168 -prefMapSize 270279 -jsInitHandle 3184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {5daeff88-f681-44db-8482-06fc5db6d2de} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1068 -prefsLen 34903 -prefMapHandle 3352 -prefMapSize 270279 -ipcHandle 1064 -initialChannelId {6f6d42b7-44e0-4f2b-9ba8-39a80152d154} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4656 -prefsLen 32952 -prefMapHandle 5016 -prefMapSize 270279 -jsInitHandle 4744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4968 -initialChannelId {57b396cb-bb90-4328-a313-81f67a525b2c} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5672 -prefsLen 32952 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5016 -initialChannelId {029d30b6-9c58-4393-aa64-df77e05b3212} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5844 -prefsLen 32952 -prefMapHandle 5848 -prefMapSize 270279 -jsInitHandle 5852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {8336f436-db1d-43c0-958d-553f9b4f2b6f} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6552 -prefsLen 33071 -prefMapHandle 6556 -prefMapSize 270279 -jsInitHandle 6560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6348 -initialChannelId {6c94be87-bd80-4cf1-9423-d0406d066d3e} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6772 -prefsLen 35111 -prefMapHandle 6776 -prefMapSize 270279 -jsInitHandle 6728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {660cc4c7-2584-4d0c-87c1-f55305190569} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5984 -prefsLen 36304 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4792 -initialChannelId {6b97732d-e35d-4743-86a4-f028141e2414} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:6324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6988 -prefsLen 36663 -prefMapHandle 6992 -prefMapSize 270279 -jsInitHandle 6996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6964 -initialChannelId {81fa8b32-50ca-4709-835d-4e33221933b3} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4744 -prefsLen 36663 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7144 -initialChannelId {89847922-8963-40ad-88f9-bd9b8603281f} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:7160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7092 -prefsLen 36884 -prefMapHandle 7076 -prefMapSize 270279 -jsInitHandle 7080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7000 -initialChannelId {98a3af99-1f96-4cdd-bfa1-171d0f2d66e1} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:4832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6008 -prefsLen 36884 -prefMapHandle 7016 -prefMapSize 270279 -jsInitHandle 6900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6976 -initialChannelId {d287ddfa-1cae-41ff-b7b6-e2115ac3ed82} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4852
- - C:\Users\Admin\Downloads\hwi64_848.exe
    "C:\Users\Admin\Downloads\hwi64_848.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\is-PO5P4.tmp\hwi64_848.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PO5P4.tmp\hwi64_848.tmp" /SL5="$50178,19696902,840192,C:\Users\Admin\Downloads\hwi64_848.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5380
    - - C:\Program Files\HWiNFO64\HWiNFO64.EXE
        
        "C:\Program Files\HWiNFO64\HWiNFO64.EXE"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2676 -prefsLen 36924 -prefMapHandle 5744 -prefMapSize 270279 -jsInitHandle 7284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6968 -initialChannelId {a663eacf-d35f-4ec4-bf8c-af3e4218c71e} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7876 -prefsLen 36924 -prefMapHandle 7868 -prefMapSize 270279 -jsInitHandle 7928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6208 -initialChannelId {85e5186a-99cd-4cff-8480-78e95a03f73f} -parentPid 5852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:6212

C:\Users\Admin\AppData\Local\Temp\HWiNFO_x64_215.sys
C:\Users\Admin\AppData\Local\Temp\HWiNFO_x64_215.sys
1⤵
- Executes dropped EXE
PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HWiNFO64.EXE

Path C:\Program Files\HWiNFO64\HWiNFO64.EXE
Size 10.4MB
SHA256 a43a6dd098681118f856105064865545e91d7c5db17b6864d68ce8e8637c981d
MD5 9e3759d75c92276fad2fa47132f8ccb1
SHA1 44761627a0ae9fdae9509d1135dd12585c027309
SHA512 31984cf6a07e68c1a8d2497cad8f14072bc0df1f396d15e179a64afde1bd055be088c411aa0f6ab946822854b6396b5023d4b8fe4a40119271ff9170fe700597
SSDEEP 196608:KohgrhBncayLBna4aCCRDAJdafKIjAxQ9R0dN1EbQO4nXuaMr5/QV66PL:Er3ncHLgtCCRDAfWKIjAOnSuam5IV66T
TLSH
T121B633FE8131B801C3495DF23111BF308AB9FCA5AE19AF2B526D750CDE3D256FA16621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2503

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\doomed\2503
Size 8KB
SHA256 df64cc2bbc4ea8cc3d918de1ad45c61b21bbcde5cc4f6a0a96a0ddfc4bbeeaaa
MD5 ee5b218778f329aebb23eedd39339113
SHA1 4e02a9bbfb2e591fcb2913cbb3d7fa9d6036602a
SHA512 fb9970d16f77f473689d89250220104e8a6bf16c85847077440f7a2e25cd409606f11e3d6363f41e767b00da3ff34e5bdb980d07c4c062ba53c4c2fa8bcbf6fb
SSDEEP 192:GI78cEiISdQ2vLr0CpW6MMh1jWkphAUKAvIzUIrW29t2Bu3S:H8cBJdJERYhDKAvKrWCt2Bx
TLSH
T138125C376E91730CC957FE51D192B7892D253E6387E2A0EC30241F04D8C8BF9E5AA5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29077

