c9764ab374847bde6e204a9a0f3cd56970f7b1ff553635cb4daa8f542c98ea05

Analysis

user interaction
yes
max time kernel
210s
max time network
213s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fansign-1785692898214.jpg
Size 163KB
Sample260802-xpdycawsa1
SHA256 c9764ab374847bde6e204a9a0f3cd56970f7b1ff553635cb4daa8f542c98ea05
MD5 988d6f382702ebf00dc0a6eb81e82456
SHA1 1238f1fae02b8a3ebbd80ebc515c55f98396784a
SHA512 a3745442df3d20b1d46f69492539378b21ac97976a44e0c3eab5f0c77b4740362fc331e7ca16051cb4de0c51f2c62ec817dc0b08c44e4d63559f04771065d9c4
SSDEEP 3072:3mSOGIky4X/uQtvHjbo9W2Jx44ngADYdljl88Lh/8MllxI0XB1DTp00j/V:3fOWy4X/9E02JxVMdljlHlDrxLR00j9
TLSH
T13BF3123AFF31BA5AA81F781C75BDA1629BFC26A51C091CC0A7B36D51C2D034AE58D14F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
337	3552	firefox.exe

Executes dropped EXE 2 IoCs

pid	Process
5724	Ymods-Loader_1.2.3_x64-setup.exe
6896	ymods-loader.exe

Loads dropped DLL 7 IoCs

pid	Process
5724	Ymods-Loader_1.2.3_x64-setup.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ymods-loader.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ymods-Loader_1.2.3_x64-setup.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ymods-Loader_1.2.3_x64-setup.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301710606877429"	msedgewebview2.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\URL Protocol	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\shell\open\command	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\URL Protocol	ymods-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\ = "URL:org.Ymods-Loader protocol"	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Ymods-Loader\\ymods-loader.exe\",0"	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\shell\open	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\DefaultIcon	ymods-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\shell\open\command	ymods-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\DefaultIcon	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\shell	Ymods-Loader_1.2.3_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader	ymods-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\ = "URL:org.Ymods-Loader protocol"	ymods-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Ymods-Loader\\ymods-loader.exe\" \"%1\""	ymods-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Ymods-Loader\\ymods-loader.exe\" \"%1\""	Ymods-Loader_1.2.3_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Ymods-Loader\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Ymods-Loader\\ymods-loader.exe,0"	ymods-loader.exe

Modifies system certificate store 2 TTPs 15 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 19000000010000001000000021d008b47b7a2a81c8435903ded424c90f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a012000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f33519000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	ymods-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	ymods-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3352000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	ymods-loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	ymods-loader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	ymods-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	ymods-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	ymods-loader.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ymods-Loader_1.2.3_x64-setup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
924	mspaint.exe
924	mspaint.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6788	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	3552	firefox.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeImpersonatePrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe
Token: SeDebugPrivilege	5724	Ymods-Loader_1.2.3_x64-setup.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
5724	Ymods-Loader_1.2.3_x64-setup.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
6896	ymods-loader.exe
6896	ymods-loader.exe
6896	ymods-loader.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
924	mspaint.exe
924	mspaint.exe
924	mspaint.exe
924	mspaint.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe
3552	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3552	632	firefox.exe	90
PID 632 wrote to memory of 3552	632	firefox.exe	90
PID 3552 wrote to memory of 4952	3552	firefox.exe	91
PID 3552 wrote to memory of 4952	3552	firefox.exe	91
PID 3552 wrote to memory of 4952	3552	firefox.exe	91
PID 3552 wrote to memory of 4752	3552	firefox.exe	92
PID 3552 wrote to memory of 4752	3552	firefox.exe	92
PID 3552 wrote to memory of 4752	3552	firefox.exe	92
PID 3552 wrote to memory of 4752	3552	firefox.exe	92
PID 3552 wrote to memory of 3284	3552	firefox.exe	93
PID 3552 wrote to memory of 3284	3552	firefox.exe	93
PID 3552 wrote to memory of 3284	3552	firefox.exe	93
PID 3552 wrote to memory of 3284	3552	firefox.exe	93
PID 3552 wrote to memory of 2024	3552	firefox.exe	94
PID 3552 wrote to memory of 2024	3552	firefox.exe	94
PID 3552 wrote to memory of 2024	3552	firefox.exe	94
PID 3552 wrote to memory of 4304	3552	firefox.exe	95
PID 3552 wrote to memory of 4304	3552	firefox.exe	95
PID 3552 wrote to memory of 4304	3552	firefox.exe	95
PID 3552 wrote to memory of 4304	3552	firefox.exe	95
PID 3552 wrote to memory of 2896	3552	firefox.exe	96
PID 3552 wrote to memory of 2896	3552	firefox.exe	96
PID 3552 wrote to memory of 2896	3552	firefox.exe	96
PID 3552 wrote to memory of 2896	3552	firefox.exe	96
PID 3552 wrote to memory of 3024	3552	firefox.exe	97
PID 3552 wrote to memory of 3024	3552	firefox.exe	97
PID 3552 wrote to memory of 3024	3552	firefox.exe	97
PID 3552 wrote to memory of 3024	3552	firefox.exe	97
PID 3552 wrote to memory of 1144	3552	firefox.exe	98
PID 3552 wrote to memory of 1144	3552	firefox.exe	98
PID 3552 wrote to memory of 1144	3552	firefox.exe	98
PID 3552 wrote to memory of 1144	3552	firefox.exe	98
PID 3552 wrote to memory of 2324	3552	firefox.exe	99
PID 3552 wrote to memory of 2324	3552	firefox.exe	99
PID 3552 wrote to memory of 2324	3552	firefox.exe	99
PID 3552 wrote to memory of 2324	3552	firefox.exe	99
PID 3552 wrote to memory of 2700	3552	firefox.exe	107
PID 3552 wrote to memory of 2700	3552	firefox.exe	107
PID 3552 wrote to memory of 2700	3552	firefox.exe	107
PID 3552 wrote to memory of 2700	3552	firefox.exe	107
PID 3552 wrote to memory of 5236	3552	firefox.exe	108
PID 3552 wrote to memory of 5236	3552	firefox.exe	108
PID 3552 wrote to memory of 5236	3552	firefox.exe	108
PID 3552 wrote to memory of 5236	3552	firefox.exe	108
PID 3552 wrote to memory of 5740	3552	firefox.exe	109
PID 3552 wrote to memory of 5740	3552	firefox.exe	109
PID 3552 wrote to memory of 5740	3552	firefox.exe	109
PID 3552 wrote to memory of 5740	3552	firefox.exe	109
PID 3552 wrote to memory of 4512	3552	firefox.exe	110
PID 3552 wrote to memory of 4512	3552	firefox.exe	110
PID 3552 wrote to memory of 4512	3552	firefox.exe	110
PID 3552 wrote to memory of 4512	3552	firefox.exe	110
PID 3552 wrote to memory of 5476	3552	firefox.exe	112
PID 3552 wrote to memory of 5476	3552	firefox.exe	112
PID 3552 wrote to memory of 5476	3552	firefox.exe	112
PID 3552 wrote to memory of 5476	3552	firefox.exe	112
PID 3552 wrote to memory of 5616	3552	firefox.exe	113
PID 3552 wrote to memory of 5616	3552	firefox.exe	113
PID 3552 wrote to memory of 5616	3552	firefox.exe	113
PID 3552 wrote to memory of 5616	3552	firefox.exe	113
PID 3552 wrote to memory of 5652	3552	firefox.exe	114
PID 3552 wrote to memory of 5652	3552	firefox.exe	114
PID 3552 wrote to memory of 5652	3552	firefox.exe	114
PID 3552 wrote to memory of 5652	3552	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\fansign-1785692898214.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {6d412645-04aa-45c5-85f8-394178480485} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {95518a8b-2a3d-4ddb-81ae-c5cf762e34d2} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3716 -prefsLen 27277 -prefMapHandle 3720 -prefMapSize 270279 -jsInitHandle 3724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3732 -initialChannelId {0c107f30-d2d9-4c22-ac40-3d6bf16d822a} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3880 -prefsLen 27277 -prefMapHandle 3884 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {50372431-22b7-4002-89d0-c11d9861871f} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4364 -prefsLen 34776 -prefMapHandle 4368 -prefMapSize 270279 -jsInitHandle 4372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1248 -initialChannelId {7285f5a4-36f3-4ba3-8992-fbd50983cc45} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4904 -prefsLen 35013 -prefMapHandle 4908 -prefMapSize 270279 -ipcHandle 4800 -initialChannelId {2259e556-3274-4427-b158-10c7ad1cd5aa} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1032 -prefsLen 32900 -prefMapHandle 4808 -prefMapSize 270279 -jsInitHandle 4812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5036 -initialChannelId {8f4267cb-26c6-4f67-9336-dab5ad7e4961} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32900 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {aec7344b-96ff-43c2-b1df-b96e7abbddac} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {9910c134-4465-458c-a695-e3bf2b4fb0f0} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6388 -prefsLen 33031 -prefMapHandle 6128 -prefMapSize 270279 -jsInitHandle 6236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4344 -initialChannelId {0255e537-f8e5-4f2d-b537-ff19b02d910e} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5900 -prefsLen 36719 -prefMapHandle 4752 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4620 -initialChannelId {56fb09b7-50ac-4e2c-97b3-3f7f509bc0d2} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6132 -prefsLen 36719 -prefMapHandle 6680 -prefMapSize 270279 -jsInitHandle 6576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6780 -initialChannelId {0515ed36-2af3-4e0f-8ef5-8d6067e37497} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4600 -prefsLen 36719 -prefMapHandle 6868 -prefMapSize 270279 -jsInitHandle 6592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6872 -initialChannelId {ce713e7c-21cb-4e33-9a44-ad7bdb885efd} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6900 -prefsLen 36719 -prefMapHandle 6788 -prefMapSize 270279 -jsInitHandle 7068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4600 -initialChannelId {2bdcedec-4c51-471f-8c75-31a5feb5b350} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7452 -prefsLen 36760 -prefMapHandle 7424 -prefMapSize 270279 -jsInitHandle 7420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7488 -initialChannelId {78343a5a-7bae-4558-9ddc-344deb154a60} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7692 -prefsLen 36760 -prefMapHandle 7696 -prefMapSize 270279 -jsInitHandle 7700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7708 -initialChannelId {0ee1057d-504b-4cec-a2ea-1bab336446b5} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7844 -prefsLen 36760 -prefMapHandle 7840 -prefMapSize 270279 -jsInitHandle 7836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7892 -initialChannelId {f5db7b16-9af3-4fd1-a42b-f2c932f8b37a} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4664 -prefsLen 36760 -prefMapHandle 8140 -prefMapSize 270279 -jsInitHandle 7688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7816 -initialChannelId {8d77b12e-c830-417f-b976-585344b12651} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7332 -prefsLen 39880 -prefMapHandle 7340 -prefMapSize 270279 -ipcHandle 7292 -initialChannelId {00ed6a41-8175-4ffe-ab9a-225f2436fdc3} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 utility
    3⤵
    - Checks processor information in registry
    PID:1224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 8312 -prefsLen 39880 -prefMapHandle 8024 -prefMapSize 270279 -ipcHandle 7320 -initialChannelId {e0836ec0-13b4-481d-b78d-5cc099512927} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 utility
    3⤵
    - Checks processor information in registry
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8708 -prefsLen 36800 -prefMapHandle 8712 -prefMapSize 270279 -jsInitHandle 8716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8696 -initialChannelId {e31cc0a7-4dc7-4e74-80ff-a5784357f66a} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:6668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8832 -prefsLen 36800 -prefMapHandle 8132 -prefMapSize 270279 -jsInitHandle 8872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8884 -initialChannelId {a49cae8c-558c-44be-81cf-57db6c61b25f} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:6676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8836 -prefsLen 36800 -prefMapHandle 8840 -prefMapSize 270279 -jsInitHandle 8884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {a9984640-6cd4-42fe-ba91-142980885073} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8124 -prefsLen 36800 -prefMapHandle 7892 -prefMapSize 270279 -jsInitHandle 8028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7624 -initialChannelId {d32ec8b6-f999-4e90-b9ef-e2c27abd3728} -parentPid 3552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:6280
- - C:\Users\Admin\Downloads\Ymods-Loader_1.2.3_x64-setup.exe
    "C:\Users\Admin\Downloads\Ymods-Loader_1.2.3_x64-setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5724

