127af692b380aed33a0b8a420e7054fa4abb8429ceb477f99207cbba070d92b4

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nature.exe
Size 3.6MB
Sample260704-ractvaf12x
SHA256 127af692b380aed33a0b8a420e7054fa4abb8429ceb477f99207cbba070d92b4
MD5 33cdce908ea8c8035297561a603acb11
SHA1 266ee6e11174c6cf19d3a8930d56e1554f9e349c
SHA512 95d1cbd5ba33d6b776733968301bcc10b54e9f0cf25cc9976ae68cbb841fff45b7757165b751562cbdbe11f95b342d311a02ec15e00abdeed075366bc8d7165b
SSDEEP 49152:w41IhnI3KMy4PmiqjDY+PppYF6jCc1nFSeDF+mGTCDG2GrtsElKkegqzIL0o:1S19FnuokpEG24xKkszIgo
TLSH
T14906CF92F39141D8C667863C8663EB17E7367C051B115BDB3290BA252F33BE16B3A352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 33 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 8c00310000000000e45c1370110050524f4752417e310000740009000400efbe8158443be45c13702e0000004c0400000000010000000000000000004a0000000000228f6c00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	Nature.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "3"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 80003100000000008158443b10004d6f6469666961626c6557696e646f777341707073005c0009000400efbe8158443bdd5c19532e000000c50400000000010000000000000000000000000000007ddfb6004d006f006400690066006900610062006c006500570069006e0064006f00770073004100700070007300000024000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WClientv31.0.apk:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe
3456	Nature.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	4224	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4224	AUDIODG.EXE
Token: SeDebugPrivilege	6048	firefox.exe
Token: SeDebugPrivilege	6048	firefox.exe
Token: SeDebugPrivilege	6048	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3456	Nature.exe
2112	OpenWith.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
4092	OpenWith.exe
4092	OpenWith.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 6048	3096	firefox.exe	92
PID 3096 wrote to memory of 6048	3096	firefox.exe	92
PID 6048 wrote to memory of 2404	6048	firefox.exe	93
PID 6048 wrote to memory of 2404	6048	firefox.exe	93
PID 6048 wrote to memory of 2404	6048	firefox.exe	93
PID 6048 wrote to memory of 1540	6048	firefox.exe	94
PID 6048 wrote to memory of 1540	6048	firefox.exe	94
PID 6048 wrote to memory of 1540	6048	firefox.exe	94
PID 6048 wrote to memory of 1540	6048	firefox.exe	94
PID 6048 wrote to memory of 252	6048	firefox.exe	95
PID 6048 wrote to memory of 252	6048	firefox.exe	95
PID 6048 wrote to memory of 252	6048	firefox.exe	95
PID 6048 wrote to memory of 252	6048	firefox.exe	95
PID 6048 wrote to memory of 4760	6048	firefox.exe	96
PID 6048 wrote to memory of 4760	6048	firefox.exe	96
PID 6048 wrote to memory of 4760	6048	firefox.exe	96
PID 6048 wrote to memory of 4872	6048	firefox.exe	97
PID 6048 wrote to memory of 4872	6048	firefox.exe	97
PID 6048 wrote to memory of 4872	6048	firefox.exe	97
PID 6048 wrote to memory of 4872	6048	firefox.exe	97
PID 6048 wrote to memory of 1892	6048	firefox.exe	98
PID 6048 wrote to memory of 1892	6048	firefox.exe	98
PID 6048 wrote to memory of 1892	6048	firefox.exe	98
PID 6048 wrote to memory of 1892	6048	firefox.exe	98
PID 6048 wrote to memory of 3680	6048	firefox.exe	99
PID 6048 wrote to memory of 3680	6048	firefox.exe	99
PID 6048 wrote to memory of 3680	6048	firefox.exe	99
PID 6048 wrote to memory of 3680	6048	firefox.exe	99
PID 6048 wrote to memory of 5912	6048	firefox.exe	100
PID 6048 wrote to memory of 5912	6048	firefox.exe	100
PID 6048 wrote to memory of 5912	6048	firefox.exe	100
PID 6048 wrote to memory of 5912	6048	firefox.exe	100
PID 6048 wrote to memory of 4060	6048	firefox.exe	101
PID 6048 wrote to memory of 4060	6048	firefox.exe	101
PID 6048 wrote to memory of 4060	6048	firefox.exe	101
PID 6048 wrote to memory of 4060	6048	firefox.exe	101
PID 6048 wrote to memory of 4364	6048	firefox.exe	102
PID 6048 wrote to memory of 4364	6048	firefox.exe	102
PID 6048 wrote to memory of 4364	6048	firefox.exe	102
PID 6048 wrote to memory of 4364	6048	firefox.exe	102
PID 6048 wrote to memory of 6076	6048	firefox.exe	103
PID 6048 wrote to memory of 6076	6048	firefox.exe	103
PID 6048 wrote to memory of 6076	6048	firefox.exe	103
PID 6048 wrote to memory of 6076	6048	firefox.exe	103
PID 6048 wrote to memory of 5864	6048	firefox.exe	104
PID 6048 wrote to memory of 5864	6048	firefox.exe	104
PID 6048 wrote to memory of 5864	6048	firefox.exe	104
PID 6048 wrote to memory of 5864	6048	firefox.exe	104
PID 6048 wrote to memory of 2520	6048	firefox.exe	105
PID 6048 wrote to memory of 2520	6048	firefox.exe	105
PID 6048 wrote to memory of 2520	6048	firefox.exe	105
PID 6048 wrote to memory of 2520	6048	firefox.exe	105
PID 6048 wrote to memory of 4908	6048	firefox.exe	106
PID 6048 wrote to memory of 4908	6048	firefox.exe	106
PID 6048 wrote to memory of 4908	6048	firefox.exe	106
PID 6048 wrote to memory of 4908	6048	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nature.exe
"C:\Users\Admin\AppData\Local\Temp\Nature.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3456