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\doomed\29077
Size 8KB
SHA256 2979741a4fc4913e6719cecd6e45b830795e93f94214e4cc47dc20c5c32909a5
MD5 1f9ddf743007535cbb69395c40d2d748
SHA1 0f161ce796fa87363badeaccae708ecad78034de
SHA512 bd5890bcaddedeec898d99c5509130c68a962186522c0f8d7616a613e6045127e1fc2b0ab65d8ffc5abe79cd147e4b544c742e2780ea79f51e7b0990c6fa6bd2
SSDEEP 192:rB78cEiISdQ2vLr0CpW6MMh1jWkphAUKAvIzUIrW29t2Bu3S:F8cBJdJERYhDKAvKrWCt2Bx
TLSH
T142125C376E91730CC957FE51D192B7892D253E6387E2A0EC30241F04D8C8BF9E5AA5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14E80BA0E319BBB2A3F0DA3D71417F86F818FF9E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\14E80BA0E319BBB2A3F0DA3D71417F86F818FF9E
Size 14KB
SHA256 93dadea6e38f3e9904b05694686c8d51954fb1b6cbaa19d85bc70778740bd112
MD5 3f9b6b36616d8a2aed53843ed35e2395
SHA1 0d5d29ea4a17e6aabaacce257db6d5d726b58c4a
SHA512 67bd06b0b5bc450725ded14816ae1e1e5e7b5632679a1feb4fde477480a9a39e11fcf360e1639dcb509cba89adef457ecf391f8e4e4554e8b578b219b45aa71d
SSDEEP 384:7yMBmpFiG/06veO5np9BtKX5hlHKKX5hlhHKKaPOGnAH:7zBIeO5xtKX5hlHKKX5hlhHNaZE
TLSH
T11452AF379E0175168792A4D2CD0B5EC83F296A93E699E0FC58003A10C28D77EDE97CC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24F419B4583ACD241DC8C894E1F664FD2AD9C813

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\24F419B4583ACD241DC8C894E1F664FD2AD9C813
Size 83KB
SHA256 097e8d3a58df4b4561a963334b6d187c90e52c97c6d682326d081a70f423dbd4
MD5 3efea66060e21212dc1bf408196eab44
SHA1 33c9d4972093c38d0197f31c1ab121a548f7764f
SHA512 a3fe153a52d0259bf8d1a24ca6f295669253e7fb02971eb4bfa159005855cc9d03dd7edceae7910c709900b714584ed6d08ff7eb845f1a5b7cb8645651d42aa2
SSDEEP 1536:9ZrjwrWumjJRZxnAdHPbPoCSVl28wr/H1Yz/B2pOiGGui1kXqiomL2BRf2A8C9ZU:7+WPjJ+kv+M2pOSuiKXqifL2728Zlq
TLSH
T12A8302371DD2336433B49662EC7D47E01A565AD3E027C96790A96C8367D82F039DB38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2880416E001AE15A6F19F12BC9F97DD2924F4F6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\2880416E001AE15A6F19F12BC9F97DD2924F4F6F
Size 156KB
SHA256 d9cd16a184ef3d05c4201c35d347e2b3ab574d5454adea9d3ee984618e7ae3f8
MD5 e28332827b17a90d5282b46985e2e9a7
SHA1 cdf7e2448b7d5acc81008512929de3596760d23a
SHA512 7327e0d69ad42ec6f8d283f3a0487f428947b7063338a383cebab2985dcfab03938ceb01fb749a692dea3508d33f2e4729043e4355bf82efbf142bfdecce772d
SSDEEP 3072:jxEV7x3u7K/cHGUoEHGRJsEtuor/OHGUoELGRhsEHuoF+O:jyxAQEtzQEpc+O
TLSH
T17FF37CDEF3C26331ADD2B1F2809B420A63BEA4155C85185EBA55E7F53E70D4B802BF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63C6FF30EF232F9C07E76968B0F920C460346C5A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\63C6FF30EF232F9C07E76968B0F920C460346C5A
Size 56KB
SHA256 11d85938147cb15c7c142219128e8d3c4475f49c131b1e533ca5d8250dfe6997
MD5 5ccb12ff39f5b3057c5f261aaf007d38
SHA1 a15620ce0d831eced8c65facbc3f2a47a13e0ea0
SHA512 5313574b43cc4b60b01b926bd936824777f044d6aedf2721539c820995c314e3d73d633a9a51af973d67b229ea201ce80da64fbb5aba8294f2a2d132d81570a6
SSDEEP 1536:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpMhjfoRyxQ:9V4VA7oGR42dmadE6LoRb
TLSH
T10343023AF79030939ED895D100625C557EB538D283F195EC076C5A28A39C7C0B6B79DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79D7B41C2CD9E1628096AEB6214E6F4F792D006D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\79D7B41C2CD9E1628096AEB6214E6F4F792D006D
Size 82KB
SHA256 ba945685cbe1549461a027a2a7266c3801caa999ca2a6be0e22e5fd1f0ce684a
MD5 dc1bd67bed5b790f96ef36d7d801609a
SHA1 4a8182a5b47b8ddd4312a0acd02c7d7e9698adc9
SHA512 3b6f88bce0cfa136c536360cce904edab45244564a418bd3f6e0223e4a3b142d542eb1c578209a8758f22e75afa0bda655db528d860f934d231d77a4ab2db2ef
SSDEEP 1536:kkCI+9iACUcDsSByHXFtZiqVU3/+hnVVtRq+1z0hpTI+AuXkx+R+j0w2hPh:W9BtcDRyVt8gnVVtRq+J8TI+XUxlQ1Ph
TLSH
T1D583023A3FBB6F098593FDC0A3D254480FF47C7F9AA6E9DE21608909D870D96D05B192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8246DD324D568CC8B555787A29E02378C96E88CD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\8246DD324D568CC8B555787A29E02378C96E88CD
Size 233KB
SHA256 5639047a13447cd8800670ea9e51738274406e4f1d80d8912fe08f5b8b5894fa
MD5 ad970a995b5271769a6d51c8a7219eb3
SHA1 3a9ad71e46152be0a36c3407a11bea21760f9922
SHA512 e8a117f0b65421cb64ce2da7459778e292b2d1e0ea0c8a7bb329ed454bb4bce1525c5f8397624e3a64177c159fd09eecbc1bd0705603d1aad80cc8dc87150785
SSDEEP 3072:xRsyyUk/JpyEvb4dxnF/oSx9qYUXvYfvn0YM6y+PC1pWn7SfLoH:xC3G8b43iQqNXvcjM6y+PC1pWn7SE
TLSH
T1CE34F626EE415B53C92007F140EB27363F31E08257A6F32F6ACE7129BD5A3791DA15AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

