dfd65e819677564a176fa78585b3fae37b16ad49bd11bbe29d88c663b821f83c

Resubmissions

08/08/2026, 01:51

260808-b9y85azzfz

08/08/2026, 01:48

260808-b798lsbb438

Analysis

user interaction
yes
max time kernel
113s
max time network
116s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OhSoft OCam 520.0 Multilingual [FileCR].zip
Size 8.9MB
Sample260808-b798lsbb43
SHA256 dfd65e819677564a176fa78585b3fae37b16ad49bd11bbe29d88c663b821f83c
MD5 8d06c8ba0907ba8c2ad8722691295aff
SHA1 3888a9c45c53b00329d2913cd9a7e1112845542a
SHA512 2a26ed8fd7f8a3c377bbce74ce1fc447eec64b1e11628319da5a6d81eb2091982f702285331c5de49a9b77b7700951868d3e165b6ff303a8cc19ba91a17be3cc
SSDEEP 196608:bwOAKE9Gxoa0p7EBoDP2Uq9bRFKXtvI9Y8YtrlkP474:bwlKE9OQhEBiP25RFmqY8ilkPA4
TLSH
T1439633D6DB286B1058BE8F69590747F77D2DE8BFACD6C0BBD4EC891E884443086119BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
94	1688	firefox.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
2524	7z2602-x64.exe
2548	7zG.exe
5220	7zG.exe
5512	oCam_v520.0.exe
1232	oCam_v520.0.tmp
5928	Patch.exe

Loads dropped DLL 3 IoCs

pid	Process
2548	7zG.exe
5220	7zG.exe
5928	Patch.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2602-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2602-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2602-x64.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2602-x64.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oCam_v520.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oCam_v520.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Patch.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0007000000028757-1068.dat	innosetup
behavioral1/memory/5512-1070-0x0000000000400000-0x0000000000445000-memory.dmp	innosetup
behavioral1/memory/5512-1077-0x0000000000400000-0x0000000000445000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2602-x64.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	firefox.exe
Token: SeDebugPrivilege	3340	firefox.exe
Token: SeDebugPrivilege	1688	firefox.exe
Token: SeDebugPrivilege	1688	firefox.exe
Token: SeDebugPrivilege	2524	7z2602-x64.exe
Token: SeDebugPrivilege	2524	7z2602-x64.exe
Token: SeDebugPrivilege	2524	7z2602-x64.exe
Token: SeDebugPrivilege	2524	7z2602-x64.exe
Token: SeDebugPrivilege	2524	7z2602-x64.exe
Token: SeRestorePrivilege	2548	7zG.exe
Token: 35	2548	7zG.exe
Token: SeSecurityPrivilege	2548	7zG.exe
Token: SeSecurityPrivilege	2548	7zG.exe
Token: SeRestorePrivilege	5220	7zG.exe
Token: 35	5220	7zG.exe
Token: SeSecurityPrivilege	5220	7zG.exe
Token: SeSecurityPrivilege	5220	7zG.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
3340	firefox.exe
3340	firefox.exe
3340	firefox.exe
3340	firefox.exe
3340	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
2548	7zG.exe
5220	7zG.exe
5928	Patch.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3340	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
2524	7z2602-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3340	4544	firefox.exe	102
PID 4544 wrote to memory of 3340	4544	firefox.exe	102
PID 3340 wrote to memory of 5596	3340	firefox.exe	103
PID 3340 wrote to memory of 5596	3340	firefox.exe	103
PID 3340 wrote to memory of 5596	3340	firefox.exe	103
PID 3340 wrote to memory of 5412	3340	firefox.exe	104
PID 3340 wrote to memory of 5412	3340	firefox.exe	104
PID 3340 wrote to memory of 5412	3340	firefox.exe	104
PID 3340 wrote to memory of 5412	3340	firefox.exe	104
PID 3340 wrote to memory of 64	3340	firefox.exe	105
PID 3340 wrote to memory of 64	3340	firefox.exe	105
PID 3340 wrote to memory of 64	3340	firefox.exe	105
PID 3340 wrote to memory of 64	3340	firefox.exe	105
PID 3340 wrote to memory of 448	3340	firefox.exe	106
PID 3340 wrote to memory of 448	3340	firefox.exe	106
PID 3340 wrote to memory of 448	3340	firefox.exe	106
PID 3340 wrote to memory of 1168	3340	firefox.exe	107
PID 3340 wrote to memory of 1168	3340	firefox.exe	107
PID 3340 wrote to memory of 1168	3340	firefox.exe	107
PID 3340 wrote to memory of 1168	3340	firefox.exe	107
PID 3340 wrote to memory of 1836	3340	firefox.exe	108
PID 3340 wrote to memory of 1836	3340	firefox.exe	108
PID 3340 wrote to memory of 1836	3340	firefox.exe	108
PID 3340 wrote to memory of 1836	3340	firefox.exe	108
PID 3340 wrote to memory of 2160	3340	firefox.exe	109
PID 3340 wrote to memory of 2160	3340	firefox.exe	109
PID 3340 wrote to memory of 2160	3340	firefox.exe	109
PID 3340 wrote to memory of 2160	3340	firefox.exe	109
PID 3340 wrote to memory of 2164	3340	firefox.exe	110
PID 3340 wrote to memory of 2164	3340	firefox.exe	110
PID 3340 wrote to memory of 2164	3340	firefox.exe	110
PID 3340 wrote to memory of 2164	3340	firefox.exe	110
PID 3340 wrote to memory of 5420	3340	firefox.exe	111
PID 3340 wrote to memory of 5420	3340	firefox.exe	111
PID 3340 wrote to memory of 5420	3340	firefox.exe	111
PID 3340 wrote to memory of 5420	3340	firefox.exe	111
PID 3340 wrote to memory of 5416	3340	firefox.exe	112
PID 3340 wrote to memory of 5416	3340	firefox.exe	112
PID 3340 wrote to memory of 5416	3340	firefox.exe	112
PID 3340 wrote to memory of 5416	3340	firefox.exe	112
PID 3340 wrote to memory of 1624	3340	firefox.exe	113
PID 3340 wrote to memory of 1624	3340	firefox.exe	113
PID 3340 wrote to memory of 1624	3340	firefox.exe	113
PID 3340 wrote to memory of 1624	3340	firefox.exe	113
PID 3340 wrote to memory of 1780	3340	firefox.exe	114
PID 3340 wrote to memory of 1780	3340	firefox.exe	114
PID 3340 wrote to memory of 1780	3340	firefox.exe	114
PID 3340 wrote to memory of 1780	3340	firefox.exe	114
PID 3340 wrote to memory of 1596	3340	firefox.exe	115
PID 3340 wrote to memory of 1596	3340	firefox.exe	115
PID 3340 wrote to memory of 1596	3340	firefox.exe	115
PID 3340 wrote to memory of 1596	3340	firefox.exe	115
PID 3340 wrote to memory of 3988	3340	firefox.exe	116
PID 3340 wrote to memory of 3988	3340	firefox.exe	116
PID 3340 wrote to memory of 3988	3340	firefox.exe	116
PID 3340 wrote to memory of 3988	3340	firefox.exe	116
PID 3340 wrote to memory of 2316	3340	firefox.exe	117
PID 3340 wrote to memory of 2316	3340	firefox.exe	117
PID 3340 wrote to memory of 2316	3340	firefox.exe	117
PID 3340 wrote to memory of 2316	3340	firefox.exe	117
PID 3340 wrote to memory of 3400	3340	firefox.exe	118
PID 3340 wrote to memory of 3400	3340	firefox.exe	118
PID 3340 wrote to memory of 3400	3340	firefox.exe	118
PID 3340 wrote to memory of 3400	3340	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\OhSoft OCam 520.0 Multilingual [FileCR].zip"
1⤵
PID:5408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27100 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {18bf4ae7-baab-46a1-8c8d-d28453c8cffc} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27136 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {adc926bc-b26c-41fa-b29f-0e357aa0f4fe} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1644 -prefsLen 27277 -prefMapHandle 1648 -prefMapSize 270279 -jsInitHandle 2936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3956 -initialChannelId {7e63f569-64fb-4b10-9df3-7ec0627f8a0d} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1616 -prefsLen 27277 -prefMapHandle 2792 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {dbdb696d-472e-4a9a-bef6-ea8cb4e3205c} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4524 -prefsLen 34776 -prefMapHandle 4528 -prefMapSize 270279 -jsInitHandle 4532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {093fae15-d10d-4896-88af-168779bc75f9} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4832 -prefsLen 34932 -prefMapHandle 4824 -prefMapSize 270279 -ipcHandle 4904 -initialChannelId {52e40da1-e50a-40f0-8de8-529e80da731c} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4808 -prefsLen 32952 -prefMapHandle 4924 -prefMapSize 270279 -jsInitHandle 3012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2936 -initialChannelId {c334a3a5-2172-446d-b1aa-ed2624ca5bbc} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32952 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5068 -initialChannelId {9d1b65b2-8cc6-41d6-8c82-613e02af5f27} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 32952 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {e44da3b6-fe7d-4915-8fc8-92cbe5127a9f} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {e798245c-4f7d-40c3-beb9-6d4ebc75ea42} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 32952 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {9336267c-3a5f-41c4-a3ba-587745321f05} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5832 -prefsLen 32952 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 5840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {7a911e3d-4bd2-45f3-8133-90fd1092f3af} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:1780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2696 -prefsLen 32952 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6196 -initialChannelId {83adecd3-bfd1-4e28-9e04-2afdc37020c6} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5416 -prefsLen 32952 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6204 -initialChannelId {3a5dd7dc-1d1c-4d74-ba1c-5c004ff82bb0} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5996 -prefsLen 32952 -prefMapHandle 6000 -prefMapSize 270279 -jsInitHandle 6004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6212 -initialChannelId {f5936292-a248-4b0a-a334-4df40bf31ded} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6660 -prefsLen 32952 -prefMapHandle 6664 -prefMapSize 270279 -jsInitHandle 6668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6000 -initialChannelId {d8e02b2a-b2c1-4111-9086-41db3df36e57} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6684 -prefsLen 32952 -prefMapHandle 6688 -prefMapSize 270279 -jsInitHandle 6692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {2414d670-9722-435d-9d8b-18ee06a1267b} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:1108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6708 -prefsLen 32952 -prefMapHandle 6712 -prefMapSize 270279 -jsInitHandle 6716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {0ef958d3-6fa9-4fbf-b533-e8de32251a4d} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7136 -prefsLen 32952 -prefMapHandle 7140 -prefMapSize 270279 -jsInitHandle 7144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7160 -initialChannelId {2d290b63-4dba-4679-a42e-218a005b012f} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7308 -prefsLen 32952 -prefMapHandle 7312 -prefMapSize 270279 -jsInitHandle 7316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7324 -initialChannelId {ee6a80b0-f98c-4464-b653-9d12f74621be} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7340 -prefsLen 32952 -prefMapHandle 7344 -prefMapSize 270279 -jsInitHandle 7348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7356 -initialChannelId {8bcb134a-e0a5-4027-ba74-e43df3616858} -parentPid 3340 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3340" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:1932