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {8085c7fa-531d-419d-b322-8f4604d1888a} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {ad9f310e-cdec-41fa-95d1-75fab12257e4} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27274 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {76d5bbf0-001e-49ee-b001-04104df46d02} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27274 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 3868 -initialChannelId {ad0e924d-c8f1-4bf6-b7ca-d939cf129807} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4536 -prefsLen 34773 -prefMapHandle 4540 -prefMapSize 270279 -jsInitHandle 4544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1640 -initialChannelId {d920ae89-8616-4464-ab04-8704e72b56f1} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4996 -prefsLen 35010 -prefMapHandle 5000 -prefMapSize 270279 -ipcHandle 5008 -initialChannelId {5ec47961-e2b1-40be-af44-e66864328fd6} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 32900 -prefMapHandle 5176 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {f6c04950-a49f-450a-abc4-b83d8aeaf9d5} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32900 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {fdd03800-645e-4ddd-ad6b-4b9b168a360f} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {0c38e601-4dd7-4970-a2fd-6002ef7cc434} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6456 -prefsLen 33071 -prefMapHandle 6312 -prefMapSize 270279 -jsInitHandle 6176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6552 -initialChannelId {cee5b430-a27a-4c20-ab75-21cc15e47dd4} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6768 -prefsLen 33071 -prefMapHandle 6772 -prefMapSize 270279 -jsInitHandle 6776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6784 -initialChannelId {ed1048fa-4e52-4e54-9d50-e3166a598271} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2780 -prefsLen 33071 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {0dbc3c1d-fbce-43a7-a540-b6c6bd857c2d} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 33071 -prefMapHandle 5360 -prefMapSize 270279 -jsInitHandle 5348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {b5a11213-387b-4d8c-add0-3837af54c739} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:2520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6700 -prefsLen 33071 -prefMapHandle 6704 -prefMapSize 270279 -jsInitHandle 6720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6716 -initialChannelId {432cb386-0a24-4cd5-bb55-8b6c04da9f1c} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4908