C:\Users\Admin\AppData\Local\Ymods-Loader\ymods-loader.exe
"C:\Users\Admin\AppData\Local\Ymods-Loader\ymods-loader.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6896
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=6896.5136.3361558297392967063
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:6788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a4,0x1a8,0x1ac,0x180,0x1b4,0x7ffa0569b078,0x7ffa0569b084,0x7ffa0569b090
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1876,i,16451075467155124062,15692347779986190056,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1992,i,16451075467155124062,15692347779986190056,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    PID:6392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2408,i,16451075467155124062,15692347779986190056,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView" --webview-exe-name=ymods-loader.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,16451075467155124062,15692347779986190056,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2B9E34D3BDEFFF1A2CDAEA0647CE8AA28A02E866

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\2B9E34D3BDEFFF1A2CDAEA0647CE8AA28A02E866
Size 65KB
SHA256 30a54aeb5c077c4dd96a5c1a6a9c73bcf11a13727f148ae566cc8f91cdacbbcc
MD5 6f0673fd7f35d24ff905abe741516746
SHA1 8c09b2283e176b33ee8296de77f75976fec05722
SHA512 aa7c30f6a951d8bc90bcf33db9661638ddc1a746f8ae6f20fbc3ee7ce9de26566778d8e978a4b0be99e9ace191300bbff491222ad52d437bcf83b5003febe6a0
SSDEEP 1536:HYDhrXLgUVTf98fcANMQnJULOK+z2N2Vr8K9qqX:HYDhrbZTF8ffZaOzM2Vr8hW
TLSH
T11763027E0C957EB97491C386CCB172502F118263C938F5B47A4B12A7074DFA9A6CE2DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B87CF88CAADBAF3F6230F60E3897881273C8406

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\3B87CF88CAADBAF3F6230F60E3897881273C8406
Size 66KB
SHA256 8a89eeccbd659c9a38a62e1a8d5c6e5d563b1f8877502372e8106333f819a3b8
MD5 28fb8e7f2cdf3a0e7b89faaf4a5f4d8b
SHA1 f7f034cf16903522a8b81cbf3962ef5f4f1b9794
SHA512 54ab9c7339e7bcf4a6dce7b35c02a294b805b87f0c20c9ab020455f5c1d3f510149287f4b8dad11cc4aab1eea9c4a3be6574a7afd6c414349f4cae8bb1300727
SSDEEP 1536:WJG/KL/shmr0SyKV2i0Qz0j72A2+0G+gSRLBeFDP0qn5R:liL/8mV2i0ac6A25G+1LBeh8G
TLSH
T1B363F2BC1E223AED6B21E3988534AA41B940D3DBF815E1D1749EA788010F34EDDCF695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 27e2905bd0019321369ac423c511fd48b03e42dd974aa03b0fdb3bad974ea71c
MD5 f47c954b472a9e395e199550f1624e61
SHA1 1b0fad4eb1a71cb44ac5c0053da1814b1520e184
SHA512 8016b59c621680a01dd06316f7b3005e30690a280a9ae964ca9fb815e3a63cb7c8b41241ba216859e97024456919314cceca2e3b1733d9f3606dff173b67bf36
SSDEEP 384:HwCe7iO024YaDL84KKDL849B7SOEAd9KVRaAcP+AWRMAMUX:QqZYaDL8lKDL8CB7S/AmVAf+hRM7UX
TLSH
T13A729E7D9F413CAC19A7C0E8C4F842DA4D19B6A3DFE6806D21683D0DC798A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7172541940D23C54ED4789A60639BFCC422E519E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\7172541940D23C54ED4789A60639BFCC422E519E
Size 67KB
SHA256 f08511b95252eb2b1526a334ec5fd94cb5c2094290f7ffeed4b579d7e4e020ba
MD5 6fafede01b179c1d85db333d425899fc
SHA1 3dab3466488f97112c15940565e916cd13bfa8cf
SHA512 75f90ccf71f62b437ff3f80c78bf952b9aa3043b4526a70f438e803b6b9ae3ef5feec740294befead367bab1366f9c7edeb5198cca79e2d1cfc45a2f8019528a
SSDEEP 1536:FyvVCHVdFlgUZgt9f+rCIAaGrxNkcW3hzT0iBTXe5SLzmgqbpZ:F6EVOUZu9f2CRzrxv0h0K7ewzmgS
TLSH
T1C063022758502DD867A10362A486A30B2EA9D706FFB4C0F8FCE534E88E4EF19359D0C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7434AAE90268463A084ACF39D907CCAD6BBBE082

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\7434AAE90268463A084ACF39D907CCAD6BBBE082
Size 18KB
SHA256 270896846abdd88fba3de6c574eefc83efbedf7f7a7acd5c80be99fdeb9ea16b
MD5 3bfb3299ed6f04c50f5b6341a1cf22cd
SHA1 1cb294bd04b172a77cc468c8d41c41030f74abce
SHA512 aaa2acc0928eb0538e98a1e4dcd31344a579c34572fb09300f31844127dfc7db68c206def09debfb921ba7b87f6965b816352cc52b3740cb7337c734ae0e52e5
SSDEEP 384:Innhd3EIdM1HqvCryTKyoU2w17kxXVdAkxXV5e+1bzXlOwqyJM:InT0uq/bhXW7kTdAkT5e+1fG
TLSH
T18A82CFB20F5015BE1391CD1956BAAF186D18F383EA62D08E784934CCCACA7737DDA096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D0958C2E02C6AAABB28F3F96DF5D7A2A6470F53