936AE71F754BFA9F5942D3722681798333D325B6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\936AE71F754BFA9F5942D3722681798333D325B6
Size 17KB
SHA256 8e041ef7fb017ad3c00e83918f98d9f17dae7ab3d34a7e5dc812405e28684a4f
MD5 6ce3d60d9362fa7b29114703888d3147
SHA1 b0b67ea7a23bca66d9150869c1cd68262b19fb16
SHA512 816d0a614d76275fae723b7f54cf52e1be52c960dcdfe4410730b641892a40a9936e76b7b96dda2d0bbb951f926c63e35d95322632915933da5b271244b01806
SSDEEP 384:en/j2AzRZa5wh8dPGuXPR8cBJdJERYhDKAvKrWCt2Bh6M:e/ZzRS08PNGcZJbDKAvKiw2Bh6M
TLSH
T12682CF727994720AA343FF508555F3941C387A23DBF3A0DC30082F0095D97E7A9BAAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93C151DCCA1C51949EAE60B26673E274A0D72AFD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\93C151DCCA1C51949EAE60B26673E274A0D72AFD
Size 799KB
SHA256 c2221b357135423088ff57bb0454b69f50c0d846a0d767188def75fc745318e8
MD5 cb65fe1e0adb3362142c08d6a1b6ab07
SHA1 1abfb3598041f9364d4dce60e6f814009f51f057
SHA512 0d9d4361a4237bb95a3737ab900d166751af72c0405635c11639c83beccb7d4681abc5429628a4969c383706ab7ff3b5b3482c235b46fe685790b9ac252e8b82
SSDEEP 12288:x1keoPPemLP1nHSz5x40tBtF4kIQfKDVwjOZgaTaxvuziGFGsgJdtlYVochR1MMQ:x1z8Pem7VHSzbtueh
TLSH
T1F005F92BFE505E63C82103B140EB27363B39D4975752F32B6ACEB626BC1A7790C6159C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 5362e7b09e2b90424fcf349951e62ba7f5a732020d9ebf7855deae929ea00e37
MD5 a6e45ec643421bf5da7e963a398257bb
SHA1 af718f40e8d0b305231add819237665b8af4844a
SHA512 d4e4ff05a0b7c374c1cc34921088ba83736fd62d2f6937813584e00a6e10c079a888a93f2f479d0248f694fa351f125fc9da0fd8d167aa38a4fd5e0a181b747a
SSDEEP 384:H9XghOiO024Y+o6J+Sl1xDnZBPsac4j0lpDII+kpdM:dX+ZY+o0+Sl7zZlsac4ID8LCM
TLSH
T181528D7E9F0138AA1E63D194D9BD9254CD04A7BBEEE2C06616143C04CE847B9F4F64CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AA3F77CCC50DBADFF172ED31E4365E6DDE47BE44

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\av1ynups.default-release\cache2\entries\AA3F77CCC50DBADFF172ED31E4365E6DDE47BE44
Size 17KB
SHA256 0c87d5561343638c813a0e2fce7206ae0d22700fcf6f70a6ebca2f677de6616d
MD5 20c5a5a935484f6d7248592263b9d560
SHA1 fcaffdfb935cf78b72aa19f7024bffaa9464bc46
SHA512 d778c08f7f76fffdf70c52365dbc25d74a420e81898d7b6d5ba08ca07a39df5ea90208441dafb492e75e93afec61a2f5e825329b38efb2a2c3481535245c86af
SSDEEP 384:Wr3LEqHJ6BHnLRJvPJQlgB8cBJdJERYhDKAvKrWCt2BhPR:WvEC6BJ0gWcZJbDKAvKiw2BhPR
TLSH
T1B882C03A2D50B21C4012FF81D6E5FB442DACAE6283F7F09E30147728EE98BED856B504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HWiNFO_x64_215.sys