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9usgf5zo.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 40b2948de05c6e8e2b85aaeebdcf625e00965d092209b692a3ea94595765e593
MD5 72bafb4117fe781cfd6b6a79f483c913
SHA1 c17f99adbdd0184597d16c7722a031a0eafabf58
SHA512 a34d0a8ced0632cf8fee397e20d832c5b30575ee588685fe99f31e574abe60265d12fdb4f414fd8ec5709cf074cd8c245c09df8c188d721ea447d7fff4422a06
SSDEEP 384:H9XghOiO024Yoo6J+Sl1xDnZBPsac4j0lpDII+kzX:dX+ZYoo0+Sl7zZlsac4ID8Ls
TLSH
T140528D7E9F0238AA2D63D194D9BD9214CD04A6BBEEE2C06616143C44CE447B9F4F648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\AlternateServices.bin
Size 8KB
SHA256 1d0bd51f95f6eb30e0d41f47f003a8341ac77a11bce8dcc543b8302caceec595
MD5 87b6615d79bbc234b613438e23802dfe
SHA1 b24406f618609de53b789a26bebcb9e1061b276e
SHA512 7a98e3dff067aae6324619254c23a27d02d9c793e8937d2d7bb4af80844cbc2b63600066fc1a7c4c9181a479100f77fd68ecf0d0906267b2c2899a98e515d242
SSDEEP 24:PuhMZFX91Y99xV29VvWRi9BMRO5q9F55A5I/39lr:vti3vsBWRQqRkI56I1J
TLSH
T1730295E36B75A462F4A28FB48059714CDC330329566D99C4C71480F30AC6AA9E13FBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\AlternateServices.bin
Size 12KB
SHA256 fdddabcae160b39b7f77be7be72377ff15378ea9f509c001f6bf5835db24b306
MD5 ba2792e4c211f719d3aba0f7a69f817c
SHA1 5855b57acc4689388dc9e5cb4a057a9abf316f07
SHA512 e59739caf8207715486585a7d7f4da3f803994dbc0bd6e6343b06e2c93908c8509eeb8746c1f3f818510916471738aba5aada10d1ac4fa296a801d269ae75a3f
SSDEEP 48:v0F3vsBWRQqRkI56I1J3G9IHtM/pGlo1HSD1HWH4:cF3vsBMQ4kI56I1J3GCNM/pGlYyx2Y
TLSH
T1A94254E76B75A462F0A28FB44059704CDC731329556DE9C4C74491B30AC6AA9E13FBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\AlternateServices.bin
Size 15KB
SHA256 ddd6bd95bb2603c40063cd01c21016f806e8c497fa589ce87a981a6105b7bcbf
MD5 ffa37db431cf3c1249c9af46cc735e74
SHA1 ebb8d4995330b62e2a9433f1a8f10d8bf6c502c0
SHA512 76ffb36bcf82c64427da36ce6803f84c3ec7b15511e5ac7a8ea648d24b6c7bf050ed6f6a5a3d2faddd85b5a5fdf6508e2216041a02b8f4a528927174a2230f48
SSDEEP 96:IdhI56ZsBMQ4HpJ3GCNM/pGlYyx2Y2yuZY:kHhQL223ZZ
TLSH
T19062B7F76EB5B462E0A28FB4405D708CDC731329955DA9C4C71481B70AC6AA8E17FBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\AlternateServices.bin
Size 17KB
SHA256 f6095b1931e3ad19c63bd44531b145bed02866ee207da5518135ce30325b26bb
MD5 b128012822fa156265423148c750fa74
SHA1 845d1ba5c645192e07c01bb43d6815fa470d74d3
SHA512 939db53615c7aefc4ba271b64c79c80ddc173db695d3af6997a2ae75ef55ad05814cd11248bd4825017749a279e72e12e32cc6e670ef120776281644772599dc
SSDEEP 96:arhI56ZsBMQ4HpJ3GCNM/pGlYyx2Y2yuZYvkzh:QHhQL223ZZ
TLSH
T10E82EAE76AB5A422F0628FB4409D748CDD331229955D99C4CB1481A70AC6BA8D13FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\AlternateServices.bin
Size 20KB
SHA256 1e85d71197cbee064c153f0dd609c9883b6e226a3cacfc1b4137f19611d4b7a9
MD5 8c6748acdb98c1111daa902a6e79e6d4
SHA1 442ebc3dd11c9b68c818b21cfe94e944de5581a3
SHA512 a87c0ac6f7be92d7024ddb8351c0856cfefcd1bd1f775245d34e36afa080effbf9a2f548ed12e2cbbe2b9b8d563629b66289945acf84f5964b1f955405e69b93
SSDEEP 96:urhI56ZmB6xHFHDFFIYLM/pklYyx2Y2yuZYvkzhi4LOtv4:M7QN223ZZ