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2752
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27100 -prefMapHandle 1948 -prefMapSize 270315 -ipcHandle 2020 -initialChannelId {b03e3bb4-ec80-48a6-ab87-a994fdaa2274} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2120 -prefsLen 27100 -prefMapHandle 2228 -prefMapSize 270315 -ipcHandle 2288 -initialChannelId {35548832-cd4e-4efd-b08a-5e5b6d7344db} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27700 -prefMapHandle 3764 -prefMapSize 270315 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {0a45fcc0-b9fc-4cfb-a7d8-e01dc1e7beb0} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27700 -prefMapHandle 3940 -prefMapSize 270315 -ipcHandle 3948 -initialChannelId {51274887-6ff3-43a1-94a7-8b4d6ed73467} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3124 -prefsLen 35253 -prefMapHandle 2916 -prefMapSize 270315 -jsInitHandle 3016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4508 -initialChannelId {54ce7ccd-6b54-433c-9151-b2575d569471} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4944 -prefsLen 35302 -prefMapHandle 5048 -prefMapSize 270315 -ipcHandle 5052 -initialChannelId {763d4b19-d279-4c56-ad33-8e343b9eabd9} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3176 -prefsLen 33241 -prefMapHandle 4648 -prefMapSize 270315 -jsInitHandle 5300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5320 -initialChannelId {284a9aad-5853-4194-b032-65e8ab91da7f} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 33241 -prefMapHandle 5488 -prefMapSize 270315 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {306cff8b-d4ee-427c-94b8-996a682b4741} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2736 -prefsLen 33241 -prefMapHandle 4340 -prefMapSize 270315 -jsInitHandle 2544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {20a0274b-4aad-4c00-b4d5-3219b50613cf} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6136 -prefsLen 33241 -prefMapHandle 6140 -prefMapSize 270315 -jsInitHandle 6116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {4deb033d-5269-4bac-bb02-211d098a45e5} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:968
- - C:\Users\Admin\Downloads\7z2602-x64.exe
    "C:\Users\Admin\Downloads\7z2602-x64.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2524

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap28900:136:7zEvent18368
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2548

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\" -an -ai#7zMap30626:130:7zEvent12664
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5220

C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\oCam_v520.0.exe
"C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\oCam_v520.0.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5512
- C:\Users\Admin\AppData\Local\Temp\is-BJ3OR.tmp\oCam_v520.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BJ3OR.tmp\oCam_v520.0.tmp" /SL5="$70262,8795204,243712,C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\oCam_v520.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1232