Path C:\Users\Admin\AppData\Local\Temp\HWiNFO_x64_215.sys
Size 58KB
SHA256 cc9d399816d0f04548545fa2cc4bb9e8d141624601ac271315cbe92f6e763a1e
MD5 8883d3b198ad93115fe3f5a798a7a09b
SHA1 dcd2e82df8a43c320a0ba8ce6acaf677531f18ff
SHA512 b6ba6e51a315901aee7258b381410aede0f34528e73d93bb56d5c89a61aa28c72e69fed2e58832fbbd39038c663bd2ed74cdd78a9a2a16e9587c02646657c207
SSDEEP 768:Upy4TF+6FVXr4bloDf63rR7Gb4xc5FxCa2F439FlyLGxAaiqg+kJsZK3C09zQ:h4xVFVXr4blobg7vzzBsZKSczQ
TLSH
T163438EA622E840FADD2290B1469E9277F8F570862725FDCF43B4C67C6B037D191383A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hwi64_848.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PO5P4.tmp\hwi64_848.tmp
Size 3.2MB
SHA256 3d7addfb5241f562cf68e4b18611d1f2585df19e24eba13ee5984495d7708e90
MD5 2d42dbb3fcce78bd8173111426dadf79
SHA1 808c2adc0c4ba326d95ff574adf5cdca48f4d9c8
SHA512 ec5d5ee6f472fa864c932c3d23350711f3754145c2551ed0741c327c4b51e36b1f41e7153b2753286d1bc6f3fe2c6cb539921a6799b7d3f27e6547293dad89cd
SSDEEP 49152:tdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQ9333NC:jJYVM+LtVt3P/KuG2ONG9iqLRQ9333
TLSH
T142F55C1BF385713ED05A1A393527D251583BBE707A268C575BEC3A8C8F3A1486E2B347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\AlternateServices.bin
Size 33KB
SHA256 80eca7eda1273c6358ff1a6f785015507c12eff2a8651c986ebec843dc1655ff
MD5 fd6c64479d62545e0ac9ee20b4fd8c67
SHA1 ec0a1a688339c12a8c9f123487de945f904afc51
SHA512 25a62787df2425bb15b156a10a9642260b55053f0c80b4d9b33c1251b978e183b430065e4c24bb166990e7d8fd07bd292774474b765fd8ac881d998e023c6127
SSDEEP 96:qQ4jTFBPZlJI56xxR22yM/pnlFyx2LdpGyuZgAaCk46My8tk2YjvWxWC7aUo8tWj:qeQp22WZZDFtrLtps21jZImk
TLSH
T176F298F7ABB56453F0628FB450A874DD8C33132E5879DA84860490B603D66D9D17FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\AlternateServices.bin
Size 33KB
SHA256 22c3c61a9a456b4b7a12067bcc7d2a7923ce68eb4e2b75b89afb1a09df751cd4
MD5 7fb1a10542513f43f10e055312581d15
SHA1 d17a87bcab86aeb39f69767e73144630025a5d34
SHA512 d3b92f4d3e1f65cd553b83fd119c8b86d7095665baf1ef60e8be94c86e83047a7e0bbf89f604bf5628558ceb3354adc31d33430a4c08433742f87af1bfc93358
SSDEEP 96:qb4STFBPZlJI56xxR22yM/pn9yx2Ndp+SyuZNn7J1nbMy8tk2YjvWxWC7aUo8tWj:qGQr22HZZuFtrLtps21jZImk
TLSH
T1B6F2A9F7ABB56453F0528FB480A874DD8D33132E5879DA84C60490BA03D66D9D17FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\AlternateServices.bin
Size 8KB
SHA256 88c8791a4c2c8863b71c7733ad6c2042b643a8457f8bdc3d9c238d78948b66cb
MD5 c427ee53ba3591f62f2cdf591d96b009
SHA1 19e2e8e6d5433f906f65b08d2c2819e53fc7c61c
SHA512 e9593809e5984f8c55d3323453ca9684c5dccae38e400ff15e32944a4e83aefcaacac922baadf98beb68417a0c508f10978f65c7510e83850d67041117c8addc
SSDEEP 24:6uhMZz91XuGN9B2+q9VvExS9FAx35q9F55A5Gpqu9lMx:MxHvIBQAqJI56x02
TLSH
T1270273E7AB766473F092CFB48098759C8C33172A157D9984CA4490B706D3ADE913EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\AlternateServices.bin
Size 25KB
SHA256 7c2835a0a47b2667eaa9ba5e51d050322a31fa1443ce8ac0c93e1d92c37792a4
MD5 2f679a16769234d7594aea1acb3a2f13
SHA1 689b8fc72e3ec8b551acd64007d241cd3f6d6fe0
SHA512 3c196d0f41b9ea152e76f80ce53fd67bfd2d9b71ce760a8cf0991846cd6b0a1351748f2867d0d12894ec639142bfdbe88d43f08559d9a33ddc0031240fd8944e
SSDEEP 96:qQ4jvIBQAqJI56x02JJ1M/p6lFyx2LdpGyuZgAaCk46My8tkvnjvWxWC7ajv:q5QO22WZZDFt
TLSH
T19EB288F7AFB56463F0528FB080A8759D8C33172A157DDA84C64490B702D2BE9D13FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c57741126102aba6dfec1ae6d73c780808445f2ace76316d872d52b581298680
MD5 787fba4b7026bcc3db6f7fccf4f97aa5
SHA1 c0b13fceb1da5e87b0c35bf2f57b8333e4fe4f93
SHA512 32b2fb01fc9175bf75f66a6e0de5641af9aeaff21415b9c42e7bcb65d9367c991c2fa43b28c32595dc7952621392503907c604bb69c3fd7d726477ed07c131ff
SSDEEP 192:fPOv5zbo7zWZVuyjc+zXhAD1d66JoztdzgCl6mc0dz:fgboGZVuyjed66Joz/zgC1jd
TLSH
T131E13E68E628863FD418437BDCA61B400F39788A9C8E3F1935DD640C2E572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 62442cb1c5f30272e3bbf0126b268c986912dc4b2d0a6f8292fdb12f7e1e8854
MD5 f84ec897ae8365d729e5349fbde9b093
SHA1 f239c26c3605a15d073cc43e5f162ecd279db4f2
SHA512 bc2a0327c349aa8c0239eb673306c0e0653035f287ae668bf73b6868bb88f1e7f817cbc5f261b13a6e2530ebd12f15109a22f863c2829ba3fe895ca2a79fb79f
SSDEEP 96:DF12FR/FRNFRUFRD/dd66JoztdzgClKtmc0d/UUhjJJSdF95/7bkW6ArcEVKFyUb:mXhAD1d66JoztdzgCl6mc0dnPOv5zbof
TLSH
T1B2C1FC28E228563BD419423BDCA61B401F76784BAC8E7F2A31DC240D3E572DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\events\events
Size 1KB
SHA256 36eeda42b4576bc21c6c33af03a3161d0ca75582059e86103a047718d50abd4d
MD5 a5e8374f95fb278c0fb2ce2027edec5e
SHA1 264d92cd4da9c5939346f64f171ef21183556290
SHA512 e84aeb19243a54ed68deca97e4866d4f27122f1f0748bbee200b38a71f8617b831fdaf2e5fae22271fb16c4368657e87897afae1326a4933c484d4add680c0e8
TLSH
T10B217F4CBAFC4D2A58CBE25CF45006CE93954E0B04975D434D42EF8DCDE1ADD316A539
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\events\events
Size 5KB
SHA256 1bb139e8614b2a777486857aec535b0a55513a05cbb8b4168a08b2c61de7d51b
MD5 bf56a7cca333d9d4e7768a1d2f89c4d8
SHA1 2acd422c5930130318641f887a6aaeb7210e69fe
SHA512 188a84617158db3daa7ce7862d420732d9bc11ae4527428be90755c2c1d7d616dfabd208980e87e8f915d5a22666130f6a3c900504b5f996ba486b623a55e907
SSDEEP 96:A458bILmw9G47ke8KdGx7dydia3SxxZOA2+:A45EqkJ0HQZOA2+
TLSH
T160B1FE1DB5BD0C7E299BD39CF8410ACD87D9470284871E474D87EF498D9AA9E321F22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b5f33cf-e30e-48f7-a675-f82df266f245

