hxxps://www[.]mediafire[.]com/file/44sv6blrwi655r0/stiff[.]bat/file

Resubmissions

03/08/2026, 02:47

260803-c93f8a1th18

03/08/2026, 02:35

260803-c2187a1tav8

Analysis

user interaction
yes
max time kernel
146s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/44sv6blrwi655r0/stiff.bat/file
Sample260803-c93f8a1th1

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3012	powershell.exe
200	powershell.exe
1968	powershell.exe
3264	powershell.exe
5348	powershell.exe
296	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mx.bmp"	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6084	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3436	PING.EXE
3872	PING.EXE

Checks processor information in registry 2 TTPs 29 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3740	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\stiff.bat:Zone.Identifier	firefox.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3436	PING.EXE
3872	PING.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5348	powershell.exe
5348	powershell.exe
5348	powershell.exe
296	powershell.exe
296	powershell.exe
296	powershell.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe
3012	powershell.exe
3012	powershell.exe
3012	powershell.exe
1968	powershell.exe
1968	powershell.exe
1968	powershell.exe
3264	powershell.exe
3264	powershell.exe
3264	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	firefox.exe
Token: SeDebugPrivilege	1840	firefox.exe
Token: SeDebugPrivilege	5348	powershell.exe
Token: SeDebugPrivilege	296	powershell.exe
Token: SeDebugPrivilege	200	powershell.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeShutdownPrivilege	4996	shutdown.exe
Token: SeRemoteShutdownPrivilege	4996	shutdown.exe
Token: SeDebugPrivilege	3264	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1840	firefox.exe
1840	firefox.exe
1840	firefox.exe
1840	firefox.exe
1840	firefox.exe
1840	firefox.exe
1840	firefox.exe
1840	firefox.exe
1840	firefox.exe
1840	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1840	firefox.exe
1736	PickerHost.exe
4236	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 1840	5116	firefox.exe	89
PID 5116 wrote to memory of 1840	5116	firefox.exe	89
PID 1840 wrote to memory of 4248	1840	firefox.exe	90
PID 1840 wrote to memory of 4248	1840	firefox.exe	90
PID 1840 wrote to memory of 4248	1840	firefox.exe	90
PID 1840 wrote to memory of 4632	1840	firefox.exe	91
PID 1840 wrote to memory of 4632	1840	firefox.exe	91
PID 1840 wrote to memory of 4632	1840	firefox.exe	91
PID 1840 wrote to memory of 4632	1840	firefox.exe	91
PID 1840 wrote to memory of 1256	1840	firefox.exe	92
PID 1840 wrote to memory of 1256	1840	firefox.exe	92
PID 1840 wrote to memory of 1256	1840	firefox.exe	92
PID 1840 wrote to memory of 1256	1840	firefox.exe	92
PID 1840 wrote to memory of 296	1840	firefox.exe	93
PID 1840 wrote to memory of 296	1840	firefox.exe	93
PID 1840 wrote to memory of 296	1840	firefox.exe	93
PID 1840 wrote to memory of 4200	1840	firefox.exe	94
PID 1840 wrote to memory of 4200	1840	firefox.exe	94
PID 1840 wrote to memory of 4200	1840	firefox.exe	94
PID 1840 wrote to memory of 4200	1840	firefox.exe	94
PID 1840 wrote to memory of 2432	1840	firefox.exe	95
PID 1840 wrote to memory of 2432	1840	firefox.exe	95
PID 1840 wrote to memory of 2432	1840	firefox.exe	95
PID 1840 wrote to memory of 2432	1840	firefox.exe	95
PID 1840 wrote to memory of 2428	1840	firefox.exe	96
PID 1840 wrote to memory of 2428	1840	firefox.exe	96
PID 1840 wrote to memory of 2428	1840	firefox.exe	96
PID 1840 wrote to memory of 2428	1840	firefox.exe	96
PID 1840 wrote to memory of 1180	1840	firefox.exe	97
PID 1840 wrote to memory of 1180	1840	firefox.exe	97
PID 1840 wrote to memory of 1180	1840	firefox.exe	97
PID 1840 wrote to memory of 1180	1840	firefox.exe	97
PID 1840 wrote to memory of 3724	1840	firefox.exe	98
PID 1840 wrote to memory of 3724	1840	firefox.exe	98
PID 1840 wrote to memory of 3724	1840	firefox.exe	98
PID 1840 wrote to memory of 3724	1840	firefox.exe	98
PID 1840 wrote to memory of 4484	1840	firefox.exe	99
PID 1840 wrote to memory of 4484	1840	firefox.exe	99
PID 1840 wrote to memory of 4484	1840	firefox.exe	99
PID 1840 wrote to memory of 4484	1840	firefox.exe	99
PID 1840 wrote to memory of 3320	1840	firefox.exe	100
PID 1840 wrote to memory of 3320	1840	firefox.exe	100
PID 1840 wrote to memory of 3320	1840	firefox.exe	100
PID 1840 wrote to memory of 3320	1840	firefox.exe	100
PID 1840 wrote to memory of 3196	1840	firefox.exe	101
PID 1840 wrote to memory of 3196	1840	firefox.exe	101
PID 1840 wrote to memory of 3196	1840	firefox.exe	101
PID 1840 wrote to memory of 3196	1840	firefox.exe	101
PID 6084 wrote to memory of 4808	6084	cmd.exe	109
PID 6084 wrote to memory of 5348	6084	cmd.exe	111
PID 6084 wrote to memory of 296	6084	cmd.exe	112
PID 296 wrote to memory of 4512	296	powershell.exe	113
PID 4512 wrote to memory of 2780	4512	csc.exe	114
PID 6084 wrote to memory of 200	6084	cmd.exe	115
PID 6084 wrote to memory of 3012	6084	cmd.exe	117
PID 6084 wrote to memory of 6056	6084	cmd.exe	119
PID 6084 wrote to memory of 3740	6084	cmd.exe	120
PID 3012 wrote to memory of 5436	3012	powershell.exe	122
PID 5436 wrote to memory of 3604	5436	csc.exe	123
PID 6084 wrote to memory of 1968	6084	cmd.exe	124
PID 6084 wrote to memory of 3436	6084	cmd.exe	125
PID 6084 wrote to memory of 3560	6084	cmd.exe	127
PID 6084 wrote to memory of 3264	6084	cmd.exe	128
PID 6084 wrote to memory of 4996	6084	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/file/44sv6blrwi655r0/stiff.bat/file"
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/file/44sv6blrwi655r0/stiff.bat/file
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27098 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {8da50065-0832-46bb-acfc-3f6a21af26bb} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27134 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {aff29d49-c43e-47c6-8d39-71704614977e} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 25164 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {e1e58552-9c54-4015-9309-fac7a04fc210} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4016 -prefsLen 27274 -prefMapHandle 4020 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {e7e110c5-29ee-41bf-a517-b43e7bb16bb3} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1652 -prefsLen 34773 -prefMapHandle 1656 -prefMapSize 270279 -jsInitHandle 1588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3088 -initialChannelId {18e8977a-0c81-4b85-a62f-e13c31b41f6c} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5080 -prefsLen 35010 -prefMapHandle 5084 -prefMapSize 270279 -ipcHandle 5092 -initialChannelId {12d6076f-ef38-4a36-a3e0-1f58e4c63415} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6224 -prefsLen 32952 -prefMapHandle 6228 -prefMapSize 270279 -jsInitHandle 6232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6240 -initialChannelId {ee694dd6-39da-41f8-b71f-c9c86e87bf3e} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6404 -prefsLen 32952 -prefMapHandle 6408 -prefMapSize 270279 -jsInitHandle 6412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6420 -initialChannelId {7fe3b330-5e55-449d-ac85-324fdc5d0cb4} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6620 -prefsLen 32952 -prefMapHandle 6624 -prefMapSize 270279 -jsInitHandle 6628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6408 -initialChannelId {e9caae97-9fc7-438a-8e68-b8108a2b8f22} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6432 -prefsLen 32952 -prefMapHandle 6444 -prefMapSize 270279 -jsInitHandle 6524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6480 -initialChannelId {d0a8f257-e3ca-469d-b0b0-dcd98ac3a968} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6500 -prefsLen 32952 -prefMapHandle 6504 -prefMapSize 270279 -jsInitHandle 6488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6468 -initialChannelId {76c934ae-86e6-4bbe-81d7-337c1b665637} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7432 -prefsLen 32952 -prefMapHandle 7436 -prefMapSize 270279 -jsInitHandle 7440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6504 -initialChannelId {bac3273e-820d-4afb-8633-8c37f71beabe} -parentPid 1840 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1840" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5444