C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\AMPED\Patch.exe
"C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\AMPED\Patch.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Program Files\7-Zip\7z.dll
Size 1.8MB
SHA256 69fd4df057985c40e510e2fac182881c7f85e90aa13ec703f763a8fdb2ce61f8
MD5 58c9628787bce8db529dd668e1825630
SHA1 f59f722a9a0064fdc2c762100383d7babb0a57b6
SHA512 da68b7bc3281bb0f7dc1ed7dcd234dddbbb1f5992bb156f6a844f8c8bea42fecee93f953d6f4a1c7d324b456e2fe56246601f334b13badc3c21e307958117327
SSDEEP 24576:h8yTPwShrEtNwWdhpmBi/33fR8x4cWNFhzNXuzrMnM:hzTPwZ/wUhwucOrbn
TLSH
T14E954C1BF6748270D0B6C075C5E2AB9AEE7134869B30A6C712859B3D2F17EF5863D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 706KB
SHA256 307a306fd3c2e1beab674d0b60fc8b6a74f0d0d7cf9db02201f03328bf1a25f0
MD5 c8d0d6ba5a081676e091e0aee0bc1f1d
SHA1 ee542ada94412fb58dc61968efb7cc866383fece
SHA512 7cc24312b023c37a20a3ff09f769ee1000be6dcb367e8d648c19a5e83a8d9e284c6dc87cf46316d1270af08b221cd895fcbcea46de27ab908273f5ade39f46bd
SSDEEP 12288:YtWiROD0RFpHlziZZqevq6U4KxaHm/0bu6oGMxxE65Be+Z:kBID6FDchG/0a/GMD5ZZ
TLSH
T138F40966F5748331D073C0BAC5D3AA9AEE7234425B308ACB5245D76C2E27BE68736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\activity-stream.contile.json.tmp
Size 4KB
SHA256 8717c736b02962d9618db3d8a1d230da297a0e8fdf18993438ecf395227e69d1
MD5 de3b1e81ef3b927758f9ab90a0ba6139
SHA1 0ca069a00fbe8ae0e64d89852edf4d1dcba11ec2
SHA512 f6537d651e8b1e4f5c2953f80ff5e5327a9007d9ec81d09f93aec1a7e77c0a213ca697a83099b5c79abc23394a369dfa59a355a1f9c3809b160fadde4991bc6b
SSDEEP 96:kKYV46/56Dm9bdJC6en0t/C/eOE66yNSwob:Ixwm9bdDe0t/C/eOUyNSwob
TLSH
T1C9B1E79FD6A485536B725EC2294A278CD283710FA9DCCD9CF3D2B922025A31E865D8C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\activity-stream.discovery_stream.json
Size 76KB
SHA256 ec4c3a64483b9c552442c15e7e8ee649d3c29837e83956fad50dbd7ef4704372
MD5 86fda6268690c13bad91c130cd22d376
SHA1 711923617ce22c5d6943b81d8b016b2ee2ae474e
SHA512 7eea54b8c3f7f64fa64f112cb4bf7e4600d4ef19988cbf203b588591c71c7b4af5efb8535bd4daa7f7f5205704c7db0313c04dcf8457d9b1980e2c9becc2073a
SSDEEP 768:YyOP9JaTPHXP/Vq+Cf17kIbaOPmNZBseLOnHzwCem0hsUq+heQZVBSSujx5xnRub:jIjar4vm2TwCem0hsU1eu5uzlRhFC
TLSH
T10C730AA363A9B1BB1B913BC72C0FB55B62E60159E38505C9ECEEC91CC19C654123E6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

419A455FE267C66F0168B02C2656CD4E92948278

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\419A455FE267C66F0168B02C2656CD4E92948278
Size 11KB
SHA256 80f83991c90c93250462d28e73f91018da84f513b4e3aa30a96e6763661682d0
MD5 a0c99b4b0573f807c01fed1b572ffe90
SHA1 e762e1c9b3db60c1b888adf1f8b68d6813f63029
SHA512 58d847ab03200ebb346b3ce7f10372340282fd5a3e5a53c56f751c5ba1cd5e5e4d0db0721c77f320cc92f16ccafc786478da0e6164fec36be93e5dbd98c64214
SSDEEP 192:i51eMSe6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDlY:ifLdvI2Efy0vI2EfnaGUzHODWoh1B9M7
TLSH
T134427F79ED5158AE16F0D1DBE5AC19BA0C56AB13ADC2E1E92F193104D8C02F963B81C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 16KB
SHA256 d5e0f7ae70e26ab141b14d0e1e8835309e110767497c36cc3bb86a1d1c73b65d
MD5 9a4745bbab8f76fcbaa0b904f6f55570
SHA1 8bbdd1c7c22867ab03204040983cfff28a7684ec
SHA512 dadd5e688732fb2f5cdeca62a2bb6c61f268b8129c5b4cea93c5c4ef086f35c3f68180ff63f8bc070aa840040172b3fb47dfedff19a6ec7742e928ea236dc9ae
SSDEEP 384:Wh8jgJ4IlP61hu1wdvNd9KVRaAcP+AWRMA1:50J4IlP61hiwdvNmVAf+hRMe
TLSH
T1AC72AE3BCF9128DA1A2358E24E6E27C91D42B14B9EDDC9DC63553902C24A7AFC5FC4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 2bca4506cfa665f5a4925365d67f2cb971c5b42b9b5090a6278ea59fd0e84912
MD5 3d9ad0d2407ee3afc154f2a09169008b
SHA1 9bb41db6a3515af3caa3d0b878de9eae7a930ab2
SHA512 5d9a9aa7f8bdd7ea177b4735a4a96a9e6a175b35b8a0fa48827cb3fafc4797e656d7c74c011871b4daca8facaee29197c13955b2ad9168230fef1c10617d0224
SSDEEP 384:HXkRyiO024YmDL84KKDL849B7SOEAd9KVRaAcP+AWRMAO:3mZYmDL8lKDL8CB7S/AmVAf+hRMb
TLSH
T14D727D3D5F003CAC25A7C0E8C5E592AA4D18B7A7DEEAC0AD21183D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 11KB
SHA256 fa9aaace74ed2882fd78cc52eb39fc83cb6cf9bbfbf0af7c7dc25983ad733cb6
MD5 ecbd37b21ff7ffd3691965339e572c2c
SHA1 940351bd337835d2bd1d7c9416368e6c794d73b7
SHA512 f7c33edb5b13a7a48233f27918298d6fe8ff085cc33a67d51a77e853601fefb041ca6a01f5dbf2387a7a0cc785a89273a9a941c73f2afa0bc55c402e1534b6c2
SSDEEP 192:48D6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDJkkHdk:48DvI2Efy0vI2EfnaGUzHODWoh1B9M0U
TLSH
T162327E3AED5158AE05F1D58BE96D69A90C4AEB03EFC6D1E92F1D3504D8C02B5B2B81C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 52B
SHA256 c1181f43f86d458bcc2bc4a444bcf932984a9d4b3649af4fad534f244aef0320
MD5 a40eff75ec32b69913314efe2a9c6f12
SHA1 d6bf15c5129d4e499477fd7a10a99ee34109ebea
SHA512 09b0d6c361385ae39d6e4cbf3abfcbb7258c04fb0f391b6b39a6373099e3ed3013984230ce473950a2e990ed827a6e5ce7eb0f1409c9c4343b1a6ec4ae87bf1e
TLSH
T1D990025856568604D4648D310901D4B4A4113D8064C4432235920B5214124D23001210
MD5 SHA1 SHA512 TLSH