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\7D0958C2E02C6AAABB28F3F96DF5D7A2A6470F53
Size 16KB
SHA256 0368cdad018cae43714a0fb4fc514893a50b60dfa6a577273f59428d5e3231cd
MD5 3c8a48960af1640bad15abaa17d84d59
SHA1 266f8727a4806c374a3406db401e54542a038fe5
SHA512 0dd0b3bc7b5485fc3c50f2f0e8a91cb9516d217397f45d87ed0d9fcf9d7dc51117eb9691e0bfe6bb5592b42b07d46dd1160d76e3cd56d9afb975434c2fb54ac6
SSDEEP 384:r5grNnpzKMTFmKiAvkIHnq8YfvSn+pYfvSnupHZvh83Ao8/ouq:rsx141AMIHnq8YHU+pYHUupHBS
TLSH
T1E272AF3D1DA2272A2DA1D35DCC75AA001F80D383EFA7D0E8B49D354C474DBA97AEA4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CBC48666ABD869724501A7154740CB337A73F10D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ploc9qy0.default-release\cache2\entries\CBC48666ABD869724501A7154740CB337A73F10D
Size 11KB
SHA256 7cea83459b228c6702d7614b670adc0fadea5cc761a61da824838159dc139607
MD5 8447ce69a6dccc8c9d7cfcdc553898ea
SHA1 40ea21ed6ed0cc60c1c6cefd3d084232f1929fdf
SHA512 3fa3e6bb2a3598fdfc373206f59910e8763f4a73f4323a05da56e89edc650fed789ddfa914124e6ef0fe8117e91d3bb29f71b858682098523e40dc105883558d
SSDEEP 192:WvN9SZ/3126uq/Ym/MewAWzwOJ4RRBJMbvaWMhwygLt7ij20vz10h9n5H:eN9Q26uq/YOwYOJ4bPoMBwt7KDGh9J
TLSH
T1D8328DB2DD003A4B0B56099786368648BE9DF133E80065ECB6B43550D8466ECEEF7699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuFF48.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsuFF48.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuFF48.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuFF48.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnaClient.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\AnaClient.jar
Size 34.1MB
SHA256 7200ed4e8f4ba8d8e22dd727a6fbc62f83f0f53f72164e705157755f09b1b931
MD5 cbdead751b69f12f66cd5c460df808d2
SHA1 dea514993ca80fe0af235f391e2bdedc72c67fd9
SHA512 31225bcb03a5ec40e71ff784d551bfb611ef358659ba4a6172e42fca5ccf3d5bff89bdbccd2242799650696f22d78470d1f8eb8a3ac76952a7baf81f7b4b77c5
SSDEEP 786432:kTSja2lG4C/sNdFfQKnxR8j6TKZk6hC8f27VMuyxm:kTy24F3xSvym2GC
TLSH
T1137733267F4DC579EA03427B9181C493786962E9C246B40F25A41D6F1DE3E9F0F0AECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AstraClient.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\AstraClient.jar
Size 16.5MB
SHA256 7f4a37b83bf4a3c4b87cda2bd5ee5e0bc6ae0ff0009cf447466363a6d9d71e12
MD5 6af42089042c5dad982646dbc8654ee7
SHA1 d2cc88bf32f5befec392cfc03db00d08f8bcfea9
SHA512 35a2a165ff483efccceb5ca147a0c3835a60663db5c78117e3d2320419f6e871514eefe4a633b9eb88d01d42f5d3d0e4bec7169fa294d29a4a344da0264c3baf
SSDEEP 393216:bWgDiv6YQ34BVayq6lOqeoRY/ALSNNgb9I1ax77XoUl:Hiv6YeEq6lPLWzax77XHl
TLSH
T1400733DDFEC8C91DC1A771BC44958143AD1C01BED20CE01B91A5AB9A24BAED98B07DFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Axylis Client.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\Axylis Client.jar
Size 20.7MB
SHA256 81160be67d3292dc1511f37357bcb0b95459a65df2a94cde151a3f189db78eb2
MD5 b33f14fd4e7b16da0b8ee0f7cae989a4
SHA1 22d1d9dda512d7f3be107dec01d070dd2ef28c10
SHA512 e994c060e3a55de850bc88f91af77198e35e19b549ee3585f50a88fc8bce201693ebe6f9a2dcd9c792d51c3bf2041fa39f70efe670a954b16e4b84ae8aa1e57a
SSDEEP 393216:3/ibmiIlvvVceNghM0dPEiROT4TZcM2e1s0n62T9qPe5G5RJyvqRq:3K8pOxMiET4uM29QqPIoJeKq
TLSH
T19327332C7ABA943DEECB427A7111DA937A7042CCE301F10F3965D18A24E195F9722EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hatred-Cracked.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\Hatred-Cracked.jar
Size 35.6MB
SHA256 e5a8eb04ed17bda521a59d5d2e6cccc8be5d2a231d46c8343ba354fa9fc0586b
MD5 03940ee1fdf0b361d72f80631f23e30f
SHA1 31ab63ec70296793e7e06d6769648610f490cc97
SHA512 73e8c2894bab0e7dbbc23c2d29d1f347872c9dc1db30c062cc9d79d0d49534f0d02c765bfcc922642025aa261bb04f70df09e6b50e5a49f8ec05d18a1abd62a4
SSDEEP 786432:8jCLprS5C/s/TrA/Ly7wb1eOT3Ea3nibs8P8F8mWaWk22TmEJovI:8jQpE/TMDgU1RYs05f2TNog
TLSH
T123873333BECAC566F82782B244C08253FC3A50DA92496D1F15A04956DDA7D8C1B3EFDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Veltragossa.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\Veltragossa.jar
Size 25.0MB
SHA256 a9dc263076162c1e75fd31bc73a00d41333f70da378c107678e0ca0b806713ff
MD5 179515935dad4bb4b84c014c843c799a
SHA1 99adf2df3aaf204443229f4fa02d8f297cccd8bc
SHA512 c2ea84eda700651ead90d1010f9aa79144ba6d28729a6ccb5f8646ea0254372f281c2fc33c876a833db9ad62a41bfe7349fd95c7b76cebb7fcba469d6c39d115
SSDEEP 393216:ihSSaVRmSjMcRAra8WJi/SL9TBi8kUEuP5fcwlDITzU63ae+a3hL0ZNax0VLArkD:OEjIcurZ/S5To2yNuM90Zg0Vcr6GI
TLSH
T1844723257ED5C82DD15B8073559184D6A82C22CEE44BD0AF47B8098A6DF6E8F4703FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-api-0.116.4+1.21.1.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\fabric-api-0.116.4+1.21.1.jar
Size 2.3MB
SHA256 263d884fe30cd53be977b83b0968cb5dd51ec77cc4c50ef78f52fe5930ee2afc
MD5 aa1660d1af25eb18790182753f977615
SHA1 39d1a6b6213d012649821ecc516ed5b5142478ef
SHA512 95060def77b54ba6c6eb5af45b478ec6926f33f145d8f3933cd90cb2b6ab6913459d3d0afa3afcb01fca07d714628414a41ee8b6845261e88d92b83bfc668ad8
SSDEEP 49152:e4KES8JxD4gMyOZ8TlfJjOBDCGhGTrXdR8MrEB+aW3Wna8K3KB6Eoxj:jKP6B4f0TV6eGsJeBLXvK3OPoxj
TLSH
T184B53371BB0B6149F1D2F8B01980D8864A31F59E58AC9FD897FA3C08DFA6D7E5385318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-api-0.119.4+1.21.4.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\fabric-api-0.119.4+1.21.4.jar
Size 2.0MB
SHA256 d183bacb845167f09264c2f90322b7ecffe8826debda6f60e597889264bef4af
MD5 128a8d042180e7c92567342e21a21a6d
SHA1 1c7871b6af04edc8b8f0dbad12606d67f6118a11
SHA512 16b679f6a42549ca3b6bc147de710b2c8ba2d5e4661ed88df22782c05a4a5f6c1163d7b13867687ed91acde0fdfe5a5037d05662431c946865b58396284e7ee7
SSDEEP 49152:qysKlZXgbGfRCPAalhVUpGhJfOglIdW/JfSyYsNaoO3A:n/ZQwTalhVHLAW/BRJUA
TLSH
T164A53364F29A1D1CE497F8702CD2D9E18C0794CD3B218B1B759931964A4ACFBB3623B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-api-0.92.11+1.20.1.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\fabric-api-0.92.11+1.20.1.jar
Size 2.0MB
SHA256 3278787c04ad636525b5c3400dff8302420f79279f6d51ce3edc0149060d12eb
MD5 480888e4128874e4be052b0e7ee81697
SHA1 2824689367eec2b52c6085e968343751137e66bf
SHA512 fb8d9d5c5ee387b12770fcef1cb4327f1575bd21606f1a268c9eff43fd3697cf0a3af55dd688cdc913f1423737f8905e13282eb69dd69f0995c32d6e620efb3f
SSDEEP 49152:sw6yLzI3PVF+6U3l4sycTB8dGH7QN1GxML6c7D12k4LQ4Iiqn:sw6y6PgTW806xMPV23LQ4IiI
TLSH
T113A53377F4485096CA5AB8BE7801A6045240F8EE3B0CFFBB1045A66C2FF5FFAD150A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fastclient.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\fastclient.jar
Size 394KB
SHA256 2088a4dd0971370bcad9456ba444589119179ca2bb6a4feb61bccc2c4c8083b6
MD5 2083018995f921df519fb3bed5028215
SHA1 2f9249f9bccd0f3eeed47b9dd4afdb0f3015fa52
SHA512 c8b3ba5c62f34ce552dea80a1d8eb2f34dd91e3a5f11f4065b523c3a21141c6227b7663fcded607014c536c8c40f3c6c73d9957681765754220522e72f7afaab
SSDEEP 6144:9EGjOyKIhyyU7Of/7PbmwqHdTw2rYJANp396bJhWbObEJ7xxeVIDiOmZvHQt+JFm:FCu7PJq9ffNpN61h+ObymIDZm6tll
TLSH
T1D28402D23DEA8675E627F431E5268D13BD8B0149DC09E0E70EA41FCB2DA5D2987077CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sakura 1.21.4.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\sakura 1.21.4.jar
Size 11.2MB
SHA256 37b8fe0ebb1a5c2c06ce7513aeded0277f79d6c255198de4ac9f5015e96120db
MD5 d613539157516a78148859274b7479f2
SHA1 e5c7d5c5b09b43d87ac4adfe963f9736a7ac1271
SHA512 00bde03e2358027b3c77f7f14531d71fa993ca1ff7095a17d085b0ff172ed5bd14bd3507d16d3c6443874996f73066b470f9ba30e533e98e107ca0dc858b8cb1
SSDEEP 196608:0Vc9IBjZG9uCkvtuxZxKgVY0WCUgYcOajsb+hjMvrsuBJQ3TWUH1y:0V1ZHOOcGCUgYBt+BksUqCUE
TLSH
T1AFC62265FE99D93AE0876077194080F7A52913DBE046E01F8EA00ADA99E0D5FC707FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

satin-3.0.0.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\satin-3.0.0.jar
Size 96KB
SHA256 d7d7924563194d42705eeb646ca021560114645e1c2cd46b3a9a37565ecb3dee
MD5 2cf1534f9e818bd567837979444557e9
SHA1 03fff6ebf3ae3a44aaab339f0104a0a623fd3b07
SHA512 10df3022a85b6d20801dff8ba25a516ed5e8d749eb9e25b32c193c5ae6fcc5d67dc4ff8f4fd9df808d6332ecffe9af1468b737f0950398f3e173274f997040e9
SSDEEP 1536:Qglby6Fp7MUZTaXJxBXUQNjxHeTUO6oW92CyJafm19OoWKwVxjn+f:RbyutMAaJxBEQN17WJaftKwTz+f
TLSH
T199A37C15FFE7E12EF0A7853241C38A536119829853C6E11F24E31A9A98E6C774B17FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wild-1.21.4.jar

Path C:\Users\Admin\AppData\Local\Ymods-Loader\resources\cheats\wild-1.21.4.jar
Size 11.6MB
SHA256 3239e484570ac250ed639117dfedb9333f936d3b75a3154a8d80e82eac6f43fc
MD5 5a1e18c864cc487002d9f9b64734b161
SHA1 69dff973f3166a1c6e8de9408f9892e9da3d9b95
SHA512 21bc522d125a5921c625efce2247f6b20e325b26234bb99b0235b26ecfc5582c6c2079c0f3d67942dcfeae6ac5fd2661326122dec59ebb3adf2b1f665d5f1261
SSDEEP 196608:nI4AugOFHJkSFt4RsCQkjNWOr2ur7KL/j1hA8N9LatmgZ16ry6:nvHgakSX4RsCf4Q2os/j1y8/qmISy6
TLSH
T1D8C6335978AC507EC48BC235D400C5A36A2B914D540B761F2AB44CAF8CFEE6F5726FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ymods-loader.exe