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:3060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\stiff.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:4808
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -command "$ws=New-Object -ComObject Wscript.Shell; $r=$ws.Popup('Made by The Sniper West`n`nDO YOU WISH TO RUN THIS?`nYOUR PC WILL BE FUCKED.`nTHE DEV IS NOT RESPONSIBLE.`n`nThe Sniper West',0,'The Sniper West',52); if($r -ne 6){exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -executionpolicy bypass -file "C:\Users\Admin\AppData\Local\Temp\mx.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\shplenot\shplenot.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES592D.tmp" "c:\Users\Admin\AppData\Local\Temp\shplenot\CSCA27750DB4AB74F068BD2D71D42D54BE.TMP"
      4⤵
      PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -command "$s=[char]0xA1+[char]0x48+[char]0x4F+[char]0x4C+[char]0x41+[char]0x2C+[char]0x20+[char]0x53+[char]0x49+[char]0x53+[char]0x54+[char]0x45+[char]0x4D+[char]0x41+[char]0x21; $ws=New-Object -ComObject Wscript.Shell; $ws.Popup($s+' gg',8,'SYSTEM',64)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -windowstyle hidden -executionpolicy bypass -file "C:\Users\Admin\AppData\Local\Temp\bi.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w1tgco3j\w1tgco3j.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB259.tmp" "c:\Users\Admin\AppData\Local\Temp\w1tgco3j\CSCEEC7C3F2A97A41979078A36082EEF614.TMP"
      4⤵
      PID:3604
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:6056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -executionpolicy bypass -file "C:\Users\Admin\AppData\Local\Temp\idiot.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\system32\PING.EXE
  ping -n 31 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3436
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /f
  2⤵
  PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -executionpolicy bypass -file "C:\Users\Admin\AppData\Local\Temp\cd.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3264
- C:\Windows\system32\shutdown.exe
  shutdown /s /t 10 /f /c "The Sniper West"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\system32\PING.EXE
  ping -n 12 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3872