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\pending_pings\3b5f33cf-e30e-48f7-a675-f82df266f245
Size 886B
SHA256 f42145b0ab621f102901fd7e78d8ff53ba38a25e76822b3979eab4273fdec751
MD5 cde837897fa1f13efa42d60a9d6dcaf3
SHA1 0d39a084efc270d931c282324aa3d5dcfe524a26
SHA512 47fd3c206eba3f5ef8a9aeadf0aa565876a70931e4edf195c43499ce4a33d22b1d9a014ad940d3f63d9576f3d9a66c15aa17802d58add7d5611e1dda2258c0da
TLSH
T126110450457479B2DC7CD24BE4E13B4257E4B42390CA49057D965F184EBF12FA36A702
MD5 SHA1 SHA512 TLSH

Submit Download

55c5efb9-0026-4c60-b7fe-6b3bea15e1c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\pending_pings\55c5efb9-0026-4c60-b7fe-6b3bea15e1c6
Size 2KB
SHA256 d9084f0c543d55940ff35a28308406731f95404402b541826f5286decb6bf6a6
MD5 bcf2114d3642362b3797834938c5f83b
SHA1 4b7fe495aa70f16033913c761587da7014466323
SHA512 1733cb6d8da46e72bb7d22b9ec45b827fbfa56c3ce64054f8d9b28c3793a2f8e643c08c7d70ba6ebdfb0d26708a4a9d9fb75d66fa63dda90fb89ba8dc8456fde
TLSH
T1A941241C38B45D769C9BF58ED482634E67A0990310CB2C432DA2EF0C8E9665D337E52B
MD5 SHA1 SHA512 TLSH