Submit Download

DE5F6CB1BD71958EB146CDD974763A3115937269

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\DE5F6CB1BD71958EB146CDD974763A3115937269
Size 11KB
SHA256 f9a57e5c9477c1961305b05614a569502237484644254bac166bb6b28c202d60
MD5 a74ff236da9e3dfdd795bd92491b13a6
SHA1 5237ec55748ae0e44dc870e8fe80e91f9bed64fc
SHA512 a6b721afca452fd5cf7505160e5f5510d028d595f4c22a3a095e8939130fab7ee51ed9539841a2fbcee40778922ed8c06ec8781217ef2bdf22cef700123dcb41
SSDEEP 192:Ku6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDYdLfkka:LvI2Efy0vI2EfnaGUzHODWoh1B9M0lpT
TLSH
T14F327F39ED5258AE05F1D19BE97C15B90C56FB03BEC6D1A93F6D3100D8802B5B2B91CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 11KB
SHA256 67beae8e3307edb887de9a19ecd3e733b117c4411049c8915ef80c1a3bdd1545
MD5 36d56be26112a6c2e50fe674a6265ee3
SHA1 ecc11f540d2ed3ac311c2e2dd6f75aa57e3d35a7
SHA512 ff63a9d5ce9d6a4173eb513c42f5a49194946e265ed8d52fecd8b02698c9d5e638c01c453685b972303884645bd649f8eb7ecc6cc444c91f0b3c50d78da3af8b
SSDEEP 192:ttwX6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDlHdKk:bIvI2Efy0vI2EfnaGUzHODWoh1B9M0lR
TLSH
T1F9428D3AED5058AE1EF0D69BD5BC59681D46EB03EDC2D1ED3E193104C9C03A9B2B91CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6DB2CC802065A948266A380F89F5EB80BB1A349

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\cache2\entries\F6DB2CC802065A948266A380F89F5EB80BB1A349
Size 11KB
SHA256 ad6037eeb72d1ea247727022bc7ba9293836d6fba47b653cba655346c358c7b2
MD5 166e9df5fa099789f67a5cd4215ac459
SHA1 2a210d78e9889d19859e44d8d912525826dcd489
SHA512 bb7f0a0de127df0cc9fc05a3819a8e4bfd6889c1c09bae456e4089d84bec924d36496b11f03d2da179804e21acfd7b9bf492aa4cb25667671741fe8ed98fe2e8
SSDEEP 192:PLy6seHP2Efs106seHP2Efs4aGUzcoOTH/E5oW65fBydFGf1e0lpBNDIIDTcdckT:POvI2Efy0vI2EfnaGUzHODWoh1B9M0la
TLSH
T1F3327F39ED5168AE09F1D58BE66C59690C4AEB03EEC5D1ED2F1E3500C8C43F9A2B91CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\startupCache\startupCache.8.little
Size 8.2MB
SHA256 8061173ea2fb422fd4da0c46b7760a7b80f80ea87b1ff66e96665abc0e73599f
MD5 7964a80f8ae83b71de6d83ddad95d1f8
SHA1 b60e94d7ec7e3d8810d712828e3e083109d4f5d5
SHA512 2497dbd958c410480b2624a6d6bfd67c831cc201bcb3ae007f420f074466a001d4805751dd89012eb93eea4267bb29dd7bfc5cd11f1655d53f140b177252af54
SSDEEP 98304:zr32LzOUeeNdEeq23uVznCi63wJdNTngVVIKFGHSOR:fszOkd34+iywjND1FR
TLSH
T1DD8602B7B3590697C425191AE87A0A393763418203E166A9CF78533FFEC724C1BC6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 c9f9d04e70df00e4476fbb81f8c397f479a0ffbe3e9fdb6908c32a6a9916f014
MD5 75b05d1286bec54464c496f67dbfc33d
SHA1 583312d5a87a83c065dc01572fc8a170d3be729c
SHA512 cff2f2f38e922ad26db3ad1a547fe04239dd36b9978ee51942d3b9df68220645376b3f43071c80992df206bb90d4342d63e6df6272dd265ef3526b81876ab3db
SSDEEP 1536:jTrli6V8/nDtmTKsnk8HOv/PsnMFRAMCflF9ysC5pcF5rqSms5kPoJlndt1+KkvB:j3lDAsnk8q1AMylLTESD4R8SL3R
TLSH
T1E8B3AFFADBA2CD3858FFD42D6AC2893EFD662410B3A73009C963271152C6FB46775648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

683ca52163a6809f7ca5becbfda0f9f1.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\np1qajgb.default-release\thumbnails\683ca52163a6809f7ca5becbfda0f9f1.png
Size 16KB
SHA256 259e6caeba29f3eabb2f40ae15a9ea13cf2e6a5e02032e0519e81469b617d11c
MD5 df730d4326a8db81512692fbb5232637
SHA1 1b3b4b643c3096db1033af5fe323a3c0b6b4529a
SHA512 26e8198f93c89a5f385a5385c4ba32cb75ad3703609b95dbc815b9ce37f6efa44e787bbadf0b7ea8cf19eb4a72e283acfbd2cc62100619c588c5ac73209b59b7
SSDEEP 384:d+F3iFNrzZaERmYoB4d+lgUKLCZUt+MIf:dO3iLhaEsB40pKL0Ut+F
TLSH
T1B572D11A5D2735EE71F73AECCB8AC2349ADC271FB836A0A1F615C954D7E9D40D0B1092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dup2patcher.dll

Path C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
Size 55KB
SHA256 ffa4e072a0b58dbbb87a661b21cd6058f50c3b4a0040ecceb1a53441430b6683
MD5 4d3b330ce2da476b7287be269d6d3ee3
SHA1 c8e8ce8c215b60c692c068be56969bc10a9e3d0c
SHA512 8e8b9b2977149e3df692f9fd8e76ec9b7767fafcd0c55fdabc34448735fe442250722e70be16598e43243cfbf4ce4c427d6326b326939b15f21991d4aa7df072
SSDEEP 1536:K/Tilc2ldltF9j6RW8Hu/1lxC+oU0ODbUI:ITYc2ldltF9jWW8Hu/1lxC+oU0ODb
TLSH
T16D43E8546D97857DC39057352CE99E6086696F31E760E0079F3C2E2C2F21952EB2BE32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oCam_v520.0.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BJ3OR.tmp\oCam_v520.0.tmp
Size 1.5MB
SHA256 efb7877be8b110b5af74b99dbf4f580d6ece6f83eef196120dff3a0220d96c72
MD5 4c31eaeee92830c35cb7c8a7dcbb14fa
SHA1 ce566385db3a711806aa34700d2fc3e714e2cfbb
SHA512 62b1b70dac5a98d4cac7df21362b45b7d78ea18c10bf0cd3bc0470c830401d7f93514f2502396db3e733f7c6e1ed6c647025669354d3cd4bcbeff273e1b3ea71
SSDEEP 24576:sNPP5WegGhedUndiH3mqBeSon6AqtIiBVU1mFMCgrun996IlEx1mJgTjo/nIbSsP:sNfMwSBt3UEt76IsAHnIwC
TLSH
T199756C13A2A2503FD0765B366D2BC2915C377E202E72985B6FF4BF0C0E792816D3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 d2596f3ee7592025d28809480a11c55bca7795f9f52ea15bdd82bff0b23d41b5
MD5 fd74bae5801e736d18e819265ba19b8b
SHA1 91b28478cf672afdca81c44b39e0bfd53abe1835
SHA512 420ceac7bf7442a4a79d6ba9e7a8fb43057b7249b76704b444f151ce11a00874fdc5bef1433545f589b710ea08ecb88ed696f4386600e7933d462a1d6038584c
TLSH
T14B2112338D8BC236F2C246347C9D45502C66378341B6F1E4BEA15AE57194EEA219DA50
MD5 SHA1 SHA512 TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 83e2a5c9d65ed4f819fd9bd6a52715e7d92eb7665d12e9f6dc431496c2b758f6
MD5 87b094ee8bf6b3236413e045af531f39
SHA1 35b84680882ae729f75eaaaf14047adaf5f6746f
SHA512 0c47f8a39b1342ee8be869ae5e146cf2693fc118f9ae9588a03f08a26a756e2c1453c860d42060f505fc19bd47512d7becf73bf2680e233f1e7c3c10f6d88a4b
SSDEEP 12:DBl/WhnB8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLsB8akrEDE+vED8YfAlO
TLSH
T18CA3C68F0E702680EDC420B0D7828EEEAA1EC32DCB13279202A000B29D0206019220B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