Path C:\Users\Admin\AppData\Local\Ymods-Loader\ymods-loader.exe
Size 14.0MB
SHA256 460bd34dfc9a2db8e3e766acb0b8777e5ea8ba716f1c11d15172bd07e8ab6417
MD5 b608a9a830098e88c825923aa92db623
SHA1 8dac6483e50bbdeb01336416926ad69e8b377973
SHA512 b7cac5d2a14460318d68452208102dd2caba1b7364276b0d4c93eeb4cf80812cbde8f78c94e1e01f6d0bae7208b906bbdd0ea17d9296a89208f188553da270c4
SSDEEP 98304:IckBZ4aA7bOCLMq4GV9PAMuCz5JPz7WUQ8xL3DM9XfShtC+g9R21E5u6zU+7Nl81:EYTVt5JPR3+XQlg9+cu+UW
TLSH
T1FDE64952F66280E8C57AC075935A6233FB71788907357AEB4BE48B353E26BD06B3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 63c9842616e090cd67ca398ae687a1967b5e77b8d1d6354302e2eee342740e19
MD5 cbbb75b0939c43edc09a9c0f9ead8dbf
SHA1 d767d8760bd9403420b5ee0db84a810f2dce5a46
SHA512 b3d2eee5060411cbd00c6aeda3fc586df688039f5507851111b74caf476a619cbf998c2b8cce84ca6b379772ab90e6feaa08f06166fd8c9367cfa8faf0b614b8
TLSH
T14DD0043CF314C501D00050711455714041445410501143050030041514C50515315150
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3a79f3d31a9afbc1500b82dae484136180fdb6ca3c61b64adde6d015accb659e
MD5 ddc060c85f276ea70757e9c010398ce6
SHA1 0d9b7b9ccfcfde2866f38ea7525f2ead67b0683b
SHA512 e478f4652530143f6cafe94c7e5b72dc2e58f3c3b4c817b4e7789527d304e2cca352a5ead432d221006b17b132b6cb560e69d243622f1ff43bb5c2d9cb892691
TLSH
T19BD0122A73118634C0102073144371480440D11B800581055438892E2A480A01B16491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 030734ffa89d02aeb07723fd825fce1a651379c9b45b6523b5943f8bcac25399
MD5 322ede32788aeb8934481d1f9e5f6fec
SHA1 628d99c142869fc2f3c20128085e01df722e52c4
SHA512 ab86478e3e81f5e805c1b6438255b2852d409b680727132c09467687939b20718cab6680f749d1c14c8b04cfe47fcc0ded6b713e48dd5af7474604797d2b96f3
TLSH
T169C04C1D2AA9D504C7C9E5FDC8D6A89030715C5921133CD95AD1D2356D08F7147E1015
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5af1e3.TMP

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5af1e3.TMP
Size 48B
SHA256 b88eac1527eac09c6dbbabcecd667e2d3db43fb2f0ff2a1201c50c911942e96c
MD5 719ab728c29dba5bfda9bdc05c5ff71f
SHA1 c7cdd926e5a34b16895d40697bcee4cb7b93fcd4
SHA512 fc5e110037075a21e0b89f77e0a81941c3c5c4cc9630d076a8e9de17d52c4bbf27af3259fb8008873a36cc29f206b05c0b134bef4efe0ca64430b9c6b77d51b4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Preferences
Size 6KB
SHA256 6886eeb336027f7d4d3367866817fa8a5c836184db7b0882fa89546d36abec08
MD5 8f154a9ecd3ea8093604574ee68d4cf6
SHA1 611e483eaae8d42ef47b8c50ccb0ac65f21ce255
SHA512 b982335da79cf4f19c542b9fc091773a9972e339e2e6ecaed135fb80411d9d8c18b65ced5df10cea83ee9ae0d2b6dfea4df99f437f645a77ec9bef9bb99c8885
SSDEEP 96:stV05GzzMZb9mff6Z8i0vhEMktDm/7qx+WVHMSm+uecJDAMH9dQjAP+ged5OMOB:stV0CXfCZ8paPy/S+WiTDAWdvP2OMC
TLSH
T121D1B6026E6879778CC7F61D7A35FB52E2FA102261C50E98EBFC861C05E66DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5b3bec.TMP

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Default\Preferences~RFe5b3bec.TMP
Size 6KB
SHA256 46b26b44ca2d67291d3dca3d2ca22dbfe6fa8c8d14a732c1501b0aa9b3fc86bc
MD5 b55bdfa2238b452a9349db7f065396b0
SHA1 831289198e4cd198d2e358929bc9a4d34af5586d
SHA512 e018d95ca96a08275830d4326e7964386a42b917401f736072ae8960ad7107ab9424d4eb53b33219802b3c6c4b47ea103ca42241b8f05c907dd39c2b943c8ad9
SSDEEP 96:stV05GzzMZb93ff6Z8i0vhEMktDm/7qx+WVHMSm+uecJ161idQjAP+g9OMEB:stV0CWfCZ8paPy/S+WiT16wdvPzOM8
TLSH
T116D196065E78B9778CC7E21DBA35FB52D2FA106261D50E58EBFD861C08D66DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State
Size 1KB
SHA256 bd45abed8668e5b6809505571fe63c3463344ebf7dc53d00b70604a60c9a9d3a
MD5 5535e20d3c1bc65f5d9350e9bfe25da4
SHA1 e6882df9ba629fcc8afc5e01cb1d9f0ff0b7042d
SHA512 6904396e5ad9824b6fccb308b8c2ef0b3638501b166b62725212d47617ebb2811b9f07ee7d8d7c4dc29880b3278843244ed8cf6d31559df86097dccf63054fc3
TLSH
T152317973A5845732ACC2954EB187BB579F31503D91534F58A3DE4F2402E72DC5A3AC26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State
Size 2KB
SHA256 263837a58ce09f165bd700b3edc1fd2805e58360187df43f29d0a4354a637349
MD5 39dab736eba821ce779e78cdaa048ac6
SHA1 710f78db458efa42a98f5faae2eaffeeee47b5e9
SHA512 4ee5c753dca2ae56da3462b4806a1aefbaf8f9074a1824fbc72bbf519abec0b48b410d7ac8ac7765d218149b261f88d731e86072b609a29810bcf68e2495ee81
TLSH
T17C51C7737804A6378CD3954CB98A7F13DB36517996931F649BDE0F1801DB29C1712C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State
Size 16KB
SHA256 e0853d241536232c9466545940dc70203ee62fff55f50c15aa67487993567357
MD5 06528f76d475089f40cd2f5c7397c307
SHA1 ea45166429dfcbb9e3d27c70310b7ec78099c8ec
SHA512 0b7634483946dc31a27aff2705cfe829c97d5c2f0408aa2c06d91a1de49249a3b5edb5cc229f9962a4e3f50d40b1c1f251b179fe47b0ed174949d7b0ce0a7e85
SSDEEP 384:ze+aQikB+z/xvxjg/qhEbNbkEJskG2dbQ9zp:l/UxvxjgC+vJVNdUFp
TLSH
T1F4729E2B65683D3399F3F5497948174BDBB594B690C26EBC4EEE5F0906DB3E81302D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State
Size 3KB
SHA256 b7beedbf1f649c865f8804754b44a02fdaf5db49a67fe9ba296a2c842fb9de66
MD5 0ffaa3a08a2b67d9538ec740bb900e8a
SHA1 6eb7d85976cc1b65c8c9edb3667efa2ad9758384
SHA512 c3d6262e9aee40ed305ec8b8ee83cb6a1f7df3beeadd5ec27e37dc28396b83e589d2125ad74605c62ec821b8b4d9ace85da49bc182cf8bbdf374598af051d93a
TLSH
T11A7195366554A5278DE39909B8863B16F765513BE1C23FA8DAED0F1C02DB3981351C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a9e74.TMP

Path C:\Users\Admin\AppData\Local\org.Ymods-Loader\EBWebView\Local State~RFe5a9e74.TMP
Size 1KB
SHA256 cb0a8ad777f23d49238d44da890865a247bf82604be6c904381dd62163ec4614
MD5 286b8050ed3861005b1053892a13454c
SHA1 46f917336600262740727603fcc544ce498c1c60
SHA512 9999ca40263e63ac53b8d3d94f972fe27896a889396675a1d9c8623ddbf92b3a744780a5b83ab73ce8e0802c96363fe4d2ca21eb141f2233353a51a1a4826440
TLSH
T19B21657390846636AC82545EB143BB476F21503992024F1CD3DE4B2406EB1DC8B36C36
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\AlternateServices.bin
Size 41KB
SHA256 92e42e80543c01a90e705e82428fc9199f20f8cf81ac78b7fd96724045c0e62a
MD5 df3d6a7a782c33410066acdda08ef6f1
SHA1 bcbad6dc1c58cd082f42b3f07eede18af802ccb5
SHA512 acb9a5b6c8e77419ef2c1a1d993aa6a362cfae172faa36aeb00a6a25b3ca7e37e0164a0fa8d1238c6004184523749dc0f05aec2c226285ee15d93432b7f3469f
SSDEEP 96:i04Ho2orpzGDebOJ9bfpebvpf+9bSgbgzwbjbTb/bnbzbfbZR1Y1Z8yxctJrbnLL:iuesZF2tKxgTGg0gPgCzkdUF0
TLSH
T11513CAF726B6A562F4625FB490AC34D8EC33013B2C918A9DDA04C4D756973A0E07FBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\AlternateServices.bin
Size 10KB
SHA256 d7c888669668ab5747e45b04458b2ab9c4c79908402b7a5f324b4aafa399f6a4
MD5 9631fe6e82190ec658dad924c051cc9e
SHA1 cf85c765b90362f961288c7370647bb43a413108
SHA512 640aad1cb3121304dcb55a5ed80d7cc7fb2d736fc1149d9694111590c475e18523379ee5842394ee8e49faeba7f5b51b681db341b4483c089f65a59565762241
SSDEEP 24:guhMZHf+lzf4AfnoPpuuqfezRpudVfNkjpuEHPuysJbF0J3uibfWKsJblxWKf+3N:if4Q2oPDpzRUMZebOJ9bfpebvpf+9b
TLSH
T1C222FCF756B69251F0714FF450B8348CAC37013F2C648A588B04D5CB02A7BA1E0BFB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4f3b55fbdb55f9dae79ae4f611a596b5e9e6dc55070086ee95e5c761cd8e052f
MD5 435dc19b02d874b25b3b45e416115874
SHA1 0ad8b03ab5ed05e2276867259e5c9d5009110f4d
SHA512 2f6bedb2c12703398f6ebf31347a4537c765a11d79ae74a883c9b0b29bdbb1ba6ef00625e46fa99746f5a87497f9de6315f8474cc3424d42a797969bcc2cd321
SSDEEP 192:i1d66Joz1zgCl6mc0d7Ov5zboBMdMyjusF:sd66Joz1zgC1jKboBMdMyjx
TLSH
T174D12FA4F628463FC409427BCCA50B454F35385B984F7F2936DD64482C5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7f0cb94b4ff64f74a38575f51d1d354d8f1a29d66f6d9ccc1c62943929af4482
MD5 80c1dcec06d2f735175b5a48b3b1da6e
SHA1 ec76843cc8c13dc769bcc95d3184bdcd7dd11e53
SHA512 793115e59152ca540ea4f9abfd531c2f287372f5734afc2c60709ffa587c4783a88284e127bd0bc1555d01b7f836afb4b317cbd9822ebe2b4baf5cf17943b152
SSDEEP 192:H1d66Joz1zgCl6mc0dcOv5zboBZdMyjusF:Vd66Joz1zgC1jpboBZdMyjx
TLSH
T196E12FA4F628867FC409427BCCA60B440F35389B984F7F25359D644C2C5B2DD7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\events\events
Size 4KB
SHA256 6e32ffe4fa525c1260d8e56783e76448d41c616479796ed457f0414a10a0c0fe
MD5 63a2b7967f2432d071f950e730a1bc94
SHA1 b635b18910d7f138802f8f844cbc324029138492
SHA512 978c4a8fdc9a2fa9a3ce0b8cef41220ab5acdb535846a078d708f68ec5a9c3f7fe431a7e322864ed3c758fbd96416e7ae67ae1fbfddbb2e452538337f6253109
SSDEEP 48:Y3b2BRp86I5EdE7gQ4r8Lzi/vOCCT5pC9Cp3p/Vzi/UzShMI37bW5W7cJaLWms3m:5IG7mLrJTe9Cp5VweI6fQSlTbQ
TLSH
T1F091001D75BA5C7F6CCBD3D9B841068D82984B53A8C71C8B0CC6ED4DCD86A9A326F029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 158523ffc41ef18ac03f6062ec54feb4ee619677910a734462f3243510060e34
MD5 5156728f47f3dddc4c5f349afa5b29b5
SHA1 182451fcc44cf506f1e5f93ca36ea7d68725f7b4
SHA512 0b78c02c7ff8ad0f55f2f83bb483bf9764c461af60b9cd2623f718af3631ddaa6b7f245131089dc279b4686010b92eb3b71c9f87493be416dd3d78c2c4c57175
TLSH
T1A0216E5C39B88D2AACCBE3AC7481128E63154E5B68471D474D12EFCDCED1ADD31BA439
MD5 SHA1 SHA512 TLSH