TLSH
T1DF9219F76AB56462F4A28FB4409D748CCD33122D955DD9C48B1081A70AC2BBCE17FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 29cd96442ec691cd5d4ae125ddef0f3421e4ca5990759647633dd6e7b2274ab1
MD5 6cdde511512c356db455a0c0a76e1945
SHA1 7044c4b919ba2c0f36d0263ec73677e208926998
SHA512 22e0ebe52f4ae8bb776b538f015f410311310eaf6e4d9a59dfc428c7d9bf7a6bc9e2a5b5fd2fa8bbf4bab4893715c8829a294251db422c168ba67990eb3a754c
SSDEEP 192:rm5Jx1/66JoztdzgCl6mc0d6Ov5zbo7q9YyjuyC:rw/66Joz/zgC1jjbom9Yyj4
TLSH
T16DE12168E628863FC449137BCCA61B414F35389AD88E3F1935AC650C2D9B2DE778D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 30c78623d40cc846cbff1e85a20098be283e277f6eba172e492ad5941954f410
MD5 d460d232da6233fac388a18538721ca2
SHA1 a844bf1cc55485ba63f22b8f22e76a8c3f2b2d13
SHA512 07b039e620ac7cbaf386bf4202537ee7d7ae184886e5b4aa16b0accffa272683c0076d098873fefd9a7717061f79cc339a594cb5f9e43f4487a637e13b2a9d4b
SSDEEP 192:rMk5Jx1d66JoztdzgCl6mc0daOv5zbo7zuZ9Yyju+:rbd66Joz/zgC1jXboeZ9Yyj
TLSH
T144E13368E628863FC459027BCCA61B414F35389AD88F3F1935AC650C2D972DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8d5e1c2d9569564c047d561a46fda5c1b28802f493babaed6423c71e7d6c6798
MD5 881d1558f4bfb6049828f9dfe1ec2ffe
SHA1 ebb271cbaa6dac3d848ab0b1db627e770fb0244a
SHA512 83953620913b276e5e659d176bded3d20d1dba919e013373a7d7d617874ed22ead1a97a6d7b5ac765bc251d07315a0989c15de3aaebe3942ae45698c2436a3ed
SSDEEP 192:lMk5Jg/1d66JoztdzgCl6mc0dZOv5zbo7zO9Yyju+:lGd66Joz/zgC1j8boe9Yyj
TLSH
T149F13568E628863FC459027BCCA61B414F35389AD88F3F1935AC650C2D972DE76CD1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f510df21a2d87bd81e828a2c5d377c51919041d2bba42a6ad9f1419a254eb77e
MD5 afcc2423b3083a9f236f01379e5941ee
SHA1 3694a07972fe35ff303694ccaea86e95b81d4292
SHA512 b9de03082119be63aaa106b5cb76fc14266290add613046a40cdf8c8ba365a0da592d9e974a329a0f01671bc8e99a0472d4fba2dfa6e966a46341ee23e6edca9
SSDEEP 96:rwFM2FRAFR2mFRfNFRx/dd66JoztdzgClKtmc0d/UfSdF95/7bkW6ArcE9YyUR6+:rMk5Jx1d66JoztdzgCl6mc0dyOv5zbo5
TLSH
T1EFC1D069F628463FC459023BCCA61B400F763957A88E3F1931AC640D3D972DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\events\events
Size 1KB
SHA256 81621b4c76eeb45973321a2424ca4bc115932b97ad88ff9bd65bc87efaff9bd3
MD5 82434c3b9e85365fbcba20bd904384ee
SHA1 55b2b8fd3b8b0cdc82c7f60586cde20b79e78ed8
SHA512 3c88273cb031ad3995afd7eca8adc634c784298bfaf9ef524266c1fc8955aabbc65814a1251d86faa3a2bb58603c15473d9a8794343d7b726d16f267f6201f62
TLSH
T15A11C08C79FC4D5A9CD7E29CB481028ED3158E0A06475C834E12EF8CCEC1AED722A47D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\events\events
Size 5KB
SHA256 79b44f338074ebee6c13396a8e9db2363a3443143db0c9cf6f319dcb69c100b0
MD5 f071b91e4e940b585417826783ec2716
SHA1 6b17b8cd22f279f976838a5dad109c13d18a1261
SHA512 41ad14f379d918a3ccb0deb47b7e7547bba22312cee2bc1291916b388e73537494920ade1cfafd6f76b35824ae86efea16749699a53cc47376a2886d1d6d0807
SSDEEP 96:KgCBiN4fEMtmN4B2diQdwNZoF4ZYpVTZd4Rqvh+raC:Kg93MtcziywNGVewcrj
TLSH
T1ABB1101D65B80C7E1DEBE29CB441068E87DC8B0681871C874D9BEF89CD96A9D721E068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