content-prefs.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\content-prefs.sqlite
Size 256KB
SHA256 fff6c2239e0d2ccc2dfe16bece3f51fe2831ce8baaa337827bbde444207a727b
MD5 d3941a15a96fb3023cf1587a47b586b2
SHA1 94996d072eea6af88a1d96b8ef900a1fe3ea56ca
SHA512 d627318f49a185b6ad4dbd76c9eb5aef82c360ab76fed195641fbd258e045e1f04c0d6359827a9c31c677414bc656e183770c0d1b829821388db8bfd2608f364
SSDEEP 24:DLCKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DmWwae+QtMImelekKDa5
TLSH
T1234426174AA17408C0B014B1D4636F22AF3D405B8933E7B23ABC143A4F886AAFC791E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.bin
Size 32KB
SHA256 f3881d73d3c34718caa0d675dbe034edc93df296f5778db37052dfae9d7ad9e9
MD5 a53c4e71620d266f4029b20b45cce914
SHA1 56412e72a2f4685cb10fca8155a13d9677960908
SHA512 755adf1b6fd4fcfa456df8ce506b7d874cdac7eb46624d1cabe6b302b5ca813ea69f3cafe1b32b40f652b4c4ab4110007cd8bd9d86c1672992e9e6d68331a41a
SSDEEP 768:cBLMcukGcmhuJmR+pCh0sVbxbPbGbwb3mP67p:cBLMcbmD3
TLSH
T1CAE20084EB2A913FD41912BBDCA507002F78BC8A59192F673A4D646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 57c17026b7dab94241acc5b27060075f3a6e5a6b70063f36c7cac1af8e20ef7c
MD5 753a6515797184ba85f4b9ba8ed707f0
SHA1 c70389699ab7185cc78438e9b2a54440310a5225
SHA512 4206302496c8e74f2bd081b2982d650674411f5452fda9b857a5ef84fb364f72544cfd2f8306d3a44bafe99814636b7da442e01eae14be1195dff748f609171c
SSDEEP 768:NPg0lBLMcukGcmhuJmR+pCh0sVbxbPbGbwb3:3BLMcbmD
TLSH
T1A1E20084EB2A913FD42912BBDCA507002F79BC8959192F673A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 eb45a384c6a08f0b917235e0e53e2eb64b00d2a55f436aeccf2f34daf05396d1
MD5 7c291f509e2788c41c02b3efbef5c5cd
SHA1 46669678bc965af7cc26789add7acb7f76651ea3
SHA512 e199bc0fb0ced096f00ae53672b75f2b00688b8131699aaa18555f33e87a9b0c0feae4103822621b0775bb0fad60033682cebc474c4c1f3f6db77419a7faf59c
SSDEEP 768:HAGPvBLMcukGcmhuJmR+pCh0sVbxbPbGbwb3:fBLMcbmD
TLSH
T16EE21184EB2A913FD41912BBDCE507002F78B88959192F673A4C646C6C872DC3D9E57F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 a418d3c097885a0101d4ea1375ac4f576ca7ea49110d12158910cc7a3eba5346
MD5 03cdb9be122fc07c04d0896f476a1252
SHA1 b216c601163173cad9a6f02c753f62da4278a98d
SHA512 515a4483c6969e76aa1f0a64ad33541548c5dcd7ac080555095bc5e68e9face0b512f36c53d9776d62b89091031253b30371e3c1210316a023dc9dd6cabbb337
SSDEEP 768:QPtSZAP6FEGcmhuWZRaAL0IGbpbmbPbX:7AP6jZL
TLSH
T15CD2F244EB1A913FD41912BBDCA507042F79BC8A590A2F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3612248e10c07e2381891f3dfeb2a33970d4454ecb6d761dd5d01a6664c7a352
MD5 6271650f6148195dc7a5592b88374b9c
SHA1 aab07dddf4445483ec016ede196fb16f21d4e578
SHA512 322d80799cd645255ff54540c5c71cf344af27499ac5bfd721e97b12ceb17c8198d573ed56825cf3984a326e19653fee78ecbec76ca6bb507eec01bb13446d21
TLSH
T112216A5CB9B94DAA99C7E29C7455138F53514A47448B1D438E02EE8CCF92A99326F43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\events\events
Size 1KB
SHA256 487df14f79bd9920371ec8cea4f760939f62fcf26827a053f5370412d8f06c01
MD5 c8eed703dab80621ba3210afa3198374
SHA1 4c3085f09e93d31123b30db92e0726c7122912a7
SHA512 2e8caf8e68a8d8f7aa0f20b43b9a79e54e68eb74ac7bc9db3d59865e9c0a90e0cbdc6fd5abaaed78f7d02e47dd7a2980c3cb980dd428c5c1b5da3f2afb04a4dd
TLSH
T15F21495CB9B94DAA98C7E29C7495038F93514E0B048B1D438E02EE8DCF92A99326F43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\events\events
Size 1KB
SHA256 708dab890feca9f2bfb295ecf693afc759d4299ec8b9f6204d187f321a37be17
MD5 2b698f15db2d9b17b98a43688f9c3437
SHA1 088a0524af23482d4714d7b1d47517c46b164c25
SHA512 8b80ff7b8249f5adfa65132bf0f0520c0817b585091aa1778641ada777b4f614298ea7aba8298eb5282026d02473431ed9c9045997b96339f5d83331a334d19b
TLSH
T1C0214C5CB9B84DBAA887E69C7444038E93194E4B04871C434E02EF8DCE919DD326E438
MD5 SHA1 SHA512 TLSH

Submit Download

062ea131-fd40-4a1c-8c81-9d6211aca689

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\062ea131-fd40-4a1c-8c81-9d6211aca689
Size 235B
SHA256 6baf21bf68d3d725b229fc6c0f923c697241a81b39b751fa06553c1950fb628c
MD5 4176242da772c8b234cff6f18e82f1c9
SHA1 25909e356efaa1a36d43e3c1dd01a66bb7f0107f
SHA512 b447bb59841b3d35bc09ee05365c028423bc5cdf791956c80c33a8015b705cffcaf01e9c94e65e7ace5ce562525fe92594303d961a65af515f72bf87da7f0acd
TLSH
T1E5D0978124E8335E0C140F13F1A029E231888C3310B09C2086510634DAB9AC81165C9A
MD5 SHA1 SHA512 TLSH