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1736

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c2055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 61fa021e6fb9bf6e62c66160ca7f4e57206d1371e9779346630293e15afec314
MD5 d124d0f75d79bdc8685649a54958bc58
SHA1 21e5086ea9ff338713774f7fde5b54f23219ce6d
SHA512 22a6a6140d5f7c9e350bdb05594e18c922da2ed95deeda0a26a91e02df9be744e4ca73784eaf642f3d5b5c63b9616a34858a9586bb165f8de17a99901ed81e22
TLSH
T118115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D548B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3adcc555847b396a321ab3057154394c7fc84886322d2d5cadacd0cca01ab652
MD5 f16a7806bd655956c1fce76d231dcb4f
SHA1 3331f159ef46c3e2ab6671c7e262f76b8f6ab670
SHA512 195dc1bd4d99f21fd90542d38b741165173d3e7d62b69d042e12ae0c37c159280c8a1752607241dbb9fba742e41fce193792597f436a46897dc0b3cff172625b
TLSH
T13A217833F3CC8624DC9A403A50CEAC1137B687DB409EDF6B7B84D649B42F599DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb16fc26d6dea892fc8389bae32d21416cc8c83478c0d3c0b7a9dc389930a34b
MD5 133767997026f1c2d2309b7e6bc3eb55
SHA1 091b79a7513200e15c6bcf1c1c520aca0d53a1f5
SHA512 a59732776c50bbfe4b8aed01aee854ce172751570afdbcba080c3550d7b40613865604295f536df39a2b06b094f125b9b690760b936850d0ca4d0578bae73c66
TLSH
T108215733F3CC8624DC9A403650CEAC1136B687DB409ECE6BBB84D544B42F689DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
MD5 8e905f2b8648d1e6d98fe873e767284e
SHA1 b351c01a95e361a8200fad41aaeb7eda7cd56d00
SHA512 651c9b32840f7670a5ab155e3a89147921c73c323076c72fa39573f6ab7c4a96a64a70cd8078822c004e1842515414c2eba88a034eceff86fab746e992d6fc90
TLSH
T160215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D549B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 7f56b489d4412b94b5a9639841b1317d2dd6dfd8f5333d27b08b77f44b97677c
MD5 f560c29fa8bbe4362687374d81ab4906
SHA1 117e5583ea803b5eac115685023b101628bc2081
SHA512 597cae82c292defa70c3eeaaa2f30b21554849e68bae2b80530d26bd142102d35b7ace7415b16060cbfb6895990f23dbfb6d18564ca150c15c9ad72470993563
SSDEEP 3072:j3liLQ/r6rhKEi2AHR1+iKW6/jlFwGzkzW:pysr6rDi3XKP7l3
TLSH
T152B3AFF6DFA28D3D64FF942D9BC2883EFD262410B3A7301DC863636561C6B782675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES592D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES592D.tmp
Size 1KB
SHA256 07561f3700a8843d1ea59364140ac8bd2d50757e41091d0b7f1c8323228156fe
MD5 d71924012a978d235317780bf94d981a
SHA1 52cd3b80af2785485b96a201aee45d396dd0fb75
SHA512 c518494319eddf25a1fc1e6fb37a50e0ed54eadf7fa0c092d3990abf578d83d25dc71e3efd2bd84dea526a4b12382d03026b487c6cd171c9bca7c60dd5029dd4
TLSH
T1CB21890A93ED471BF0738731A9F6532F9238FDA0DE62939A858502692C51904EEE0A73
MD5 SHA1 SHA512 TLSH

Submit Download

RESB259.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB259.tmp
Size 1KB
SHA256 24c0d189b54cf463f4732a197052032d18b52825cb0fc155b04cbee2a9c71af4
MD5 fc9898921be4362758b412057bf03234
SHA1 7e43db866c779619063fbb539529961f6d8a1da4
SHA512 d1be39d6ac985c27d8942e6f3f33b5e836aa9a20a8d08a49c72022a7cecf550f13b34868e1de8fdd6f910835f892fabfb6a44b11454921d6eab4d08563a544b2
TLSH
T1E821C90693E9471FF0B78732A9FA532FD675FD60EF61939A8580422C2C51514EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hzk5vbb1.5sd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hzk5vbb1.5sd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bi.ps1