Submit Download

0d53125b-3533-4ed3-880d-dfd53ed45d00

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\0d53125b-3533-4ed3-880d-dfd53ed45d00
Size 16KB
SHA256 30afc01db5c8e6abdcba3ddb5947c91f1e93627cf3eb4722d8d434976b6bb984
MD5 74c51de75100eb447b316d03d415efb3
SHA1 281a2cf93603bf841d4f27a39b77655f62052e70
SHA512 83ef6df4e4420549c706eefe9b3394f4e38a46a573a5cfb7f758cedb0e454e313714fbd746aed4d98378e42ac538f21331bd28cd4a70d8703a0c2ac97a95a858
SSDEEP 192:zcSzxU7ifGnpRJHUHvW1/iEtBSz2+IgvpbONVUFjuAhuQYf6OTKPO8/VjhOVno:ISlU7iunvcOtcz20xaY1jUVno
TLSH
T15272CA56646046BA8251E36898FC7FC7E6F528CB4C019FCA9BE4BD0869DE05E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66a52100-b5ab-4e2d-9582-5e68adc02b00

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\66a52100-b5ab-4e2d-9582-5e68adc02b00
Size 886B
SHA256 d1a0e18a0146101f087fce50480cea76c0ed6ae2f7d1ffc4a801d91f9874fbb9
MD5 e8916ac924e995a013beb24dbcc858d3
SHA1 96d77b63f02c0311593357d7ba922cb47d018109
SHA512 2ba4197543c46bed4f06c2d190516c9544ede202f0c940f5a769f120d9fc95056d4e242dbb115add24b3f74286738b7e0906e9460cdccf68854d4dc8f0eb1ee6
TLSH
T1C11144418A70A4B28C6DD15B88D477428FB47023C0C694047E918A080C7A11EA76770B
MD5 SHA1 SHA512 TLSH

Submit Download

c29b18fb-19e7-4b5b-8a44-43c00a458678

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\c29b18fb-19e7-4b5b-8a44-43c00a458678
Size 235B
SHA256 d8b95815813a1d57acb6a4b8f217c22149471ec58260c1528bce99232fe85d42
MD5 725371e2f98485d1d0b8b22069407318
SHA1 2abd4e38b5bef6d0a00e58db5a5e4c11cabd2651
SHA512 41d744963de5f7773086c810865e1b43146130f82faf312f7d0a28c95ad4256c9e840d12bf3694e718cf98edaaf89676297a5d33bb18ab2b64f26323a0ba4e3b
TLSH
T1CCD0978024A8635D08080F03F1F078C3B2448C3318A4A82097908478ABFDDCA8222C0B
MD5 SHA1 SHA512 TLSH

Submit Download

d14a7121-7b09-4936-bb33-c91c58046ed9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\d14a7121-7b09-4936-bb33-c91c58046ed9
Size 2KB
SHA256 644889b30eb13665baaa6a27a024e1404669448dc5f763726a935974b973bce6
MD5 fed133f40da8ae50dda28f2b8e6601e7
SHA1 af0a62ea0d65ed6a03b8984c545522c9a5204482
SHA512 b640f9b3b755c07bc29e2f05b017ad4912067887aa60a1c16bfe407eb719538d5405aec2db3325d7f5968a7657ea77b84e4593dc8fccc06901ea44ba63f6d6f6
TLSH
T1FA41345C35748CF78CEBE56DD442238957E0890340C62847AE51DE0CCDAA75D737A52B
MD5 SHA1 SHA512 TLSH

Submit Download

dcdeebca-5bab-4515-908d-54e9201b5531

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\dcdeebca-5bab-4515-908d-54e9201b5531
Size 883B
SHA256 e31456496e81520481dd58eac02cbbe90b96a72d4b2fbf0f0cb75a1d7364bb70
MD5 cb7e31b554566e32cfb106dd249f2d16
SHA1 8a909b80391d5d9e2f2e460aba038d552367c8b4
SHA512 33d9c473654da03c9652a8f85091ac9651778269bebc0bd95e3de64c8a40ca709a151310cc6fb5e11b58cca893524c3ecec73c2dcd88388590ffe53ac63bea2c
TLSH
T151110041A67079B2CCA8D15FC9953B028BB8792380C694047DA05D040C7E52E936730B
MD5 SHA1 SHA512 TLSH