689770ed-40a6-44b9-8400-f4a610aaf656

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\pending_pings\689770ed-40a6-44b9-8400-f4a610aaf656
Size 235B
SHA256 bc4756a4c11bfb3319d8b7abc765f1e743f010ac5fba83b2e2c04f99a148566c
MD5 b714de24131f8e382f106ea351dbd70a
SHA1 8d0dbb24282e99e8b0210075f88e70ea26ddade3
SHA512 933082ec5bd92365cc5bba0b559c82420751f90d478449cfc0530a0d105bc30710d1ba49f5b1bd5517baa910861adcbd2ad715cb4c83ad03f83470a15f9488ed
TLSH
T1A2D0A78154997B6D0C140F07B0A06ED7319C4C3354A4D860D99269749EFDEC95265956
MD5 SHA1 SHA512 TLSH

Submit Download

dc9e6e1a-1fef-47b5-b4bb-4fb387de9d17

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\pending_pings\dc9e6e1a-1fef-47b5-b4bb-4fb387de9d17
Size 16KB
SHA256 0dd3646905e95deead4627a0ee5e491d934bc8650e044ed9bed34076b49c35bb
MD5 6f0e818e64f867802881042c223f7763
SHA1 a573d9cfe9560915520b25ab3ccd811573bdc10e
SHA512 680cf8caae68eb52197d9663654294c76fd24e8073480a92240f3468bb1c8b32bef7cfcb5e2cb9cb6552a1a5cc3c22a59ce283b3ebe86d38f04eba41b35b514c
SSDEEP 192:TY9KtLLEnXdE/YRwKcgaN0yLu3waE44BJ1GYqgmUBhv/eBNy3zxKVyNSX7BO4otE:cn2o4oYvO8lKVyNSX7w4otPyqFw
TLSH
T10272C85A686045BA8291E37894FC7FC7E2F538CB4C418FCA9BE4BD086DDE05E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e325d3cb-aadc-4dba-87c1-32ddb937b87b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\pending_pings\e325d3cb-aadc-4dba-87c1-32ddb937b87b
Size 886B
SHA256 c65ac64dfc355e3cde7990ec56722a0fb6db447e687108b21906ff58da57a60d
MD5 310c596f175924a9da374d40a70301db
SHA1 6462d9ff3a4e02c97df15665cc335e9aa624294e
SHA512 17a796ea139775a67c4baad71abbc84963b5d1b78c5dfdd7078dd94e535961f1117bd9fc2dbe1beba081f8e8a5cb0c9540ecfa9c61826a5ad05f88a7c47c5a4b
TLSH
T1C6111C9290B8BA728CB8C25B84A03B4287F0742380CA0C087D600B084EAB50EA7AA707
MD5 SHA1 SHA512 TLSH