Path C:\Users\Admin\AppData\Local\Temp\bi.ps1
Size 204B
SHA256 1fe1e7a48404fed56b046a3c5c3f8878b2cfb7286dedf8956f58eef6019ceaad
MD5 850dbb99369d5b39a1ca9a8c3149ada1
SHA1 f9e87ac2c2b6b3a582ee811cf6e782ac29a76883
SHA512 ca6bec1380d79657c55be3afe5a53b00867f2e6154bcb825704c7d2e5f0aa73a1a627b2b1784a105497c9e067811f9e0a36a77384bc2d8cb218c96618f0ad710
TLSH
T13AD01230EF3169A54477C8125CD5ACF3FD1A40F6296F0910C273CF519E1E0D91316A05
MD5 SHA1 SHA512 TLSH

Submit Download

cd.ps1

Path C:\Users\Admin\AppData\Local\Temp\cd.ps1
Size 790B
SHA256 ebaafc952e93d2d5efa87da286bd1cd5d21212b450d03467d5d0d71e69d67bc7
MD5 b5ae7cb2fe82c0fdfe4d5bdfd54807c6
SHA1 251bc330308eaff06bd849f9df2c03593588f017
SHA512 1a915921cd22afb14f4fc9359617f6d5d20e5eb3aca859f4ed11916c8e18467bb48814cef72ddbb722abf57998feaba275f2ab69cd05a04453e2eb11a5c6b8b1
TLSH
T1F801BDB147E9E96281A008479A9BABC08D1E537E1059ECD079FFDD07F56D0468334785
MD5 SHA1 SHA512 TLSH

Submit Download

idiot.ps1

Path C:\Users\Admin\AppData\Local\Temp\idiot.ps1
Size 903B
SHA256 5af00721d1c810299b950d34870655f59f7ae087a7e42e88950f170c67cb7df0
MD5 b5e6c12629155422d8d3242255ac2cfc
SHA1 b1c8e8a7db499d831bf1b2a7abcd917afd851a55
SHA512 517d7d216d2fbde2102e831df08345700c9a32fc9c37a76ed2e08cc9323774aa503756612e2b1020d19deb05f4b82c74cb3d8cc8a7a852f26fef8c32eec44edc
TLSH
T13911C0B99379E55180A114471D9BABC58D3E127F2499FCA06DDFCC02F529416D335348
MD5 SHA1 SHA512 TLSH

Submit Download

mx.ps1

Path C:\Users\Admin\AppData\Local\Temp\mx.ps1
Size 698B
SHA256 2e57f6b955fc282d865c1241fd653e14d76b597ea76f18112d9589d34968ecad
MD5 41daa561dac5cf63db2961875634b248
SHA1 06a068c85f1122b034226b90a83df6bb07d2c1ff
SHA512 e93758b53c88b0742972b5c6c673563aca410dbdcc74e7055b43eb53b493dec68fa6da9f80fa102054b16f6349269ccd2b815195985aa96725f8ac85858b3404
TLSH
T15E01473C1B4EE4A99A0A8095A9DEC481DF3663143175ED4E12EE9352CF0B925837D239
MD5 SHA1 SHA512 TLSH

Submit Download

shplenot.dll

Path C:\Users\Admin\AppData\Local\Temp\shplenot\shplenot.dll
Size 3KB
SHA256 6acd311621701853843d851d95b64463266b9e99ab2f72f6a43a108491fb3f3a
MD5 c2565a4b618c1c4f25c289aad7c0003f
SHA1 66a751fe1d9cd7055794a5cf6e77f53041910182
SHA512 2bee2e6e5c7a1cd134b7c76b63780594e8b77067db55b38b108b113c567206d4706ac2cc4818af25ab304957b6192713e8eb8c77644ba6f6ff3c549105b83ce1
TLSH
T1C151FE1B67E80667E4B707356EF383562BB8FC50AFB3A36D198042296C217241E71FB0
MD5 SHA1 SHA512 TLSH