Submit Download

fd42a676-024c-4d93-9c41-47448ed4d5c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\datareporting\glean\pending_pings\fd42a676-024c-4d93-9c41-47448ed4d5c9
Size 235B
SHA256 ad7fb993b1f4ddb0076f1dedd6cadbfbb506e7e0c3e6c95a2a76a50cf5d639fc
MD5 6fad9d3c6c4648e68759adeb7e77264b
SHA1 4893306f1befafcaec0de8e6e237dbd84e7af508
SHA512 c5a222a402f1cbe8cfdea89477a9f67a23b3a20854c2ab3a75fbf5049ffa11be9c228b7282b5a020eccf5a1638a2639100bcf72265dde920d9d09ff75a88ce8f
TLSH
T1ADD02390288CA76C0C100F03F0F07DC630898C3331B4AC24D592023989FDDC84263867
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\extensions.json
Size 16KB
SHA256 25cea7f56675d299e08055836af25418e1376ddb9e0c78acb93062c021a49238
MD5 2cfcbfbc86e629cacaf1bcb39b27dea3
SHA1 b4d6747d304b2076ca354752447b49073ef94a79
SHA512 3da2c06e2ac9b3bc4a7fc037ee04d6ae8b76ff00f903c6d45bd8a259393b7d96c696547bf7d00cfe8a326eb1a2d133402d86acd1298ee82d11e3a0ba7a4cddb1
SSDEEP 384:XAkkI4vSUmldv18dhWM94zl96oHL4HWL4PdL4HcL4H5L4HbRS4hjH:X6I4KRfWXd4H6M484F4W4R41S4dH
TLSH
T12072421545048EB8298FA78AAA367E01C37D473B60855C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs-1.js
Size 7KB
SHA256 b839b310d774961303aaf8037a335e49999ad5350d9a0e632481c51bd1474bd0
MD5 02f73db3382a575baeb7413a363f9fda
SHA1 f3f23a02e7d3b04f4523877ebbcf84308060b42b
SHA512 b256b67ac49416beb91abdbeaa8c5cacf799377a3c311239a77bcdaeae07a0c7730762fd81827ca0af8f3c1019ebc5549c1703454428e4caf415963a0a5bc4da
SSDEEP 96:xHyoJTUQqGqi66fqbWObzScSSlNdv9jRn0H6nXBw88ZvzOiv1xDF8L4cnfToU8GS:NyRz6fqbWCSSgGBw88ZLOi9xDgG
TLSH
T1E9F1EC786044CB7F74B6367CAC68497159B2023B7ABF68D750B988C5051CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs-1.js
Size 11KB
SHA256 951ba85d3450c17359cf21912051c61264eeeae68c8ddbcb142cc94dcb310c81
MD5 0f4bc50ae3aa340512bd767646a31143
SHA1 cc92ba35fcf09d84c04a4d3a4eedee7edb1fedad
SHA512 ba2021c41e8b16444d1edca5d4512f059328b26cd62d44a39ef30fda7104aa02b343c070c629b0ee727fdb36cb224e527145f8efda43a99f74485ec2b6a1190a
SSDEEP 192:NyRz6fqbWVUmSSk+OieOBw88Zd1ABLIU2+BdeOi9xRpdDVuAYt2jBc8TxDxt4fYd:1Ltwpd1ALIU2+BdeOi9xRpdDVuAYt2jz
TLSH
T11232CC387144CB3F24B6327EBC2549B019A1423B7E7FBCD605B99891455CF2441F6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs-1.js
Size 7KB
SHA256 9e45907c3f8a61efb0e1e596940fa701f0be2f222f7edf59405e6b91d01a68a8
MD5 192cefa1a1c020bca7c72a5622eb288d
SHA1 2e061b5bee3d20bf988d129364587de1d6cc6dbb
SHA512 359c3b1cb92d6f68914479d0e2ad393db3d39de4fa7add5050fe2b71adaf0acd30fc2462dd2a5eb477620a02ce25f431e6c1b6e9e7449c87e156998fd9a9443c
SSDEEP 96:xHyoUTUQqGqi66fLbWObzScSSlNdv9jRn0H6nyBw88P8L4cnfToU8GS:NLRz6fLbWCSSgXBw88WG
TLSH
T160E12F789148CB7F78B6776CAC6888716AB2013B7ABF68D750B554C4011CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs-1.js
Size 6KB
SHA256 5701a0f191a2b737daa6f317f4c359b9ff27d70c6759e906aadac9ea966b5d9c
MD5 9bab489ca71805674dafe56bcef74f97
SHA1 32306dfeaca72f1729e7bf13c7efb8504e3d84b1
SHA512 9730bd2be0dbb129e88689bf1c0891c9cc9cfdbf38c0b350e023c7a4c1ca180a5153de0c8826a2fdd0cdab96b6c02a945be2ede8c9223610fcca1c96b0868f83
SSDEEP 96:xHyoUTUQqGqi66fLbW1zScSSlNdv9jRn0H6nyBw88P8L4cnfToUh:NLRz6fLbW9SSgXBw88W9
TLSH
T11EE12E789148CB7F78B6776CAC6888716AB2013B7BBF68D650B554C4011CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\prefs.js
Size 6KB
SHA256 036bf13cc517e901ddf57844775b8841bdb4076eae116e6e2ea2971c442e214b
MD5 5f75886841371839defb14f3e43dd6eb
SHA1 0311ca41d0bba64ad86eed06d0ec17dcd4884454
SHA512 13ae52cf78eba53e44e0b902c52680e5b17dd5923553b3b381030a236d16a2638cb4ee1c43a633287928102d992cd85c5ea2587c713b6a6a01a9a495df6f7fa5
SSDEEP 96:xHyoUTUQqGqi66fL361zSoSSlNdv9jafn0H6nyBw88P8L4cnfToUh:NLRz6fL36pSSBXBw88W9
TLSH
T1FAE130789048CB7F74B676BCAC6888716AB2013B7BBF68D650B954C4011CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serviceworker-1.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\serviceworker-1.txt
Size 147B
SHA256 30ae54f2805b532b70dafbe2fd617b55ebc4e4212b69a870cf24b1acfaa22a8d
MD5 9d57f0e15e9f96eccd3a374607c683ab
SHA1 f50aaad3da45b5610c4e26dbd1d833f613d37d62
SHA512 1e1ad47aff0d7db07cc1053efa2296ad960707ee963c32e1efd7bb86455dd7ed51a57d504ab739005be6e65ce3c90fbba38aecb423b11d84a87219ec906dad4c
TLSH
T1AEC08CAB7020D8E374040CCC30AA16481FF30438DC8381AD4082073800410A20CB8126
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 4e7e684f187619f91a85aea770183cce0c7e031e7ca5b59989bdc4b1731e2647
MD5 bc7ec15dd65419b78b0db121db9673eb
SHA1 b7110e5b29dbde836cbb132d2c5655609f9a66ce
SHA512 59ba49226c88c044d410123fb984a3acf277bd0c4c8eb30463eab773fe52df5ddf690d8c4128b663ed0b72bbfb018720802bd14f40be30571c5449d45b04163b
TLSH
T1EE2106C3246B0DF2BA9AE0B6D8CA4FF5C3483432823408F0C5D90E8240FF48CB2C9229
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 4760d276a8d5bd91683d0ae359cfd582eb8e14ec70cf798aa9bd77b651c7ea04
MD5 006f7fc84c2128ac7dd21c0a40faa8ab
SHA1 51eb601e51c45db4012ebdd23e14e4315276f04d
SHA512 36ca0cff16d0ca067487bbd6e552514e92b655f8242f6114537f3373f43ca36fc3ecc76a555f63bd39c853ee76b2bc6028b23b7518efe2ffff257060658e64c0
TLSH
T1FE21E7C77E0B1CB71589D1EAA1C91BACA7962016C728A8F0C8651A4141F8A2E72EC30C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ca98c6b60801eb2f22bbacaf81940327496f44c6136d7b1e3d8907f330a7f018
MD5 3a7b3f958601933c436ab40f07deb121
SHA1 23b6c3b7dbb382362eb42b8fc2237a00cbdf8f9e
SHA512 5052daaf94e2349bc7a4a7403ff68ccc89252eea4011a9386ea776a6f9fcddf02eeca14e74e710e701a54679cb95fd52dd6497f9b449a63aadbbd936994c2a1d
TLSH
T1B321A8C2EE0929FB0F09E184644BA77DC77C6037936659E8E44966114278951A17E18A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 2031b21885a9d1f606977501e610999d3770508f36f650676bdb3c46a537ef28
MD5 b4d9e48f7e0135fa5a586826035a6567
SHA1 dea8f963e4be76e83d4bb18807db0d3652a72db8
SHA512 5fc563afefcfba71221fc57e85af820186985af4507d06020ca0397893f508228e636d256521b76c20855fb8b005ba62cb4e6daa33475010111ebcb59f0bbf88
SSDEEP 96:L2zfzMPICMrWPXj49fufDzEIZpBg2qJF7wQMZperf8W8Qf3goS25c/e689nh9Gj:L2zMPHMOj49YzEMZWFfMZg3RLVOe689M
TLSH
T1B8B18E96C94838C7C9F4A27D10C20C83D7B65182ABF64AD8E7212238C59BB072638263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 3d5357205445568621b1f5c6bb1fbc2582386afc11f31321e2336b2e3738de3c
MD5 ae59fc8ac493b287a5bb7b3fb2c1a585
SHA1 ad9e3ce00b8c5410cd581e852134b7224d540331
SHA512 c73a24fa24e045eaac89a9c630145eebf81df04a465404f55d0e775d24687dfaad06e621f31e5e4ee386e3931099f41912f2de4c5e25ea7900924a6efa9dee2d
SSDEEP 192:I2zMPHM149mXQ5pksTJrzNJwdcNbDZ48t6GEAJVFFyMekumtzDMH:H4PpV5VzNmdybDZ4eJVOr8DMH
TLSH
T18012AFC6852D3EC1C9D8547804D25C5BEB34EA50ABE31D8C62653738D5AEB0C2B693D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 13e1eae5b7b79dad853319916adf0b644994a781255ae141ed062a1221412930
MD5 c01e3d8a826102a0584f049ff1e37b5b
SHA1 2fd49e00374953765809b64c7e0602fa780f3a68
SHA512 cbdbd3c9b616f9ec8ad7f507a38b9ce2886db0dad734d63d0ab51c078ad0b9a212fa98f4663f3b8fab71d31f58f4dae08ede89c136e056c1931751ee2268cae9
SSDEEP 192:/2zMPHM149mXQ5p1sTJrzNJwdcIWZ48wmKRPXFKMZkCR92L8:O4PpV0VzNmdJWZ4RDPgqqL8
TLSH
T1FD22BEC9886D3EC5DCD8D47500E15C5BAB31E680ABE32E8C316A3334965A7192F28363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 eeee70e449d0c5552d8bd8db38a0f3d3511685df79af5b6c3566c198e0167bff
MD5 429dc1b9e991e3d1c32be24e8212bebd
SHA1 316f914ee9879424584bee6851d2bebf91391da0
SHA512 9ed958566ea69d9f859dd0f199fdaadda07d75e6d4ce5dc445bd6bfc1a699f2f185f100ea48e88ce2888dafc23d08ec2fc114148980c893646508481f8c61a2a
SSDEEP 192:S2zMPHM149mXQ5pq9sTJrzNJwdcMvZ48syn/HL7xX5FoMZke4BSAdKd:J4PpVuIVzNmdrvZ430fBgGMdKd
TLSH
T16722AEC9896D3EC1D8D4A0B800E25C676B35F600ABE37ECC21673324955A6192F39352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 58389802bf3ad5f5c32d9f056e2b87fa589977cc4b60da7931a1e1277c49283c
MD5 11f7140039dc02d9dd1c4a04bc0b09bd
SHA1 fddd5d588c56f6d8258b089a93f782ecb1739775
SHA512 39f9794ce6975d1f0041e200a92f7ca103f4d15b3f49e5af7024685af2601f09d5975b01b25f26934d98c74bb8e7dbe2ed7b36579f4af2d4e434d24ab4ea215f
SSDEEP 192:q2zMPHM149mXQ5pwsTJrzNJwdaMU7AZ48cDrNqI86DnNrcaZJFIMZkv4BKRhhLV:h4PpVVVzNmddUUZ4lcI8sBZQX1hZV
TLSH
T1EF22BFC8892E3DC1ECD4947500925C5B5B3AFA50ABE36ADC21623734D66E6191F3C763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 52436c4b15dc97df3d7b11506d718c175fbd499038f10cc00b9703b0421de9cc
MD5 b0abfded9bcbe087c32c64fe4404a607
SHA1 ba610f63ab534752d0ee33d10eb5187c5defe80e
SHA512 994223095e192df40047e6ef8657d57b634f72e2afacaecaa6268f769301dcc4321dc3a6cab31716ff8669fccdb46dfd188310a5df7182e671306f7ac791593b
SSDEEP 192:I2zMPHM149mXQ5pSsTJrzNJwdTliC75Z48QeNxtfNYHB4FnMek46sVBx:H4PpVbVzNmdTliClZ4ezWBA9nBx
TLSH
T13622BFC9897E3EC5EDD494F900915CAB573EE9006BE3298C21663770669F6082F783A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 c7f45228a8d344e939d60beec6cc7580cf14754a41d32909fbeec05d441f87a0
MD5 f3d3ffbfd139402159b63a0735386970
SHA1 2bf3a708bc33636ac0881bb3268a68bdee1640b4
SHA512 317b6859bf71178c68a02fedb2fb174d428aecef4a49b7f6d303eabebbea081d973ace581222974c3ab2065f716e479e255ef970785f46ddf754996ed7465938
SSDEEP 192:T2zMPHM149mXQ5piusTJrzNJwdTEcC75Z48Q+rN6DssQUhFRMekiyUTZnq:a4PpVWzVzNmdTEcClZ42VUxXyUnq
TLSH
T10C22BFC8893A3EC5D9D4A4F400916CAB5B3AED006BD3398C25617734AA9B2181B3C3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 188f30754b78c9c50c85f48bd1ca2bfa438163e88fc01b5d454f8b9f14c8b551
MD5 412c95d009a8c30f2e1dae0da14a97c2
SHA1 b780fb614e0e094880d2beea74301c60fb3b3ce4
SHA512 6f5019b0ff1164f546157512902852f90ccfe9426dccf7ca804080b3d1eab5c190c3654918f49a5a666cac5d68bfa5f3130ad97d78985207558b5e5a1bb17702
SSDEEP 192:T2zMPHM149mXQ5pFsTJrzNJwdTE4C75Z48Q+rNTDssQUhFRMekiyUTZ2q:a4PpVsVzNmdTE4ClZ42cUxXyU2q
TLSH
T12F22C0C8893E3EC5D9D4A4F400D16CAB1B3AFD006BD3398C2121333465AB6081F3C3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 5b5880af28cf09ed341605db1174b5372cc931edb42eaa20362288f4f936e298
MD5 89650a094368216efcd32dcfb505a269
SHA1 afbe8811d77fa3cfd413dc0e74f14517a569d1db
SHA512 6b9c3e352a879ae3296f13f610b78c0b256d4db2172ca793139e7d844ae468ada611749bd89e1b7680e0b9affe5d557fd877b91a7e2faf2b4720c3684e3141f0
SSDEEP 192:T2zMPHM149mXQ5p69sTJrzNJwdTEGC75Z48Q+rN1b5skQUhFRMekiyUTZmq:a4PpVeIVzNmdTEGClZ42EUxXyUmq
TLSH
T1F022C0C8893A3EC5D9D4A4F904D16CAB5B3AED005BD3398C25517334669F6181F3C3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6ec1a684-c2e0-41ce-9387-0566eb46a968}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\104\{6ec1a684-c2e0-41ce-9387-0566eb46a968}.final
Size 3KB
SHA256 1ecf60e8e804fdfa55d4e25906eb21f5c392c5b1a6f085df8a0a7840394d6c7e
MD5 67b0eef4019728072832bbe0e24857dd
SHA1 5a89f43db5867056ec3db5c13f9a7323ab2a97e6
SHA512 1fdb7c31c7ff73041a8a807c559e1cdbf820bd4f2490e8af233198df65283ae59d9cae5ecbf7aa47c28f2a5486337736bc56c3dec75ae27215247facf6f02e4e
TLSH
T193713B6F10886076B76105CD767B2A56F134A9FDC64F8212DE6903A503DF6CE211CBDB
MD5 SHA1 SHA512 TLSH