Submit Download

a0c998df-de4b-4fd1-884d-c8d64452a0c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\pending_pings\a0c998df-de4b-4fd1-884d-c8d64452a0c3
Size 16KB
SHA256 55863d8e0ac48ad1dcdadfe554531f0a1c37688868d1e741fe39fd0f353c68fa
MD5 a0dd2415872f5e4cbf822cb29aad6d04
SHA1 aaa6b5e4cde6da023e7af93d94dcb5b55bfde5d4
SHA512 1497a5c47aec3233749b250d7b7c6dfd7b80998f7ba89f8fd9e88d3b1c0e967aaf4d8df4691d2c0e3a8521b20e6e9670e0c4f2236428439918c45b05fa090543
SSDEEP 192:kpNbPWr+GPJHCOeaTIRKDF36JRV+e/cqXDv9gPQ43txFRpBQm1q7Smq0J+1zUiRl:6PWlezAydk0JwzUiRYlif
TLSH
T18472DB565820457A8291E768D4F9BFC3E1F538CF4C419FCA9BE4BD086DDA0AE113784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a36a25a8-b3b8-48eb-958b-262e68cb220e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\pending_pings\a36a25a8-b3b8-48eb-958b-262e68cb220e
Size 235B
SHA256 fefe96617131527eaaf4604aaa873aacfdfeb953cdc90ef3d4dbfa4306a995e7
MD5 c273474d252c62f69a247169c9f232ca
SHA1 4f2d9cdb94019b736322fce3c97c9db1400cd415
SHA512 ff312070b86e925189e9ff1daeb355e78d2f882a31a0b476f757925327c6d7844f2033e6db9824d3d2b7b5dfef46424e6d07ed4b798ce8d66d20c47377622447
TLSH
T121D097806898B32D08101F03B0A16AE2304A8C33247AA810A9A24034AAFCED40361806
MD5 SHA1 SHA512 TLSH

Submit Download

de8f5917-5723-4aa7-97c0-9f2edce3f2cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\pending_pings\de8f5917-5723-4aa7-97c0-9f2edce3f2cc
Size 883B
SHA256 6f3b712984e8aac93094795db7dc504a50cf753ec43a44e03a5d57040a40f469
MD5 cfa9cad6520e873b6e13802778c131b1
SHA1 7b4dedf37fce585ed3c91db69a2e2a4a9afb8091
SHA512 d71d159958dd5fbc611120e04c00d8703af12ce0fb04fa3956cd4f3d111c9ff5e21e7a8f81b10014600faecf3f08d92242191e618162f43f45a52c1804f8b7ff
TLSH
T1101100509230BAB2DD7CC34BC9A53B426BE8B42390CB44113DE25E184D7E11EA36A606
MD5 SHA1 SHA512 TLSH