Submit Download

w1tgco3j.dll

Path C:\Users\Admin\AppData\Local\Temp\w1tgco3j\w1tgco3j.dll
Size 3KB
SHA256 8edf05c3d49eafd80ed97ecff276d3d056beb7b32bac95bdc1eacc74c9dc0b98
MD5 390845819ed113f7e2083da1da67c34d
SHA1 14bc27e5af74ff02590521e9a63076f1176bd707
SHA512 1c7ebf8fa92aedd99b3b417828368979d15c529383446e02a795908f5fc99a979d540bb784361a2ee2a4a3c54ab8325c571de0298fd785d4c5ed416152bda334
TLSH
T16A51CE1AA3F8056BE4B34731AEF30356B7B4F8209B73976D59804269AC207644D72FB1
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
Size 8KB
SHA256 9746d3edd0c890e2d3ffde95517fcb4fedaa5fd6dcd99cda892a0c4eab0baf56
MD5 f335632b7346110289064df0bc879bb7
SHA1 60b23612d7fbfe7c70aae59965beb5e2403e8579
SHA512 4414250fc87cf7a5742bb49f587b96ef4bf4993085e2a1c58eb166ad9e9a6521324842a5b3934a9e75acb8bbfda93304859426a2aa8eaf06918adf82fb594278
SSDEEP 24:XuhMZ7kn3ejgewlp3ep3eTDewxgewhQkAewCgewlLDewBgewB4D9ewMlqgewFYXB:6NVSs/9VigMlHyXmUmJ/Y1bV
TLSH
T1C602EFE78BF1A456F07B4F70C076708C8C2716967669C8406F54E0D76292B91D1BEF5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
Size 13KB
SHA256 ed66a778bb8e96e4f2c550fcb607ba8df4a9a33d56db2edfeaf113702ad9317a
MD5 570f35be370a3799781a52026d9c852e
SHA1 09f8360f86b9d2cbe19a9af3e9043248968cc275
SHA512 e4ea9747bb6fe64a32adb09de1dde73f3e715fd2321a6c7118f17a957dc67584fe7fd483c23d6ccafde2d9299826531b02e95a624c633ad7de3b60f01652bb80
SSDEEP 96:YNSs/9VigMlHyX9mJ/YJVEGZG6fHILoVyGuCxn:0W3Qh
TLSH
T1D2520AE78BF5A456F0774F70C46A70CC9C2305A62979C880AF58E0D76392B9190BEF4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
Size 18KB
SHA256 0746a2515e3ca190a757a59345e4a01e072f685c970705c102e6152e0b42e9ec
MD5 d96ffcdaafbfd4f536e7accf57bd75b0
SHA1 0ebbe5ccb60b3bdbb8ad32019b3b2dd90602aa03
SHA512 e183e0f49168fbba4dd1aff914fade0cb3234ae41bb49cc908e2143278ddbc6758ed14cfb4a23c4e2083bdef810925bf6fb8662db8ae170874c975b5e4c3f718
SSDEEP 96:YNSs1FigMlHyX9mJ/YJVEGZG6fHILoVyGuCxnMS5HG/ELXQ0:P3Qh
TLSH
T130822AE78BF5945AF0774F70C4A9B08C9C2305692968C8C4AF18E0D79392BA1D0BEF4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
Size 25KB
SHA256 55e16fcfc176cfa49d3177e030f874776b1f0dfc5246e786af410888381ced0c
MD5 844145843e2978f867935be1ad4e4ed2
SHA1 4d4c6ee6855e9f0d2c2f50fb76529611a6c29b26
SHA512 03a93cc4b336bb2cb8f20935fc81c2c7e31eb9818aab1ba49160fe6aeb6d9e147d1ddc1a57cd97614fd29103cf8e65daef04fd3454992dbf9d96a39dd74a45f4
SSDEEP 96:v3G3uMSs1FigMlHyX9mJ/YJVEGZG6fHILoVyGuCxnMS5HG/ELXQ0zO0YdMm1MmXM:r3QhTxYZMV
TLSH
T136B2E8E78BF5A456F0774F7084A9748C8C33156A2929C984AF18E0DB92927A090BFF5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\AlternateServices.bin
Size 28KB
SHA256 ac9b117819071507d10271c91519e544155b51c0074e872805ee8402c6498c3c
MD5 bf5801f64b7fafb87777d020d0337d2d
SHA1 1ff196b027f56332b3633fe41a311bb2113e54cd
SHA512 4815361ece5f88be3fc62b5b699edc34a028dd1dca28c21e98b331f9b5b78ed13dac71f584bdda2340457495f84fed84eb50902ed0d0d78c4548a51c6e4b9f28
SSDEEP 96:T3G3jV8c1FCcmHyXTmJ/YJVEGZW6gHILTvGuC+MS2HG/TLXQ0DO0YmLaOSUJRJOe:AQaxY+MVKpjPxDzvn
TLSH
T174D2F9E78BF5A456F0778F7080A9B08CDC371A652968C9849E14E0D792967A1D07FF4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 ee07efe2d6b74b79903df62a2bae531858e29c2ff883088c3cd06714a914fd86
MD5 4ea3f4d91539bdc3f5da08b1c8baa662
SHA1 a15676594a5c352bb3b8b3b1665e46313c0b3f13
SHA512 33a15e9b9bac638b0a78aef17ed034c3f754434d0d3e159b00c86a0970186a1f9f58a62d41a0bf90721a6ac5deacff3906f4dd1028230fbcebed1da264fba36d
SSDEEP 768:Erc1MimtiM7H+Gcm+uF4iReTCf0fbkblbGbR:yimtiqHR4ia
TLSH
T113C22184FB2A953FD41512BBDCA51B041F78B8C998192F573A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 d0dfc9aafafae026f30f5a83bf59e7d43457e939c7649ec13fa8354157ad49b2
MD5 6bc8b80435127b6d14f26c2e36d59686
SHA1 d28fbc93472ae268ce2af1332f9e65648972fd5b
SHA512 a12b1f9b52d43cabf8cb8f1e9e536c675b50790e084c371d4ccf7a293f05b16eb6ab954dedf91248fef71c4401d5a14d82744f8cfdf83a029c24055d777cea3e
SSDEEP 768:bimtiM7H+Gcm+uF4iReTCf0fbkblbGbRUSc1/:bimtiqHR4iaQ
TLSH
T179C22184FB2A953FD42512BBDCA50B041F78B8C998192F573A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 4fe2fefa976cf7a83449719da6e273de2049ec8c0492a0a46d4d89913ae5e699
MD5 db239f3f9a23a33275c7c3422b80fe3c
SHA1 c1f1e537d422662cc08c011844a272f3033c8b36
SHA512 9fbf43e0d1213aa9a152684fa2b1c057a1b754473df0ede2f40ffc1854e6e880809261d0eca45494395134646aa033bd513eeb885b7936c911933aac81274761
SSDEEP 768:7SfimtiM7H+Gcm+uF4iReTCf0fbkblbGbRF1/:kimtiqHR4iaf
TLSH
T110C22184FB2A953FD41512BBDCA51B041F78B88998192F573A4C64686CC72DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e3a1312596bb6944cb28961ae119e30d47f3de932fd0ae9498d90a891e40a7fd
MD5 3c02c21b1391c92099450d0b4ecceff5
SHA1 6564518bb3bd8f387b6453e4023aa8279fdaf5e2
SHA512 8d290eb9262d7f2a8f8349da7f342ab254d61643a63d080ddc016c5bb38eac36839af03a7a1c234b8c58846750b0f58b4a2b38f617749a687be02281811cd407
TLSH
T11B213D9C39B88D6A9CCAF35C7490018F97594E07558B1C434D12FFCDCE91AD9326A83D
MD5 SHA1 SHA512 TLSH