Submit Download

{f7769dbf-ca31-40d6-8c4d-9302df8f5d68}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\104\{f7769dbf-ca31-40d6-8c4d-9302df8f5d68}.final
Size 5KB
SHA256 97ebd0d2b7be09e5c3e2fc4275e9a02be98c4d7dcc07ca09c4d10d06c08bb577
MD5 18a65e5b9c710d6b464266afdf1d66a6
SHA1 140909e56a5d6480f536f2d34f6f841f5ec0542d
SHA512 a57e155c41486e2859de76358c7079936095dc2c3e27f41da092b70fc73a511ea7a2170773699f2e40db241b503c658ad671e92247d5e45c99356ed6aebf190b
SSDEEP 96:0agEFCnksbqvWS1O/KhsjfbQMnL6nrAeOnq3l/E3WFJPojEsHc6U+2+Ldf:waOk7vWzvjMXdOnwJFqqu
TLSH
T1A6C1AF72E2A0E73716C763D89601E0419C60D72C871F4EFDA4A14F55D8434CDDB2DDAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4c2e5aee-8db6-40d5-8203-490f0e1a84a9}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\169\{4c2e5aee-8db6-40d5-8203-490f0e1a84a9}.final
Size 1KB
SHA256 ffbb19921c7649fe48296865fba09cc5b0daed8615e80c28113784fefb22b681
MD5 3a0bd45c1a16e6556f7c56f5dfa6a12e
SHA1 831e2ea89a285436bd4c598496f742a29584b7b4
SHA512 1881aab6e07df29afef12fc4060065bcc8f1d8e0333a9501f51bc3b0565262629b3c7d3ee63af8a39eca74dc9a356db42d8ab56ae6577e3761d63392e7ef31a7
TLSH
T18E11B571E9BA8A7E76200103D91F69A4F38109A7518CD4BB85BE02B42051C4A8AB5B81
MD5 SHA1 SHA512 TLSH

Submit Download

{cbd78e93-5d48-4a6c-86dd-c6e4e3e8ffc6}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\198\{cbd78e93-5d48-4a6c-86dd-c6e4e3e8ffc6}.final
Size 3KB
SHA256 70650c4a292ad6adc7cc3fcad05cb7a0f9d560e20baeea52ec1fddbae3df32fd
MD5 fbc847f46b8fe18d103bbf4da01cf26c
SHA1 f32c1b4addc0bcaabbe59d79d9fe826fb349a9fd
SHA512 b6987e20fc35152e6d7099f2a95461e159c40ce15134fa518887a247ef7463a865b5fb6b57415df01c5d2ec07c2dfff2fef9f6b86542093caedacb54ea44ddc2
TLSH
T186715C58742D6A7773F964D0D9B5027188ADA5C8A7DEC1A3ECF89EE530F0F0A105832A
MD5 SHA1 SHA512 TLSH

Submit Download

{3a08f526-7df7-438e-b069-ed4d9b2feec9}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\201\{3a08f526-7df7-438e-b069-ed4d9b2feec9}.final
Size 2KB
SHA256 721223762d1c931d9b7614a933ce96e6be4699397000af5bbbd039c2dd7ad9e2
MD5 ae0374fef2117c52cb83f22ded0ed5f7
SHA1 e8d77d276dd6b1dffdbca5b563ec7f59fe2d025e
SHA512 46dc9ad9de681f375a4e84b3d672a09499545d19c0745b1bd6fec5811abcddcfa482876d4b6a6743dd4cea46600f0d56c9a6bf4070579c641187611b28ac4528
TLSH
T10141F8BB81B3D1A2A7D8509E8445A247640235557152D09A7F3A58E63CD2C870659F0F
MD5 SHA1 SHA512 TLSH

Submit Download

{60a77261-67a2-4e35-8e52-df75d62acb16}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\22\{60a77261-67a2-4e35-8e52-df75d62acb16}.final
Size 459B
SHA256 8cbc58810b87de0a914af7fe5c05d8cd248ba7499e886b62cf001fd41ccff0f1
MD5 c43a4ddda55a5f34c93f34e2e5f2e334
SHA1 368f75f2a4e29701e75001110c06709ee61572e4
SHA512 0f439af05237284cc4d70b1b5a651b5e2a3908b03d824f51c1a3e77eba68b10aab4c1ab687c4dc282380887dfae05f1d0845b7d90120cf5bc105d8ca319fbd2d
TLSH
T1DEF0DCECD17E8EC307E524E8700AC5A3A69F6458A24DA26997FD085248A0C93E3FA419
MD5 SHA1 SHA512 TLSH

Submit Download

{e79473de-d452-4f6b-96a3-ae7ff570e2fb}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\251\{e79473de-d452-4f6b-96a3-ae7ff570e2fb}.final
Size 2KB
SHA256 fa257cfca3b7c9839fff7603ab498c705170a72cb74b16c5d648b07c339ad450
MD5 cb0732214e9dfb1bccf139d8582a5aa1
SHA1 19eeb7f7ca01fb48ea9bace84053fbfd74026800
SHA512 5807cede108cde95d642a2f18ace1c69c309ac5bc8bf82b461c0ccf89d8baaef61fd5782ff4a12f5a8dd8c9f5aaf409f0a5b960f9a26b3f04af8e9a0f0d97074
TLSH
T15A413AB92D50516B33B3D1A1C087068AD3200ABF2069D224AD397C76309BAC725B469D
MD5 SHA1 SHA512 TLSH

Submit Download

{735d558f-cf7d-4360-a54a-731f2abf41ff}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\255\{735d558f-cf7d-4360-a54a-731f2abf41ff}.final
Size 3KB
SHA256 75a3de412c495d0fc4733d0a3f2f49fcea184cf8433d27a3c1d279f9c83dc08d
MD5 c75a5936866153a389f15d2346b6c256
SHA1 fbd38e127d37f6b7ec0caeb3b1eb9d6f34e0ee2f
SHA512 07c23ee5c1d6e5babd8b073b7514eb8678e1f687c2eba6342431267b2e97641f9a001d42163919928fc4a7c2865f124c0c63fe9acdebfd144af3fd80ae763b40
TLSH
T108615CBD7360C7EC1A9D37AB930E6283E3E916BD204F40AAEE9C7404C1F2185D586E20
MD5 SHA1 SHA512 TLSH

Submit Download

{a6d8a0eb-c525-4adf-9a7f-b2e7cb8fe021}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\33\{a6d8a0eb-c525-4adf-9a7f-b2e7cb8fe021}.final
Size 7KB
SHA256 5a42ef07c1399d3f0f04c31a94784e5b15dbf9ef2d96dc501f0b6bbedebe2c0f
MD5 b10d26f9f05b962f860d106122795e46
SHA1 3a256877f498715fe89215eb495912b927f07981
SHA512 e0b108dd646ee9420512c64d65da1dbdff739384e86c423b4e0a2af9860be792eee07351319e3f35f1e5e25915cfbaa2981bbada57c3fe3b58b8221113ded82b
SSDEEP 192:a3IWihd9IZzg7nmN+c5UoJvG5CQWL7cN8UbIfDF3Pge:AIXXMCOJvWUoN8XLz
TLSH
T104F1AEE6B27B90E36D6270FF64125B6132DCC78E398AD9C7A87444103084FA77269B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{50a89d71-88e2-4577-9a66-30b741ab533f}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\cache\morgue\63\{50a89d71-88e2-4577-9a66-30b741ab533f}.final
Size 13KB
SHA256 528dc110f27c8691aa60672fa58171e32c68fbd416f62dc418d3676374106816
MD5 8c56ee2b3595c13a8d155c352c0a4b73
SHA1 14da00aa2bf3124b24b8df7d581c9397ff4a1b19
SHA512 06e70832add101d172bc926bc2bb49f2722e65b9bf91f1b360dd672ff1b25026c8eb56bb7068b3088b2b9bbcd0f4be580405197a4d9e481e11f197c8e850e0f6
SSDEEP 384:E1eQV+N5Xg7iI+FNy6MEW7tK6L9cRWe9IW5p1R:E0xumI+ry6A7o6BMaW71R
TLSH
T10952D084562493AF0BF0C688B4E7738CCE55B9324E89470D838C66E611FFA49D6BD6E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