Submit Download

e7c43e72-acb9-479b-9dd7-5b0275ac8b56

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\pending_pings\e7c43e72-acb9-479b-9dd7-5b0275ac8b56
Size 2KB
SHA256 25f40996dafc5614ad3ae3bcd0915fa3bf6d01bbc846266875afb8b3f285b433
MD5 9fa6934347f654c0c594fa8608578f6f
SHA1 a90cdabe59ecbdd9046c98fd07af6f0f90a747f6
SHA512 cbf639b86da6f27ef9eee79d408164cabedb1b9892a6108323ac88bf5a25b181b5cc880af94db588ed6a48154dac9ac248b99d47b11165c425d0cb91e535ef7c
TLSH
T1C241106935F86D778CCEF18E9045228E5B609A0300CA1C432E61EF0CCD9769E33AE51B
MD5 SHA1 SHA512 TLSH

Submit Download

f523d631-cbc2-4107-a658-dd21a9202759

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\pending_pings\f523d631-cbc2-4107-a658-dd21a9202759
Size 883B
SHA256 01b9326b94b08f211e670f4d597c4ce6d8ffeb163ad5736c30fa322f83e8cbd6
MD5 068d5096e5b219ec8c27296afd51c0e4
SHA1 f8e85683a5335a384bb15e3ec499e31378a00a5c
SHA512 b6f255278cf576b41bc35d1fcab72a9d3e1314574b6ed19f20cd2c7bf20066eadb7949ec7618d9f7bde11cef5cd0d382c499476aa46e7f37890a1fafb574e517
TLSH
T16211DC51A1B4BAB3CC7CD24B84953B424BF4742380CB44143EB15A088DBE91EA79A74B
MD5 SHA1 SHA512 TLSH