Submit Download

1ac9ccdb-373a-4699-9251-cfed30b6614f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\1ac9ccdb-373a-4699-9251-cfed30b6614f
Size 871B
SHA256 56db0b9b2557f90d5fbb77e1f4d7d27448fc8dbbcdb98861ce3c4618235d003c
MD5 24072d412ec3c98293425faa21d19bd7
SHA1 aa11eeda23a6ded721bbaa49d46ada51229d0b8e
SHA512 7f07bd7d3120f6c7b459a2230e7a2762cca42275ffa0f3897c97d0e0e4e6188a772027ee3e05b1c2e914cb87e06d46a008ed4970190d81662fe0e48871f20cf2
TLSH
T1D81100819630B962CD7CD34BCDA23B018FB4352380CA54047DA15E280C7E52E936660B
MD5 SHA1 SHA512 TLSH

Submit Download

6a0baef1-1e0d-4fc1-ac78-059a9f1b4c12

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\6a0baef1-1e0d-4fc1-ac78-059a9f1b4c12
Size 235B
SHA256 496d87b82d1af23a9b217122d889699517004c9464423bc3692036fc742c2a89
MD5 9b1d5e28d892da84b18e605bc5b10681
SHA1 04fce4879f926f7386d1dc432fd9a3914365d0c1
SHA512 69944c97793431f3f3d91301b1b739617a7b364463d1ac0f0a516d464a4be5514d0ee000e251d999ccfa088605ead8938dcbb66910f79f2c4509497064f9cc79
TLSH
T1A1D0979468882B2D0C080F43F5E03CC231A84C332C616820D6A10B398AFCDC80161C2B
MD5 SHA1 SHA512 TLSH

Submit Download

6d133771-49ed-429b-8d46-1301d622ee64

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\6d133771-49ed-429b-8d46-1301d622ee64
Size 235B
SHA256 6ab785805defa22a2f7ee901c221de974a552146c9c4dacdfc4b8915e526c8f6
MD5 1993738928dc385157d325f382ae65da
SHA1 665c23b1d125c799bc637bdd404734add822be98
SHA512 8ce16c51d44620dfbd01741693ed0bc1bf9d47f94e8d5a6b0ac69c593cf3c211cc138d6feffede1dbd3162f79fd356713ba6d6375bf9f9c7ffb1250599d3c4ff
TLSH
T19FD097A024D82B5D88140F07F0A0AAC630484C3310A5682089E64138DAF8DC842A282E
MD5 SHA1 SHA512 TLSH

Submit Download

87bca70b-ebd1-49a5-8712-5857d7c5e3fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\87bca70b-ebd1-49a5-8712-5857d7c5e3fc
Size 886B
SHA256 bb6ecc7950e728784e784ae1c8551729aa55f8f3a95f3dbc4b8eb9f019cdd3e3
MD5 5a2392a9c51657b1fa0156020def5a07
SHA1 88af8cb0848da698b0a2f4fc5aeedf3a54a59864
SHA512 ddb19792f167360af46caceec4021f7fb8605d120b7b6591304837a92a83515445aae60017251e61e3d575bb9520fab5ed71cb4d2f329393e9abb647875d0a0d
TLSH
T162110041977479B38C6DD38BCDA23B428FA87523C0CA59047D646E180CBF52F6766717
MD5 SHA1 SHA512 TLSH

Submit Download

9ec7ec5a-8519-4609-99d3-326897c2393f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\9ec7ec5a-8519-4609-99d3-326897c2393f
Size 2KB
SHA256 93b14fe858840cbee20bec78b176bd3b9c36686439781c20fe06628d44d02176
MD5 c7415f9a5923e9d027f62ecf822bc4dd
SHA1 72688cb39b6b33b428e971d745032908d726109d
SHA512 31d2e9655d4397ec69c99d5a582524fbe9055d0c0951187fd9d0a39fb8fa753b034215f9b3d9ba87f00aea482ec7e4e76c76299f8962d7eba2ec9a4003682dde
TLSH
T18041325CB5744CB69CCBF14DD496234E57A04A1700C61C83AE51EE0C8EAA659336F42B
MD5 SHA1 SHA512 TLSH

Submit Download

afe326bf-d4df-458c-90b1-f1f4d80336e4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\afe326bf-d4df-458c-90b1-f1f4d80336e4
Size 2KB
SHA256 23a09593e37c76cd76e83f24ca323761fbf23c2d21df9bada3d8c9af38651f84
MD5 23e4ef356a667547ed94146483ad1559
SHA1 348e091d4cfdf0c4aefd3e83df4e57d0a08aa935
SHA512 b9fdd235c5705b6013262c4ebf23a3a24a84ab7d90c45c32820d5666b221c9b7145a7f9f5b3fecb48f38f45c13e230edfba4b8c93c28c388f31c98c5783aaf9f
TLSH
T19341235C35785C778DABE28DDC82234E57604A1200C628872D62EF0C8CEA65E336A67B
MD5 SHA1 SHA512 TLSH

Submit Download

dbadc29a-de23-4989-86b0-94bcf8949a36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\dbadc29a-de23-4989-86b0-94bcf8949a36
Size 897B
SHA256 402e751f31e3c6578a3c51b27cf0e417b525759a43a64af2a7fb147f801f0ff1
MD5 d3b7cbedc6937f4d7565f9244999032e
SHA1 8f0c329577944b38d18f0522c4db11b2fbbe503e
SHA512 b0068ab47790bb567bf8ca966791f4a6fe25285e55f8ba231e8014b3a4cc9267bce5698f0e4ab6033eefaaa9780adcadc25106080241e36d29f0ecc609a65520
TLSH
T10D11D0419674B873CD3DD38F89A637524BA4312380CA15147DA45F280CAF52E6B66B17
MD5 SHA1 SHA512 TLSH