Submit Download

f4c447f0-338f-4f50-b3e3-612fb784448b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\datareporting\glean\pending_pings\f4c447f0-338f-4f50-b3e3-612fb784448b
Size 235B
SHA256 857700a3c85783e4a9d23980525bf55e0a1c121fadd304aa24e7c3761fb40ace
MD5 ad74b3a31d6de552c568d0793eb7458c
SHA1 814b33fade0526db0d43dcd4aa5df38a842dbc07
SHA512 9a701aad1ecd13a4e3b009ccef249b46cc26452c39fa780cbc8478d9fbd94e7d5dc7386720e064760c2f26386b017dbcb39186b9181b8a9167a9c906d0341cfd
TLSH
T183D0978668A8A36D0C1C0F13F0E0AAC630568C3360B068208A60447C99BEDDA1131817
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\extensions.json
Size 16KB
SHA256 59d5ebc0945dbc7141c2707ed34b21bc8d65359e1efa54d0ffad2fc0267098fa
MD5 8a4d206b412d212657adf6f474060e17
SHA1 fee811b888a63a271fecdfc44b70d81c606a62c9
SHA512 315459936568a1f29108009b970ad88ad97b5c8e6f827a160a33c664f73907f39fbf1591986d66bbf1d45f57e7608e56250ce18c1705f1cfab5ef5f70a47458d
SSDEEP 384:xkI4v3Umldvw8dhWP94zg96otL4HKL4PPL4H3L4HnL4HfwG4h9:CI4fRfJXO4w6O4Y4r4b4r4/n43
TLSH
T17772421545548EB8294EA79BAA367E01C37D533B60845C78F4DD8FC802FB5B902FB62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\prefs-1.js
Size 12KB
SHA256 d02eebd97f0ff7a6e8cfcfcd5c553f87d530282cdbfd446caa84ad4bb054aede
MD5 17ce081b4df83d43cc396fbc5ba49f0c
SHA1 c043278b616003b354e89ad15a8560882aa2a7c6
SHA512 ab8c8d495e9ce6724bb57eac75ad0d07f7f69dd19d186a0a1687f80dfaf30ab7e03557655d5451f773ea9674580485f31d151603fd6a471dc5679a2e929462a0
SSDEEP 192:ybCRGf3ewCXOSS5LRa/CGWOBw88V6445WnF:WJR+CGpwwIF
TLSH
T155429B3891488A3F24F6327DFC2559B11AA1022B77BFBCD606F99486045CF2841E7AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\prefs-1.js
Size 7KB
SHA256 97f677c4ef9af6df4074cba363ee70cef44a100f27184b8cd42251c84a5242bf
MD5 1cdac7b09d75d574eec1a4975d5059ee
SHA1 c7c0d003baa7b9fedda7eae2c32fc91236e66857
SHA512 ad82bf2e12c9a607d79429c304b6e42d4c41e16474d10ea73dbef03f06e4ebb8c387b1849855fd98dfd11bf0a48a9a4cf44bb076a85ceee0f7585642880589c6
SSDEEP 96:xHxCUTUPqGqGffewNbzS3XOSSlndv9jk9neH5/EBw88u8L4cnpAb3GS:ySRGffewCXOSSX5/EBw88U
TLSH
T1E1E12F7890088F7F65B6776CAC6888716AB2013B7BBF68C750B954C4051CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\prefs-1.js
Size 8KB
SHA256 98223ddcd36f776339680a244bbb1ddbf09768d7430ae68bfdcdc5f3811c6f80
MD5 255d24ba4262ef544e0f7ff38534f4a3
SHA1 b8424401a77611ee6267a29627906cb0119d8359
SHA512 08be253c81470079b5e708c5d127056768bbb1c5645c14ca5f5b84b2cb18c1a6ed3ab2f45f8cab11137b814f20eb5da7bbc0aca7cdab27205669972e887b7b66
SSDEEP 96:xHxC9TUPqGqGf3ewNbzS3XOSSlndv9jk9neWRAN9/CGVBw88j4e4wx8L4cnpMb39:ybRGf3ewCXOSSmRa/CGVBw88ke4wH
TLSH
T1A602FC789008CF6F64B6766CAC6449716AB2023B77BF6CD610B99485050CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\prefs-1.js
Size 6KB
SHA256 ee1e7b4fd95e327e587de5c5e8aacdcc12f76447539891c17fb86afe80272c52
MD5 03a9f2667391a717bb95b722ac292f9a
SHA1 4335e4117ba15753b9d363afbf70c4b75fe16784
SHA512 6204d2490fdefe47354efa955f17647b9fe1026be243acff37ee804a22505b013b92fec6f2bf074d12cc4acfb09352ebeac1a1914487f4fe56d185ad5f9e82a1
SSDEEP 96:xHxCUTUPqGqGffew1zS3XOSSlndv9jk9neH5/EBw88u8L4cnpAb3GS:ySRGffew2XOSSX5/EBw88U
TLSH
T1ECE1207890088F7F74B6776CAC6888716AB2013B7BBF68D750B95484051CF3845FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\prefs.js
Size 6KB
SHA256 61722e167107e2c94560b212355e9d9c1506b8ae01ebc1b4188db4891f620864
MD5 e83350802906001401c4038e2bcadfbf
SHA1 d8232ea979894224f3533ecd91091c3cfab15023
SHA512 c97d447059d7f82be6a81fe61b4451503df0a7ac6a99aa666e5ae4721f75e93e8417988c0b3d289b00c89db776476935ec03fa988ab2b890b504027dee082230
SSDEEP 96:xHxCUTUPqGqGffKE1zSgVI0vSSlndv9j3neH5/EBw88u8L4cnpAbO:ySRGffKETIWSSS5/EBw88j
TLSH
T140E1207890088F7F74B6776CAC6888316AB2013B7BBF68D750BA5484050CF3446FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\prefs.js
Size 7KB
SHA256 5087dde6824ca948d90f5510b2ffce2794ee881483c50ab391dcd04fc5f6000e
MD5 a452a0a274528ac7e4baf47ce5c96cb5
SHA1 cb7285fa97621cd66e2c9f378f01a19b7fc269d6
SHA512 49f1daabe3a9b0b6bb7bfbe79c5c0e9f5f5b3568d2fdc6cbc8f5db0ded130f336e4fa8f40852bedb3319c84b9d5e7315eae139d809e3a26272b11ac2d051cf07
SSDEEP 96:xHxC9TUPqGqGffewNbzS3XOSSlndv9jk9neH5/EBw88jc8L4cnpAb3GS:ybRGffewCXOSSX5/EBw886
TLSH
T1EAF10E789008CB7F64B6766CAC6849716AB2013B77BF6CD710B95488051CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\prefs.js
Size 7KB
SHA256 3a38dae6aab0ef7c974852e35b79f8435593d7ac1157bc9ddc087c2c493a2bf0
MD5 6e881fda92779b0327fb178101d9a79b
SHA1 5e74e8b18e41ffa2b96689b30c617147f794ba86
SHA512 e7f28fa5256d68564839669969a1fa72d5f924348d51034fb6466807c5c410db597f283d2bccb468b9c41deea487bc62ba371a01c2b46e72b804701474d0c848
SSDEEP 96:xHxCUTUPqGqGffewObzS3XOSSlndv9jk9neH5/EBw88u8L4cnpAb3GS:ySRGffewhXOSSX5/EBw88U
TLSH
T167E12E7890088F7F65B6776CAC6888716AB2013B7BBF68C750B954C4011CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\sessionstore-backups\recovery.baklz4
Size 22KB
SHA256 f9fc8dd831ae1c70c8b052f996d6ebe5017f84515ba8098de147b4cec93ddd93
MD5 b98e9e4dcb0ed5ee208f2127c54df5b3
SHA1 c9dc164ab24e7ba8e1c1d686be7c737992c8199c
SHA512 f285eefe9256d1080f53aaedf6e06cd07816aeef120d5ae92000ad1275884cea5d7ba1fcf246b81282fa26ddddee546ae4473c9e48038c728b16c9ec2e2fcff2
SSDEEP 384:fV/PQ6pBh/aHkqoqJPnsR1ww0dyEIpsTEl+J7k4+0H/alilaWtkO3vpNPNEwfXT:ZQ2hCEyM+Gc1ZpN1EG
TLSH
T1E6A2BFF5A43CDAA383B5120881F91E466E778C6C46340592D90FBD6C2174F2ADBAF4B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\sessionstore-backups\recovery.baklz4
Size 890B
SHA256 a88ec4d5c2d2ad3439a3d30875aac2c7d47032d027e650f79a802d45a054a065
MD5 50d18436beade6ccbd0a337e7962beca
SHA1 62efaf40c4e479a3108fe0b934225e990afd3b73
SHA512 2df9be432286f9ab98637a6de62f25ea2935a35b308c229d360cb564b768030c755264d216a7c8f919a54100ba3d01238b0ea00986af4386406c05dd35626104
TLSH
T1B21167849D0A61B69602F02DA4CEAFFE4EC4112607361DA0F2CD6700416C39FB5BF60E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\sessionstore-backups\recovery.baklz4
Size 22KB
SHA256 3043406086c8bafbfbebd844eb9b622d7c3b9a1e317eb8459b84e93ce0d5d1b0
MD5 91b96e104a84ffab5b2a20d7949c18f3
SHA1 712d496cb408c26c9707307ff533cf7ab01934f1
SHA512 e286f74d1f6ada279434168c9fdc1cd8bdd0a70b615478ef6cbe2c72f6b968f36fc503840f9dfddeff4934600cca4ec3589a4cd13c6e2f58d68e6447e5e77674
SSDEEP 384:bV/PQ6prGxeaHXqgqJgYcR1ww07jEIpMTEl+J7k4+0H/alilaWtkO3vpNPNEwfXF:FQ5xl3fM+Gc1ZpN1Es
TLSH
T19BB2CFF8643CD9A283B5120C80F91E4A7E775C6C46344592C90FBD2C2574F2AE6AF4F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\av1ynups.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.1MB
SHA256 7e2d814462331bdc185bab785bf751d60dc49fc27da157ebc1047f84115883c7
MD5 19a53a0f9fa44bd07938bf2f3140ead5
SHA1 d2cbd6dc11df107b0b7ef8cc6e77fbc4adedc088
SHA512 215f25526ae69fadd8fe04fd4c984bd42030af81dedcc32e6e99700e7568f36afa8636f22c8f951caeab77743e12a2b400c9f1314ddacb7ac87695c12bd740c3
SSDEEP 49152:5LALyTaeUT6QC5zYYsBYJ577FISuLbBq8hL9rFVmJO0WctxbN351YfYzC/tn4kzB:yC41n4kzrhmfnX7k+
TLSH
T115765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hwi64_848.44TsFJ50.exe.part