Submit Download

f71d72e8-8be5-4fe2-81a1-6488a8db1301

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\datareporting\glean\pending_pings\f71d72e8-8be5-4fe2-81a1-6488a8db1301
Size 235B
SHA256 ef347746c32b2af93111cd8e08b0bcc1565f64b39895a8118c48b4996d39e2e9
MD5 bfbaf207577d58490adc20a2a80638e2
SHA1 1852ef82c423ddfb10d6fefaabb25db9c5fb6b54
SHA512 5609706113692cbe0e954d797ed34cbffe5c4510c2819924cd6fb228198556addfaa12492a6fd5797df5699e1d2307732f9dced035a1db3fff8934f90088bba0
TLSH
T197D097903898B75D08281F0EB0A128C37A6DCC3314709820E65204B88AF99CE015286A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\extensions.json
Size 16KB
SHA256 4b8a85e794b995e2d9271f300c87e3fe7b158518edbdc93caa7c92e87ebab2d8
MD5 f7eb8501a0337bcc1985223d45669222
SHA1 1e141c0714ea22548d26489d6122cceebf7b8623
SHA512 b4bf1dfee5b03fe773bb859effe7021704beac41e03b9334207e158c426567d25b735716421e4b80ed5f12f6662669cd625be4ead90aafa1adcced861c1a5168
SSDEEP 384:LkI4vVUmldvO8dhWBQd94zQ96ojL4HML4PCL4HQL4HpPL4H534hW:4I4dRfTXzP4g6M4m444y4JT4B4I
TLSH
T18972521545049EB8294EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\prefs-1.js
Size 11KB
SHA256 63e5ca7ddefe376872c52f5dcc21f7f80706d1ed4dd217437554bf52ffb3df18
MD5 525a18daff53ae71cb6c9690302927a6
SHA1 64bd796028cc878e82eb81c5a4f6c2293ccf2558
SHA512 e0f11a2fe1940352630020840444d1d7460f5dcb7ef93caa0861307432919bd1d991b11a5f539cf25dc9b4525c5b63c0fddffcc43ae037c335d631b88945556e
SSDEEP 192:VmsCRZUf2QXfSSsLRCvRlOBw88lo6YFqrcm:c9U+RCvRSwOyb
TLSH
T14B42CF3891488B3F24F7327D6C254D705A61023BB7BFBCD606B95492085CF3895E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\prefs-1.js
Size 8KB
SHA256 283099fc411375aca523c57d4eddd90d94733d3a829b4b9b606370a543a60fff
MD5 edeac6f76ecb7cdebc365dbf63f86ecf
SHA1 5700eacdfefb971806da28b711feeb4e8babca34
SHA512 86d1425ebb1e5754e4de27faad06801f2b4791fff3accd08c9327a3734b7057d8e9041607a880d3cab877f0ca620d384ddf5c2094c9fc459e7c2d2b06ccde060
SSDEEP 96:xHB5xTUpRqGqZUf2rE2CNbzS2SSlndv9jRnOWRhINamE0SBw88PurN8L4cnMeV67:VmMRZUf2QXfSSNRCvRSBw88Purqm
TLSH
T1C8021E789008CF7F68F6766CAC244D305A62023BB7BFACD611B95485051CF3885FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\prefs.js
Size 6KB
SHA256 3e004b9bb4e4d21704fb273316929f0476cda45cde80973cb0d4852366df3c05
MD5 f5d0d4a7af9436a8dc56f509194b4382
SHA1 299c9851b3103c2b11c4309fee3fa79cc7777a79
SHA512 42752cd63b2a8ad468587603020e27c3109ec36bd6cce6e3322fc37d1d6afe0ddec0fd3c7e0c96a98f9c6cb07f327d9d73387f087f1cf135f5b81eb90d68e382
SSDEEP 96:xHB5UTUpRqGqZUf1dB1zSg5ESSlndv9jwnOHWmE0ABw88u8L4cnMeVPU:VZMRZUf1dBUSSxNRABw88vK
TLSH
T1DAE1307894088F7F74B6776CAC6888719A72013B77BF68D610B554C4055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\prefs.js
Size 6KB
SHA256 bb3255458b87067552380bfcd779de8c457ce00a7e09ce5652f3b86f39c4bf66
MD5 afb8ed3638d7b467b57bb9b530f94cd5
SHA1 6df0713e2faece03a642e8d7dd7b7980f4fd2664
SHA512 271a137f502b3d5d9b7c29cfe50b422ba3d96c2da3c486cf16b7d5c662bd3c2c70fb6547810b162b9e47065229f1feaa5e84504525b5c24d393256e6786b30b9
SSDEEP 96:xHB5UTUpRqGqZUf1rE2CkzS2SSlndv9jRnOHWmE0ABw88u8L4cnMeVPRGS:VZMRZUf1QXUSSINRABw88v5
TLSH
T1B6E1307894088F7F78B677AC6C6888319A72023B77BF68C650B554C4055CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\prefs.js
Size 7KB
SHA256 976ea9926a5b1d3570b6b423441edc09265788695c9e711204fcd618730c64cc
MD5 94483fccfa2dde7b2e4738a3512a9465
SHA1 9e80a61dbeff1ab202743cd898c866c78e707626
SHA512 2d9a825011f6c9d9ea856255431913aea9084ef929b6f4fff57d187dffa2da3da612f4e733e41b54cb61d0da2e2e105759ded287ed7fc871badb1346f6b50114
SSDEEP 96:xHB5UTUpRqGqZUf1rE2CNbzS2SSlndv9jRnOHWmE0ABw88u8L4cnMeVPRGS:VZMRZUf1QXfSSINRABw88v5
TLSH
T1BFE1207895088B7F78B677ACAC6888319A72013B77BF68C750B554C4055CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\prefs.js
Size 6KB
SHA256 8bd946e4c9fdcd790b03f19685fc1576a823c3cdd84de4538510b6ec073051e7
MD5 78f15b930046bb96cf39f2f6c0eff011
SHA1 eee40c3cac0ac4e6337f694dc9df404e2d0a9a55
SHA512 fd4868ab71c74e3d9b0fb10a37089d0d65a37af1fe6f4752bc5b6f31291306f5b133c78a6bf0c1e7d8c8b1c060f1270bec7d61b2bf28fecea34bb8f5b01497d8
SSDEEP 96:xHB5UTUpRqGqZUf1rE2C1zS2SSlndv9jRnOHWmE0ABw88u8L4cnMeVPU:VZMRZUf1QXzSSINRABw88vK
TLSH
T190E1307894088F7F74B6776CAC6888319AB2023BB7BF68D650B554C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\sessionCheckpoints.json
Size 228B
SHA256 db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2
MD5 a0821bc1a142e3b5bca852e1090c9f2c
SHA1 e51beb8731e990129d965ddb60530d198c73825f
SHA512 997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be
TLSH
T14ED0A783C6055075CE83696CB39C7B519E3E04F672640245B1AC954C187F027414B843
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 3d3e2f9501f03bdb90f97541be4d1cca35c512c7caeeaba33e97624ea5381687
MD5 3cff012ba7d60d7ecdf57d4712a91c46
SHA1 ad7161b10d83fd7495d825246086927e93271f0c
SHA512 ce891ee001b727a93475f7032efc1b5e2a2e6e0dccc52fd9283f7bcc89edc7c152e28fa3146a5fa587a9d3680fe0ef567db7a8e24bed6d133d5cfd64e5d710d3
TLSH
T16D518DAE1C1B3CFB3630C548E84F0FE0CAA314200475956ABD6DD51304ED60BE9C1A5F
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 3d09436251cdf94899a2fc15c9abe982f240828825f0f17b49968a38774f772a
MD5 c1b7058dfa3d6e1f2c890cfe3bfad0a1
SHA1 0e985e866560e33c9d49194bc8189123406309a0
SHA512 bc8fed3b69c5303411a94164a621b0718cf353bd38d6b3f16e4af9ca6982b069c57b1ee27220d00bca577063cae7f219201df81c81325def70a870aa6b9f8351
SSDEEP 49152:zx2gozYJFuUGD/Yf9/9RvrS9jorvxCCPuYD:tDZlFrS9jiJ/PuY
TLSH
T10E4629F820D1A257F3814073724993EB21EFD00D5037DA085BA95AE9A574CEF8E17B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WClientv31.V_ONKfhR.0.apk.part