Submit Download

069e98da-4ef6-4b26-982c-42360c053190

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\069e98da-4ef6-4b26-982c-42360c053190
Size 15KB
SHA256 d47f90249f38dd82358b229a650b43a64eee0c0e92a12958dbcd5c2cc40ccb83
MD5 6f4e2f1cbf9db8f8f19655334a306e86
SHA1 f22821d152a40a6dd1aafd63a49384ea15b160f5
SHA512 35dc7db6898d6f7d76c7917af64a2d5a663b84dfe9bba22319c91232702cece4a075a6bcaf7f71ef4c5525de5c91c785e84991c4e91ea0080d5c9f8e16256e28
SSDEEP 192:IvzcuLrEI6NoaL604nJ9Bn4tSFOMNbpcWj9Xk:etLwI6KaW04nJ74tSFOMNbpcWp0
TLSH
T10372EDFDCD1200473D65E51EF2AAADAB2057293149CCC78E6AFC083A27D6DBB4563364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1cb6ba6d-8164-4b33-8dc6-8aa830f4e00f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\1cb6ba6d-8164-4b33-8dc6-8aa830f4e00f
Size 2KB
SHA256 56d392944cefdea39152f3eb7397ed9b75f0966733a960af27ce6a1cae62b59f
MD5 11f05c56c3c5381bbb19ca191afa5506
SHA1 90da1dc989ef9e8059c3dc283025f01e6b4a5a79
SHA512 1b686b0dbe44bfa4cd993e3b12e6ab340fe38332cc51c89ad966b454940fd9d16fc189f4013fbe1dfb3d4fa15ad53c357fd9ba4306db946ac5f4e5620316108a
TLSH
T13C41405C36788D764CDAE14D9182328EA7A09A03008628536E95EE8CCEE269E237651B
MD5 SHA1 SHA512 TLSH

Submit Download

20e61cbe-2388-4cf9-ad35-e6d35520894d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\20e61cbe-2388-4cf9-ad35-e6d35520894d
Size 871B
SHA256 e69b96a7bd1661306e7b342b24f5a4bd908d71e045383faeaeef021a1925e6a3
MD5 92bcd62a844c7270df16b93ce7541ec8
SHA1 d801f442c5a71cc364e986174179de74350d8a3a
SHA512 43972b5c5723406bab872617c3894390f92e66dd10c14485c26afb416117425637c79f4125625b70daa06aa6ea506f0990b30fef6efd8361238393279241829c
TLSH
T1871100819730BAB2CC78924B84D437168BE87423C0CB54087DA05E084FBF61FA7A5747
MD5 SHA1 SHA512 TLSH

Submit Download

5f6968c2-c230-42b2-b344-febc62a169cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\5f6968c2-c230-42b2-b344-febc62a169cf
Size 235B
SHA256 f46652a0bc119fc09977e69e8e69feaf9797e591c3226dc6e976b004ebcaf793
MD5 e5324edf21c40cd8558828d084055540
SHA1 46a8787e93bb777d4a58f36c89b07e0699f4684a
SHA512 cd84fe825f78578b72c8d80e71b8626dca8f018ea50ce7adbe55a7cce2b987ae709f39a41992836974a7667edf5d01b28bd7f6597aa253718b54f88a0fe2785f
TLSH
T1A1D097902498BBAD08240F06F0B0AAC630444C3320699824E59086F899FC9C841B2876
MD5 SHA1 SHA512 TLSH