449403423sewg_asrto.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\idb\449403423sewg_asrto.sqlite
Size 48KB
SHA256 3e4a70692c4f17b63abf8d841111c3368393e2f82e60243892e085e995e7940e
MD5 9a34f3d9aa3967ed0e510ff9d8861292
SHA1 686dd7fe21782348b7f173bb550266e99339eb8d
SHA512 393ff45f3deb7c323fc4107198228003e763bbc90ac7195a93d0f6ba2fc159628c0df8a36c9c15b26d799692c11dbb2946af91326cddf92288e7db22a5d6c5d6
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:Oa16S6CKnqlizbxV+2xVeU7X2B0
TLSH
T11C236F8E3F07E511C53AF0B178A48D51BC5E321D07222AD579D0DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

449403423sewg_asrto.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\idb\449403423sewg_asrto.sqlite-wal
Size 12KB
SHA256 863425d93915ca16af891f9f42d7dc00e8086ba5b9fffe8874771fabc49c1458
MD5 686d45c0063233273cd18c50fc74eda5
SHA1 76539367f38032415d2a7c769d74f0b04bf8d7cc
SHA512 8e4a8cadf399456bca04bec2f3d94af7bbfaddedcabc36ab7e09fc2d032e19af4f74212114d8ab8fe65e6ca78560428cac53c9457c89483d5e5455559febfff4
SSDEEP 24:Kdw2LnKVfIPlbEc47lUQ3Otj2XbEc4blU8QgCmiWuj0:4PLnKVfilgcOUQ3Q6XgcuUszuQ
TLSH
T14B42EF8A6264C217E90459BEC3538BC1A04D334E38CF8723171492AC466A53447AFF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

449403423sewg_asrto.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ploc9qy0.default-release\storage\default\https+++www.tiktok.com\idb\449403423sewg_asrto.sqlite-wal
Size 12KB
SHA256 9dbeed17f8f5d8cbfac3a620826eb647b5fb6ec78af98be519fe732fdf7c2490
MD5 7e2d23947021b2b738d1a4c92c5dbaf7
SHA1 1640c28a1e61f08a0889d499ed1c2e3b578971e9
SHA512 3377da29f8c2f6ace08f20375c5ec8342da0b18ab3a3eff84ec4126609c6df338627d80a1771f1fb05e33ca7e51e1a44c52ff8dbddc943795e130b265f00eaf9
SSDEEP 24:K41XbEc4fOVkOQgCmiWujqV2XbEc4/lU8QgCmiWuj1P2XbEc4PlU8QgCmiWuj0:fXgcNHzueMXgcCUszupuXgcyUszuQ
TLSH
T19642AF9673A0C207E9065DBFC2828BD2A05CB34D36CE9A23EB48517D597B51882EFE14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpensiveClient.jar

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\ExpensiveClient\mods\ExpensiveClient.jar
Size 22.1MB
SHA256 e5d4d594f03fe7ab907fe3d012461a205cd0cc752b53958766f30d197ff789ce
MD5 81a544a3b709948d962e72479be43f88
SHA1 cef18af488e7593cc8ad282f632bc5381aa8916e
SHA512 744a536391215d3c9d0af17c9efb342f1300b88e8b0154c7a8d335e3eeaafec6d538116c8bb8d70109ed9895c7110c6fb7defd3bee9cb905f1346e628bf528aa
SSDEEP 393216:+76N677j7jX5Bko2a2oRvBd3ZC9XJRoX1Qha2ZgEtI5DGj5BTU5I8HSN5BiJBpRk:+i67H7bko92y5itzk1F2ZgEtI5azr8jG
TLSH
T13437021E7DAD89ADD91390F2D081C896655C12CAF059A09FDAE50A8AD8F5C8F0703FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accounts.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\accounts.json
Size 49B
SHA256 dd1b3142c0f3dc1428062ae7d08b449b557c67ccf0a0482bdc0283e56f21c201
MD5 a6cea1527595ae0bd1ea3e7ec4070496
SHA1 00e8ca70d621ea67ca91245797fcb5a457c95e83
SHA512 6f0280ee59f5242588d55a8eb0fb78c9e42b564bcfdf5eda27a0878b1cd839d094b2feed1ee0b1c548d2159785116e3514b7ad08cb8a2a65d5076c670ad1e1c0
MD5 SHA1 SHA512

Submit Download

accounts.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\accounts.json
Size 376B
SHA256 36936a44e658f14c21a80c2248303b0b7527313ea224b49f1066da488afb0c20
MD5 3c125bad6e20dbe791d8ebdce903fbe7
SHA1 a6cbb751c2e7c401fb184bca2549bf6efa9d3553
SHA512 0b1955b76624a37c70ce0f1efe58165e4b8518c6d7b758fabf01bec9d0f700d0dda36ef0bbafea59c63bc000740b503a8b4ff4fb996e1055cc16b73d5bedb5fd
TLSH
T19FE0262CC0616C3358C61B50513AB5E662E0689705E26D9479AF610C2F39F5A895EA1B
MD5 SHA1 SHA512 TLSH

Submit Download

accounts.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\accounts.json
Size 310B
SHA256 4b22bd18f9a728319e0a8ee7ff7818ae0d167f3b250fc65218edd3447aa21b35
MD5 18fed899ef9db72e1562bfbce73a853a
SHA1 8c010e0bb6876c32ab83913cbed244b7413373a2
SHA512 6fd11fb7dea0b5a128f5c81a76f565de712ff0a345da3f5357a8b4a2f7b0816084e4a3dbe2c48a4406f1ad165c9fb2903cc91f0ca7d6fb1053defe645e36238a
TLSH
T156E09534C0602C3328C50B50117596E76090D46747F17D94396F550D6F3DF4A492E75B
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\config.json
Size 1KB
SHA256 4c1cc8fa5a8e48b06a1e616d45ba457d8333c6379f4c3d01338a973313e55efa
MD5 15f1b840ee4ac42a2e2e9e69a0ae4607
SHA1 668861c441d3af65144358d4ee9ccff0f59ac68a
SHA512 471fd4003234c5c2404ba604650afce09636ceac75b104151e1f0fcbacac8fbd458afe811014056e8e1ef4d441b5e00226e6b77a25b8aff4b55502e7fb5227ac
TLSH
T144116A20E97CACBB00A01036647B600375758E9F05297F7C719A84EC7F2EE6DA07A4E1
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\config.json
Size 1KB
SHA256 7aa2b37c3eb4d33d9c93242f6837720eecaeded0339509b95dd68bf5c71c8048
MD5 bbdbc92280e0d490afc7f21b2710fe71
SHA1 b341fdafeb3734d32ec5d872efa40baf8f35deda
SHA512 eb3446b282b928f0e1ba5abfcc5e58ecb8616c974a4a4c0bae9bfc6b2c58b1293e2f009be4b36492f879a134561c36be5fb3d3814cd6cc73e3340ca03f05d28d
TLSH
T126113A20E97CADBB00A41136647B600375758E9F05297F7C719985EC7F2EE2DA07A4E1
MD5 SHA1 SHA512 TLSH

Submit Download

custom_clients.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\custom_clients.json
Size 35B
SHA256 f9bcd1df398fc5f43cdb352e61e9307fba5fcc893f71fd609e6653bf5ef44cd5
MD5 62aacb1b128e0ea60c3f3c0e2906216e
SHA1 fc156bccf5edc095f7f9f032ef92c4f158cb54d2
SHA512 6ac5dc22a08683fd0bfca801264d70e8821d7358207727fca0853ba104ff6e96695347eb4710a8a433e3eef82964ad4fbe6dd631fbdd131f5ab9be10b99998bd
MD5 SHA1 SHA512

Submit Download

favorites.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\favorites.json
Size 21B
SHA256 ec723e97e1b28b86fcf784fdec214163ce8e0b5e9a19899f752f314405a7bd72
MD5 193f295c9945af0afbc35de338984a5e
SHA1 41f10b2780c3a0eac2b425c612c184a7d3364173
SHA512 9b58db7cbc661eb06f2af2d5fa35a5dae447f1df4c66d9603ceee9174eee219c5c174f3febb4062fc7898d8607b5922a3c8bb5d733837ea4140f0f150275596e
MD5 SHA1 SHA512

Submit Download

flags.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\flags.json
Size 204B
SHA256 4a9369bf286967193dbbff66c50c65ead3f6a0fbd85a7ba38c1de45303a83ecb
MD5 f42277fd482ec14fa60ecb159b07dfbb
SHA1 bd59b0507c8118f90b2541441e6281e055edb7b0
SHA512 d96f41ed048e108208457b14f0cfd4801f0f56f14ee754b55458ce60f6ae59c4ec9c6130ece2ef29e806b9864eba2e9b6e8c3491b239c0bd0be1db6f6e33ea79
TLSH
T129D01230F1B018F304F44435243BC203B6604C49801E2F68F889829C7E59E24817E7C0
MD5 SHA1 SHA512 TLSH

Submit Download

flags.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\flags.json
Size 205B
SHA256 483db00d673b9178c56de1f4410ba80fa45aa6e3f06620023e451a531f388e85
MD5 af7674a6843bdc43f7b123416ff88dad
SHA1 ca77f1a276a3b8b474a8e56b39cb4c0d1ec28d6c
SHA512 37487ab21608e40b0a225ef1a3c81e26a76f08a59d27e5d98d1bd3546b2e62cda161699d79cf0725423200d892df590aa197a2c0b0b1035dc97c15bc461b3954
TLSH
T1F4D01230F0B018F704E44435243BC203BA604C49801D2F68F889829C7E59E34817EBC0
MD5 SHA1 SHA512 TLSH

Submit Download

flags.json

Path C:\Users\Admin\AppData\Roaming\Ymods-Loader\flags.json
Size 204B
SHA256 2548c4e6fcc74a1157dbddf782d47f3fbe75e48cd9c909d6bffba3ad4118769d
MD5 7661a3d40045f32572f2889fcaeffd74
SHA1 7656de2b671284296f5522fa8265b9808efdae29
SHA512 b3ac484401271aaec27ced08507860b8ba697dcf3c4b141c0c975675e130c7f091eb3412b12163316aba94196ed1336a677983b001e2e92d9bf04d18eb72a553
TLSH
T150D01230F1B018F304F44435243BC203B6604C49801E2F68F889829C7E59E24817E7C0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2276-2687-0x00007FFA252C0000-0x00007FFA252C1000-memory.dmp

Download

memory/3120-2603-0x00007FFA252C0000-0x00007FFA252C1000-memory.dmp

Download

memory/3528-2686-0x00007FFA26990000-0x00007FFA26991000-memory.dmp

Download

memory/3528-2685-0x00007FFA26060000-0x00007FFA26061000-memory.dmp

Download