Path C:\Users\Admin\Downloads\WClientv31.V_ONKfhR.0.apk.part
Size 17.2MB
SHA256 3011ea7018b4af2e6cd96fccca7c62c41d92672be18aef60eb24ad2fbfb8daf9
MD5 c68581e470e190fa11a824c9c00b1976
SHA1 ba391209bbe15d220d0f4cf27f3ccc42051b4c5d
SHA512 afddc281392d97a7e5f5dc2a4794fc62ed6cb1b2d1dc21e7e4b17b3180d1b6e49498604b4969e7a279aa74afb00580b2473e8f5f04cb0f6b527903058bf8fab5
SSDEEP 196608:gtFjcxOYo/tNOChj7cDJSU8mQykNVApU/FwjQ/xd0+h6kwangc8SEgmd7:O5oOYo/tkC2DJ7rUdwQLRMkkzBl7
TLSH
T19807BE73D5424B61E16E67381CF24346F731AF86AF03539B1004B9B87E732CAAB95AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2112-0-0x00000209147B0000-0x0000020914A0F000-memory.dmp

Download

memory/4092-1000-0x000001CEE9DB0000-0x000001CEEA00F000-memory.dmp

Download

memory/4092-1001-0x000001CEE9DB0000-0x000001CEEA00F000-memory.dmp

Download