Submit Download

781281f1-15f8-471d-8e5d-219373f3729f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\781281f1-15f8-471d-8e5d-219373f3729f
Size 235B
SHA256 0421777b03032a6bd27c4d24d0d08b6e3249d76010b930135470768929657929
MD5 00a19fb97a9c456b9c9cd35c1bb12f6b
SHA1 6e6aabad0d2b967dda62e63f17c38433ded62cc4
SHA512 a65a86a0160a4956004acfe79b951c7db542a18be69ab1703d4d24599b871f38b4fa376b877cb06f9c424b0434b975162c3aab9a1c4f1617ce8df10072244914
TLSH
T1FAD097A024C8275E08084F02B0A228C630D84C3314B8982089A10C3889FA9D8423281B
MD5 SHA1 SHA512 TLSH

Submit Download

878efe9f-8e86-4255-b091-22f7d900c6f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\878efe9f-8e86-4255-b091-22f7d900c6f9
Size 886B
SHA256 10ab41eb18a87ed72e50d870a963be7b168d1d06ad65df81fc00e50e4b1d9293
MD5 8d98ce81db80c131cf13cc3e0f5a433c
SHA1 826c532d53f67d37572e7486c8b3dce82db024c3
SHA512 a62254960e632600e7d10e5192e20d4d37ac53ab66e12a14d773ce9652c5950c2b0da7a9e02c858b48685fdded2d629ad0eefa58ebed696f968e56b748beeb58
TLSH
T11711004193317AB68C78C24B94E477128FE43433C0CB59147EA05E0C8EFB62EA766707
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 6KB
SHA256 f1ef79a02e5bbab9972eb92f5df14e86e2ebbfc2c715aafff283dce89ab0893e
MD5 86ad6fba35f6d4b8a99884bc5c6f8fa6
SHA1 acb5494628852ed37111bc2fdeb530fb2dadc555
SHA512 ac912b5ad110d70d624ab17a5d57f89634f6a6fcd84e0cdb882b7d120b4ba7a04cd40550c05a688868792d944838cb18749e79283835acf59a38215c8fd718b0
SSDEEP 96:xHtUTUPqGqTfFE8M1zSaRSSlQdv9jF6nnH1Bw88u8L4cnyFa:byRTfFE8MrRSSGi1Bw88B
TLSH
T1CEE1FE789008CB6F74B6766CAC688C316AB2013BBBBF68D650B554C5055CF3842F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 6KB
SHA256 3918902fac02b998bd5a2ffcf3e9dbbd03f7ce5e585e00c072e758339cf0450d
MD5 f5e7162a61f763b8dfe956ffd05a90c1
SHA1 edbf8cdefb6e807bdaf1c486b23fc22a023c1b20
SHA512 321b4c0c7c57363915389a298a4f4ac1d47e79555e954008ea252351e68e521785a7ef2dc0521ba48174c834d82e44521c37451d056b0497fc62ba1aeb07b270
SSDEEP 96:xHtUTUPqGqTfFEXZR1zSaKSSlQdv9jLfnnH1Bw88u8L4cnyFa:byRTfFEXZRrKSSu1Bw88B
TLSH
T16BE1FF789008CB7F74B6766CAC6888316AB2013BBBBF68D650B554C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_5.txt

Path C:\Users\Admin\Desktop\file_5.txt
Size 53B
SHA256 f95611264d12a7d6ae36c67df4d3e37822c3367b8d3458a29f997ed30ffe65da
MD5 68156a7b7bec2ae257be39f603bc84d1
SHA1 413e6beb68a8b98acca3cb29b2184e461bae52a3
SHA512 326ea67ff4e2e7d1133bb192035cf10191dcfde2fbd08dac071a5e84bc25af17a2a7ede5fcd93bff90110e297cf2ec083df0929406a17643e9e1f0805446a94d
TLSH
T15590024E564881C5D011180581416618131E7DC524519944573E89D449441813205AE4
MD5 SHA1 SHA512 TLSH