Submit Download

f055ac30-dd3e-4260-b9c8-e9c91d9df072

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\datareporting\glean\pending_pings\f055ac30-dd3e-4260-b9c8-e9c91d9df072
Size 1KB
SHA256 2d7bd790410f1d08a2294ded91e4a80ef12286936399d18bf3fadac37021ea60
MD5 d845f8ba53cf4e75c3cfc78913b7855a
SHA1 37c1dbfd17ef3319c4141dc8df7eb3cdd6e3c066
SHA512 d78e8ccc499f2c3f8fd747653f6fcf3a003b31a3a0d8065e850215017014d246de7692824938edca29ddfa5ac94b6c9dddd0e0e3baba46c910d32ec9302516d0
TLSH
T1A011EFEDCD1224137D79E20EF9A5BF6B0659643198C583486FFC98362AE747B4113B02
MD5 SHA1 SHA512 TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 c7baab1cd8662625bc822a3c3c7b57973b927cd5c26192d6cda60ed9ecc0ed07
MD5 7231237395096e88196ba0ffd7ac0ac6
SHA1 d303ddfed1d4341f30ed79abbc23ce51f651bd35
SHA512 6220c9908bfa889f1db84625dc214127ee76c40c97a0d2b81df251253d4a8cc7ba6387d94f751a8f092850ce8a86d5c7e0d7938b85ef763813c4ab4a0834055c
SSDEEP 12:DBl/ATMbUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLbbv5XvtQhP8W5/b
TLSH
T1A6A32B1F1B1CB840D4C356F26D8329067634D50B8913BEF03B9D84004F066481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs-1.js
Size 6KB
SHA256 8513a33d2b255a17df9fac777c237b7cad9089246d1fe4ca83e599afa00c4c79
MD5 de21def958907378fa3a0680df8cd211
SHA1 0e8e3678b12e7cd9a9127f7893e6a426641da366
SHA512 01561f08acd5aff1023bafa13ee10b1d859e0fc50198e0aa2ac80f2a2ce6a80e4fcc8b357253a4ab5bfc8e4d8001f7d122d944456fbafbc7d538f3c6029e121d
SSDEEP 96:xHdLUTU0vqGqLfy9cObzS50SSlNdv9jtn/HhrTBw8OP8L4cnzkvJC:zEiRLfy9c/0SSBhrTBw8Oxk
TLSH
T186E1207891188B7F74B677ACAC6888319AB2013B77BF68D750B554C4051CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs-1.js
Size 6KB
SHA256 1b666900aeddaaffc2e2e93e651e83f912aa884fe4823e03151a3e0ea0901c43
MD5 7d7aa8c4368ca93b1cf63e2a0b3aed0a
SHA1 f1d8cc63eade70b163d664685b5ad6dbf1d08a1e
SHA512 63181e7e2c050e9d3a65525dc5de367342d52fa7aebb5b92e87cada699e6eb04c3d3f1a152705aad5154591bd06a881d21eb519d0fddcc313a7b195f6d59ec48
SSDEEP 96:xHdLUTU0vqGqLfy9c1zSD5SSlNdv9j+4n/HhrTBw88P8L4cnzZXvJC:zEiRLfy9cm5SSvhrTBw88kk
TLSH
T12CE13F7890188B7F74B677ACAC688C319AB2013B77BF68D750B55484050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs-1.js
Size 6KB
SHA256 e5e9d00a46f05cfb614bc18c4d2a483ae69b9b9a2c2bbe7d147c137b5f3660a3
MD5 36c6c8106b6045265625d67dbf0ce8a6
SHA1 f742f047e2da03733a24b265fe7b4cc3d8ad95a5
SHA512 502209811f342fca9b12a9b53a770e00b86e7445d975b50309969c3ba83211bf469e022a8717a9cff90604a58222deb27cf2d00f26d8c1fb7413e5e1cdacb0f4
SSDEEP 96:xHdLUTU0vqGqLfy9c1zS50SSlNdv9jtn/HhrTBw88P8L4cnzkvJC:zEiRLfy9cw0SSBhrTBw88xk
TLSH
T18EE12F7891188B7F74B677ACAC6888319AB2013BB7BF68D750B95484051CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs.js
Size 6KB
SHA256 3cf71076ef28ac0fcb5fce089798591deb168fde31d7684add3ab66a59d6992f
MD5 2766aa9e4bb2718da37872090294314a
SHA1 f904cb8bda7595e7b55e9c42349ec2c0f1e31180
SHA512 c0940849d500fadda88c17ae92076db922ee23ef1918406f3300fc4c39ec09fce4d0dcf55069ba4d191669ec94970c1781780aa0fc1bb3c5ad418c807592070a
SSDEEP 96:xHdLUTU0vqGqLfyYc1zSpTSSlNdv9jtn/HhrTBw88P8L4cnzgvJC:zEiRLfyYcMTSSBhrTBw88lk
TLSH
T15FE11E7891188B6F74B677ACAC648C319AB2013BB7BF68D750B554C4051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs.js
Size 6KB
SHA256 6420d3d5718d453e3b7d505a8abb9b14c362847c5147ad76461e0fb29fe7aa5c
MD5 ebf0f00541305c2ee01930cba4f112bb
SHA1 308a1d383cb2b1685d8b100343278c1fbda77af7
SHA512 185cd1ccd977b132c668a381698ffe83edffa725bf7a189dc3a8f774dc11276c93b89f1cc297a393911778bc109998cd55ea032a3a145f6ba3a31a365ce10746
SSDEEP 96:xHdLUTU0vqGqLfy9c1zS50SSlNdv9jtn/HhrTBw88P8L4cnzgvJC:zEiRLfy9cw0SSBhrTBw88lk
TLSH
T1B7E11E7891188B7F74B677ACAC6888319AB2013BB7BF68D750B95484051CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\prefs.js
Size 6KB
SHA256 6d4b5de16a45c06f4bb5015060884239a20799e9d8a26614d830624a6edaf74f
MD5 3be0c49263c556bd19e76e2d40ca1280
SHA1 691740d05ea106f3a5869cb153631af89f6eb95e
SHA512 62fa6de399ce177d7e4c9a4466aa89a3d4d8c9a5c3f47f2cce160e7a2e8cda39b3fcebddc71abb9867d778a62b65c73a0667a882926f800495a7c79dff2c9a01
SSDEEP 96:xHdLUTU0iPqGqLfy9c1zSD5SSlNdv9j+4n/HhrTBw88P8L4cnzZXvJC:zEiCRLfy9cm5SSvhrTBw88kk
TLSH
T121E13F7891188BBF74B677ACAC688C319AB2013B77BF68D750B55484051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\protections.sqlite
Size 64KB
SHA256 f47973dd13805200a469d534a0ec50e224f0c12ae77d93a0e5bcc267af19c145
MD5 63b6f9d979a2cd96d93c105805cafcfc
SHA1 5fc70ce8799617202d1b2a350f6d596b65d48e54
SHA512 ca475720928bd40abab686efb8b890fdccef59c292b26263d41bfd9dfe8f35d21405820e10505fa7cff49eea5ae57ffdbd6ca73d5cf6e1cfe67f5994d2823b90
SSDEEP 6:ltBl/l4/WN1dR4BEJYqWvLue3FMOrMZ0l:DBl/WunddfJiFxMZO
TLSH
T1BF53225E47387021C0891372ABD323923F3CD2FA93232E836A100C358C0A023B822AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionCheckpoints.json.tmp
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 afa8d05a750a03a9610f85241564f76343e48c38490be31d88374a2a96bdbac4
MD5 97e0b1ea2dc4b8dab26bc2cd41771886
SHA1 f5cd6aa0ca06176c032dd0a4e2ee7a1711a83367
SHA512 81358adc5566864e718a6b83dfa606bb1c0f4d1167d29ff3fc7e73c57adfc5bd70238361181c6454eb3c01782865fc65b5e425bbef3bfaab4fa0e97cb51ad6fe
TLSH
T1E821A752D8271EF37E25A225D0C98FA1CA6D3072843818F0C1DD8D5254DE04D774A669
MD5 SHA1 SHA512 TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\storage.sqlite
Size 4KB
SHA256 1db39598ae2ee67e7a598723a6ec07a3b74ab17ef166a2614785c74c43d1c5c3
MD5 701bd81ab9bb9fb95ec393a557d20be7
SHA1 7f6d6f5a146ac2e0c5f5424da7d7199ca8b6662d
SHA512 4f6b7a82f3361c2f452f0093fb0286acfa898528a2933f501bfe627993899cc77e136c435a0cebd95457c72c604b030b46dc07fb7b2b937d67ce3dd46179fc5d
TLSH
T1CF815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B95C72EA011FACAF35966B164BD
MD5 SHA1 SHA512 TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 8131f271a139a57eb966c838663154ba60a56260193a1b6a34b8eb5db3e69779
MD5 7f855e99898b0a352f40606a6b318571
SHA1 2a2b3c53e348547da3f66619a205eced1c8b8632
SHA512 5d7aada5eed5aad14771a6113615326425acb3180b7fcaa255dff6ef20f93e2a86e24142f22d22a7c9c3514262f5238379807d6298eab0457b8bfbea5a45373e
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkBTb:Oa16S6CKnqlizbxV+2xVeU7X2B0mK/
TLSH
T12F237F8E3F07E511C57AF0B178A08D51BC5E321D07222AD679D0DAE4C8F215AEA1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 1f542a48a86671f06293e8d0a5ebc5d9f21f79f427d79c742dda8a59a713ce46
MD5 52f1129f881422aa2d2c98ae9d4486c3
SHA1 282528fdfcd228c48d181ffc14a148ff38d50848
SHA512 2238c6e850c37880de9cf20d07b42c0dee4cf4062b44fed2b332a71c79610e697ba68ee17ba480fafdfba5158673eaf9b921003e230d197028bae303bafd0f5e
SSDEEP 49152:WUjnfs6yaP6ryMtPRd5C9S8ARzMUghuRPbPxYUpq:/zfslaP6ryMtPRBRzMUghuxq
TLSH
T1331639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 e6f25d3954f6215298f40179aae9cc8698395ae6f35f8f5629fc5256a0d10c41
MD5 768ea5e3e5b022780af3580c444752f6
SHA1 5fe4aebfa87c510bcc8a2a30706edaf472c7a7e0
SHA512 f064a01f107b1adaa3233c338b6c32011807735e1b1a13f3e4ff59296a378bc15cc8b1c62fc78f5eaf92966157f6d02f24cf66ecce62ce4c847a521a64018769
SSDEEP 49152:1U2BfskyaP6ryMtG/dWC9S8rRz3UghkR0bPHY7pq:OOfsHaP6ryMtG/xRz3UghkRq
TLSH
T1411639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\np1qajgb.default-release\xulstore.json
Size 138B
SHA256 81ef165ad53b66d069fb647f3b801e9de87b7b09b37201943949ceba3e65bbea
MD5 20b352ea9514cb02dfaa2afcefa0b948
SHA1 16f12babd94531ff9bf0c6948065b40cc4558f0f
SHA512 2347fe24e07468c2d68f23d9c80aa1d1ddc29a066137acdb352930bf663202738f01548aecf9235a6cedae547340a9ffad60157a61d09889d152f4b09070059c
TLSH
T179C02BB0215FD8487F178FCF024D23843D2A851091C011A679C214E0008530F4C18308
MD5 SHA1 SHA512 TLSH