Path C:\Users\Admin\Downloads\hwi64_848.44TsFJ50.exe.part
Size 19.8MB
SHA256 be6fa1eb8a394e1782cedc25902a3a2a35d350997a932c99f5e72b9d0ae7b3c0
MD5 3b7e2fe063ebe2efc634db090ca7bf46
SHA1 565c0f4332e0ff797dfdc6150915ac20532ff539
SHA512 da4516d3023382bf9e1e85d84f9252232252c6f20b14d2b70a5548ed55cddf73b60ba3ca66883998f56f91151831e864190f84102296c3878ae91c08fa1091b6
SSDEEP 393216:OfLxytBnt7s8NyVpkp9grABcOlQ3aplnrr1kDvRtEZDrJqHsbp:eq7s8ysmrgc+Qwn1klCDrgmp
TLSH
T142273327A197F03EE15A4F361162B32084FB6E21AD23AD5786E8A09CCF3D1505E3E757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3036-1220-0x0000000140000000-0x0000000141EDD000-memory.dmp

Download

memory/3036-1233-0x0000000140000000-0x0000000141EDD000-memory.dmp

Download

memory/3036-1248-0x0000000140000000-0x0000000141EDD000-memory.dmp

Download

memory/5096-1223-0x0000000000E10000-0x0000000000EEB000-memory.dmp

Download

memory/5096-1191-0x0000000000E10000-0x0000000000EEB000-memory.dmp

Download

memory/5096-1172-0x0000000000E10000-0x0000000000EEB000-memory.dmp

Download

memory/5380-1222-0x00000000008A0000-0x0000000000BDA000-memory.dmp

Download

memory/5380-1192-0x00000000008A0000-0x0000000000BDA000-memory.dmp

Download