Submit Download

HoCreHSY.txt.part

Path C:\Users\Admin\Downloads\HoCreHSY.txt.part
Size 6KB
SHA256 fcfcfaa536482a86daac137fb4049eec479ed617c30a00a2c9462804f6950cd7
MD5 9cf2ce3521d31df4e02995d505a90299
SHA1 a5d35462d3f2eff2234c61ad713e9f057e88b756
SHA512 5727549052e5668c60e9946c0f81006bad78fc2dacfdef3011d9265ca4fafd028c2e7dda690760d26c51bc04fd26a8a8cc5cc591a2c47a3ae9b6b876c2072011
SSDEEP 192:AlIB1FvgHAcOmOFiHNqfCaZ97lU4lJb6P97NdOaU:AlivgHAcOmOFiHNqKuRlU8JbiRNdnU
TLSH
T1FDD1FDACB305C944EB1E00B1C8FE7D94BA36592B2959DD34D48FB9207E89A9483BC2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA27750DB4AB74F068BD2D71D42D54BE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\shplenot\CSCA27750DB4AB74F068BD2D71D42D54BE.TMP
Size 652B
SHA256 af427f27be59b832b6ef7696c9fecee9cda4dcc98765926fc0e3b6dae114309b
MD5 530a5f3ce97580ca6ed43b288b12048f
SHA1 e6044cae6ee3831b1105d3ceaa37044346b4200f
SHA512 6b9c94e95ba8a21657b545fd29c2aacf8ecf1039dfe5ec8788e0fafc75f88d8dc9ccba042ca6aed32db4a296bc3fc2d5322899e5c6d311c67a04b462852bdbc5
TLSH
T10CF03A0963F8120AF0F34B30BDF6836391ACBC65DE3293ED5545031D28645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

shplenot.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\shplenot\shplenot.0.cs
Size 210B
SHA256 868ee47ffd9b6f9fce2c575360acfbbbd59b82166a1fb09f86a50f6fb8a3e037
MD5 6a596baa4572a07c0037674e48bb2298
SHA1 ffa3df4b0d308b7fe08a8a06e01ee063c9d16fd8
SHA512 78631fe02faa568521a0c11f6ba3a95533dbd41f64bfda348b76a3db8045b0bc9d21e4fe9085f3f41905413167ea36e11c1593e40edd504808303d67a95a6779
TLSH
T1BBD0A92826A3AE6920020826094490A96A37A01632AEAE03B9FC0221CF875081231B2A
MD5 SHA1 SHA512 TLSH

Submit Download

shplenot.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\shplenot\shplenot.cmdline
Size 369B
SHA256 2a98abcdbcb4ae3ec720063a85ddb2bbef1f89da4d77937c250774c7f49b9b7f
MD5 97163560dbbe60278c9fd1d4c9e99372
SHA1 74345ac1de9b439a58ed91c591f063704de0e0e9
SHA512 09e43cf1bf07571b4dfcd478604fc7662406d6ecaa4af6df064f57c1f62c1a5a5f3147f001b942215a0b28b8755328e12ac8ec232ba6df40c7d95a93a835f6d9
TLSH
T141E0C62F4246C2BE89EE100F226AD5ACCA720B833D823F8C9440849DE8370003BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEEC7C3F2A97A41979078A36082EEF614.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w1tgco3j\CSCEEC7C3F2A97A41979078A36082EEF614.TMP
Size 652B
SHA256 14aa693db6c8527e6e02f92ebf9c3a8a11f5b000ecb7436ce4c1b50aa5002300
MD5 549e0eb20e13c91ae87be9720a75e62a
SHA1 ba44309b40460554dea99cbbeae566d906f89752
SHA512 f0467169bd2bab0852d113ad1de565de2da57939d4a0f0795b1781be856a596b92ccdf7db241216a6a644773b98f0f1f43625f085d3f6fafc3e620b2c7955114
TLSH
T1E4F05E0AA3F8020EF4F74B31BDF64367D5A9BC65DE3293ED1480435D28649108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

w1tgco3j.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\w1tgco3j\w1tgco3j.0.cs
Size 182B
SHA256 70323755dc978fbfe5c2434f916d25b60d7f80f678ddcec42eb403df1e23b2ee
MD5 67aebaa3a9114aefd02015bdd0fbbc32
SHA1 1679e6d0a25b7a1bf49e065e8d1b5f65118adf19
SHA512 30baff4954a8eac0aa123991e5362cecba4af653704680685b0e4fac68ddaf3eab8de9cc2a114043b208108d88041856a4d726d22631f324cd0fb715d66a9919
TLSH
T15DC0122866F3AE24401348171D49E0F97B27525B269F1A21F9F94600CF8F0444221F1E
MD5 SHA1 SHA512 TLSH

Submit Download

w1tgco3j.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w1tgco3j\w1tgco3j.cmdline
Size 369B
SHA256 61abd56a9d458fc0124426f9c7154dd89e0cbe467409a8a6b63a20a0903e585b
MD5 cf229608821eced8bb984640d13c2b3d
SHA1 06a5e420ffd1ce39b6ef07017804b82183cb93ae
SHA512 49138e8d8fa6dc16fe1cccb75d5d68a703a4d883fd805c93fe4be0a8eadf54c932fa9c9ba44f196d21e44dfb6596c725b4e0ec7518083c5c680aaa95833bb53c
TLSH
T1ACE0683B5347C67D13E91007226DD6ECC272064329403F98D168445DF0170482BF2742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/296-1658-0x000001F91F220000-0x000001F91F228000-memory.dmp

Download

memory/3012-1691-0x0000024340E80000-0x0000024340E88000-memory.dmp

Download

memory/5348-630-0x000002975E630000-0x000002975E652000-memory.dmp

Download