Submit Download

AMPED.rar

Path C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\AMPED.rar
Size 70KB
SHA256 0d962fee764ec8e0f6b175c53b6e03d2722d736d15638c5326e36f7da94ee45c
MD5 87b14b9680c54e141e27130a93888a17
SHA1 fba7ea2d00bf789057604cb5e886da1198b25a89
SHA512 e66af34020bfc1b4733002002c3ef2315f6f35bd96feefce958d25bc26731f3b01dc3fba11562dfe06e0eb02e4896b27df6eaee21c2da6deefe13a893d341f39
SSDEEP 1536:jZAwZikPUO9iXtxAfHlqCp5pFlwuXgkgBxgbNG62w:9Awd8wHcCnKuXgnBxgZzt
TLSH
T1C963E103D57191B6FB318474D30A806CD279452B512EAA3E778F6B15BF673B3C7A0261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Patch.exe

Path C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\AMPED\Patch.exe
Size 61KB
SHA256 b85a445a6f11ef7427ee0f7cb9f7fd84a6e67ea663d7f3b70358d45050e3ef18
MD5 b92968370e9c611e64b339ec9fc09fa8
SHA1 4e0599109a3f86de69739e74aa0bfee304ca4fc8
SHA512 860eb58929984b791c91996eeecbfc14aed6f8c49e1094d445ffed1fa66eb2acac9ad8e4ba6281c0f57f6df87f3d691bb426be8bc9812267017faa827c8c42cf
SSDEEP 1536:4wZikPUO9iXtxAfHlqCp5pFlwuXgkgBxgbNG:4wd8wHcCnKuXgnBxgZ
TLSH
T11B53F106C99651E5FDB084B8538E44BCC7799917500EA61FFBC868066FAB1D3C7F02B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oCam_v520.0.exe

Path C:\Users\Admin\Desktop\OhSoft OCam 520.0 Multilingual\oCam_v520.0.exe
Size 9.0MB
SHA256 507b0b3a008cb04c5a56cb373316bf4b0a4a21e6df187d048ef3d2cf3adb26ee
MD5 dafaa1c179061339bbf77c479e2deba7
SHA1 6f753b3da62450e5e19e67e3992ffeeb784b017b
SHA512 1efe4353ffc7156c750cdc05c5f112f68021031b52d5dfe407f2bb70045089b69bc29c318a289f1264fb751f6d35cdf26e6856d56b5cabd158b85f0c01423c9c
SSDEEP 196608:z+NOLLzqBCmhHs2ZScpZJNzWdxNPqYWSQDSWREjzOvZPqtjJbcTkE/41s:iGLeBRxs2DZJNadxNSvSDj0ZPqrbukw1
TLSH
T1C3963382B9C74071E1B12F39AD6640511EF67C783AF0721D2C39F60E0AB61E569BDE93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z2602-x64.EoUgzjBW.exe.part

Path C:\Users\Admin\Downloads\7z2602-x64.EoUgzjBW.exe.part
Size 1.6MB
SHA256 6745fa76dc2ea031596d8678f6f6b99c3c1b435b4164a63485adbbc7b8d82ef0
MD5 0617e5373e5e311fcb4bee506e046359
SHA1 b563e139acab81cc7ddf358bec6cee1e6b8b2b17
SHA512 85389eaef377aa9fef3155d2e3375c1fff77fc10e39d9312cab229f202f3aff78f6e807460cf6b04bc2a32f72f7853afbf475cf0dce6232a40c0a6f8ddcbe4da
SSDEEP 49152:L6Cx0Yr+pwKQtSzhTnSwIC4xQlMIUoks8KkE3XB1:L6ChSwbm4wIvxQlPkN76XB1
TLSH
T10D753302D1A0817DCDCBC871D6EC9E23E132B10DDB605E6BD266CCCEBA21A119EDDD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-1076-0x0000000000400000-0x0000000000597000-memory.dmp

Download

memory/5512-1070-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5512-1077-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/5928-1083-0x0000000075810000-0x0000000075836000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads