dcdd8374cda2f0ffd71daacec7dc920090561577f2bf38ec1b4515a8d4448a1f

Analysis

user interaction
yes
max time kernel
323s
max time network
323s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bigwalk-trainer.html
Size 32KB
Sample260809-18g1wsem41
SHA256 dcdd8374cda2f0ffd71daacec7dc920090561577f2bf38ec1b4515a8d4448a1f
MD5 2a43c69108567aa9da0107ba8a7b01f6
SHA1 473fd5c7472c5619526ec026df135827a0cd9964
SHA512 c898b9b919b6e465051941914c57ac1dad49bf282334a37d4f32f33675e43a84048ab39a6768174f75492f72d69d237912541f2617c5fe80e4a8b2fe572f2d74
SSDEEP 768:4CKkSfRHSL1piD59beGKXXq36BVaqktlRvlm4KfcbeGKFJo:4CKkSfRHSL1qHoa367aqktlRvlm4KfSh
TLSH
T192E2FB72E3D0552E713341E8AE42BB69B923004FAA410D2C757DA1B9BBDECE5993374C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5024	NETSTAT.EXE

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5744	NETSTAT.EXE
5772	NETSTAT.EXE
5024	NETSTAT.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{257770B9-278C-444C-A393-50198A335B15}	BigWalk_Trainer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{B7B0F1BE-BF47-44A4-BD97-D5C4D05C1CCB}	BigWalk_Trainer.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{8784C1F4-0CD3-41D5-B103-1CCE498AD8BA}	BigWalk_Trainer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{7ABD9435-8CD3-4707-8739-2729BFE29009}	BigWalk_Trainer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\BigWalk_Trainer_v1.0.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5392	powershell.exe
5392	powershell.exe
5740	BigWalk_Trainer.exe
5740	BigWalk_Trainer.exe
5740	BigWalk_Trainer.exe
5740	BigWalk_Trainer.exe
5968	BigWalk_Trainer.exe
5968	BigWalk_Trainer.exe
5968	BigWalk_Trainer.exe
5968	BigWalk_Trainer.exe
4924	BigWalk_Trainer.exe
4924	BigWalk_Trainer.exe
124	BigWalk_Trainer.exe
124	BigWalk_Trainer.exe
4924	BigWalk_Trainer.exe
4924	BigWalk_Trainer.exe
124	BigWalk_Trainer.exe
124	BigWalk_Trainer.exe
4824	WMIC.exe
4824	WMIC.exe
4824	WMIC.exe
4824	WMIC.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	5980	firefox.exe
Token: SeDebugPrivilege	5980	firefox.exe
Token: SeDebugPrivilege	5980	firefox.exe
Token: SeDebugPrivilege	5980	firefox.exe
Token: SeDebugPrivilege	5980	firefox.exe
Token: SeDebugPrivilege	5980	firefox.exe
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeDebugPrivilege	5744	NETSTAT.EXE
Token: SeDebugPrivilege	5772	NETSTAT.EXE
Token: SeDebugPrivilege	5024	NETSTAT.EXE
Token: SeIncreaseQuotaPrivilege	4824	WMIC.exe
Token: SeSecurityPrivilege	4824	WMIC.exe
Token: SeTakeOwnershipPrivilege	4824	WMIC.exe
Token: SeLoadDriverPrivilege	4824	WMIC.exe
Token: SeSystemProfilePrivilege	4824	WMIC.exe
Token: SeSystemtimePrivilege	4824	WMIC.exe
Token: SeProfSingleProcessPrivilege	4824	WMIC.exe
Token: SeIncBasePriorityPrivilege	4824	WMIC.exe
Token: SeCreatePagefilePrivilege	4824	WMIC.exe
Token: SeBackupPrivilege	4824	WMIC.exe
Token: SeRestorePrivilege	4824	WMIC.exe
Token: SeShutdownPrivilege	4824	WMIC.exe
Token: SeDebugPrivilege	4824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4824	WMIC.exe
Token: SeRemoteShutdownPrivilege	4824	WMIC.exe
Token: SeUndockPrivilege	4824	WMIC.exe
Token: SeManageVolumePrivilege	4824	WMIC.exe
Token: 33	4824	WMIC.exe
Token: 34	4824	WMIC.exe
Token: 35	4824	WMIC.exe
Token: 36	4824	WMIC.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5980	firefox.exe
5980	firefox.exe
5980	firefox.exe
5980	firefox.exe
5980	firefox.exe
5980	firefox.exe
5980	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5980	firefox.exe
5980	firefox.exe
5980	firefox.exe
5980	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5980	4228	firefox.exe	88
PID 4228 wrote to memory of 5980	4228	firefox.exe	88
PID 5980 wrote to memory of 5464	5980	firefox.exe	90
PID 5980 wrote to memory of 5464	5980	firefox.exe	90
PID 5980 wrote to memory of 5464	5980	firefox.exe	90
PID 5980 wrote to memory of 5152	5980	firefox.exe	91
PID 5980 wrote to memory of 5152	5980	firefox.exe	91
PID 5980 wrote to memory of 5152	5980	firefox.exe	91
PID 5980 wrote to memory of 5152	5980	firefox.exe	91
PID 5980 wrote to memory of 4124	5980	firefox.exe	92
PID 5980 wrote to memory of 4124	5980	firefox.exe	92
PID 5980 wrote to memory of 4124	5980	firefox.exe	92
PID 5980 wrote to memory of 4124	5980	firefox.exe	92
PID 5980 wrote to memory of 1388	5980	firefox.exe	93
PID 5980 wrote to memory of 1388	5980	firefox.exe	93
PID 5980 wrote to memory of 1388	5980	firefox.exe	93
PID 5980 wrote to memory of 5620	5980	firefox.exe	94
PID 5980 wrote to memory of 5620	5980	firefox.exe	94
PID 5980 wrote to memory of 5620	5980	firefox.exe	94
PID 5980 wrote to memory of 5620	5980	firefox.exe	94
PID 5980 wrote to memory of 5284	5980	firefox.exe	95
PID 5980 wrote to memory of 5284	5980	firefox.exe	95
PID 5980 wrote to memory of 5284	5980	firefox.exe	95
PID 5980 wrote to memory of 5284	5980	firefox.exe	95
PID 5980 wrote to memory of 3196	5980	firefox.exe	96
PID 5980 wrote to memory of 3196	5980	firefox.exe	96
PID 5980 wrote to memory of 3196	5980	firefox.exe	96
PID 5980 wrote to memory of 3196	5980	firefox.exe	96
PID 5980 wrote to memory of 2352	5980	firefox.exe	97
PID 5980 wrote to memory of 2352	5980	firefox.exe	97
PID 5980 wrote to memory of 2352	5980	firefox.exe	97
PID 5980 wrote to memory of 2352	5980	firefox.exe	97
PID 5980 wrote to memory of 3516	5980	firefox.exe	98
PID 5980 wrote to memory of 3516	5980	firefox.exe	98
PID 5980 wrote to memory of 3516	5980	firefox.exe	98
PID 5980 wrote to memory of 3516	5980	firefox.exe	98
PID 5980 wrote to memory of 4980	5980	firefox.exe	100
PID 5980 wrote to memory of 4980	5980	firefox.exe	100
PID 5980 wrote to memory of 4980	5980	firefox.exe	100
PID 5980 wrote to memory of 4980	5980	firefox.exe	100
PID 5392 wrote to memory of 5744	5392	powershell.exe	107
PID 5392 wrote to memory of 5772	5392	powershell.exe	110
PID 5392 wrote to memory of 5024	5392	powershell.exe	113
PID 5392 wrote to memory of 4824	5392	powershell.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\bigwalk-trainer.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\bigwalk-trainer.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {97aa60e5-1d14-4e8a-aac2-aa2ee02793fe} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {23532090-3b40-4934-8b3e-ad42de9aa259} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27274 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {94bde0ef-f65b-4730-b651-4205f5e54ece} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27274 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 3876 -initialChannelId {cd51ce84-dae8-45f1-9d8b-f22ef5307611} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2676 -prefsLen 34773 -prefMapHandle 2784 -prefMapSize 270279 -jsInitHandle 3144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2712 -initialChannelId {1fd13b0f-586f-4433-8858-af5feebe5456} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4924 -prefsLen 34929 -prefMapHandle 1272 -prefMapSize 270279 -ipcHandle 3044 -initialChannelId {635f739f-8bfe-4bfd-af9a-fcb43d462cb7} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2572 -prefsLen 32952 -prefMapHandle 2584 -prefMapSize 270279 -jsInitHandle 2588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1684 -initialChannelId {2651bba4-8340-4ae7-8cf1-489548960897} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 32952 -prefMapHandle 5700 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5708 -initialChannelId {bb3098fd-1e62-4e76-98ff-ffa1b74174b9} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5888 -prefsLen 32952 -prefMapHandle 5892 -prefMapSize 270279 -jsInitHandle 5896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {519cdb68-846e-4fdb-9e1b-9363423034f1} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1688 -prefsLen 36766 -prefMapHandle 2612 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6192 -initialChannelId {b9680de2-0071-4c9e-9bbf-7ef22a78d806} -parentPid 5980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -f -b
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5744
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -f -b
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\system32\NETSTAT.EXE" -ano -p tcp
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\SysWOW64\Wbem\WMIC.exe
  "C:\Windows\System32\Wbem\WMIC.exe" startup get Caption Command Location User /format:list
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4824

C:\Users\Admin\Desktop\BigWalk_Trainer_v1.0\BigWalk_Trainer.exe
"C:\Users\Admin\Desktop\BigWalk_Trainer_v1.0\BigWalk_Trainer.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5740

C:\Users\Admin\Desktop\BigWalk_Trainer_v1.0\BigWalk_Trainer.exe
"C:\Users\Admin\Desktop\BigWalk_Trainer_v1.0\BigWalk_Trainer.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5968

C:\Users\Admin\Desktop\BigWalk_Trainer_v1.0\BigWalk_Trainer.exe
"C:\Users\Admin\Desktop\BigWalk_Trainer_v1.0\BigWalk_Trainer.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4924

C:\Users\Admin\Desktop\BigWalk_Trainer_v1.0\BigWalk_Trainer.exe
"C:\Users\Admin\Desktop\BigWalk_Trainer_v1.0\BigWalk_Trainer.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 da9fe7e799f3e9dd0c651f59e598369002ebf6f09a5d931485a0e6598d00fe4a
MD5 c94c2b6803976b9628355e04062dfef0
SHA1 71d7aff46d9bc4e525715d071b27d6d94a917807
SHA512 7cd32323257773c91434563752bcc8d94a47f278dcb48cb9b4a7f26896452fbc5de9d7e6c6cfce62e904b78573b29668fa164ecb7191bc0df14c7b8f55c637a6
SSDEEP 384:HwCe7iO024YzDL84KKDL849B7SOEAd9KVRaAcP+AWRMAztg:QqZYzDL8lKDL8CB7S/AmVAf+hRM8tg
TLSH
T181729E3D9F013CAC1997C0E8C1F882D98D18B6A3CFE6806D21683D0DC7989A9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 6fa2ab60f3597ebadbd604c6c62e42307c75da8f657f831c6c3f12c2b745a223
MD5 5b4a576b7b9123f3ad86e580e4f15272
SHA1 0bbaa372c6932184c2b78374cf9bdc4c0c8e3c5c
SHA512 6b123884c4c1c27846251e4289d95d93bdb5bc17d43a85500d1770096dda1aefea3b84e113ba79e1bb22b3fa18321f12257187515663fef9cb32f7f10fd2181e
SSDEEP 384:HXkRyiO024YODL84KKDL849B7SOEAd9KVRaAcP+AWRMAa:3mZYODL8lKDL8CB7S/AmVAf+hRM7
TLSH
T16D727E3D4F003CAC25A7C0E8C5B992AA4D18B7A7DFE6C06D21583D09C798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\AlternateServices.bin
Size 10KB
SHA256 6f21dd64afc1b85ff300e9098ffacd7aae9d44c7f243078d92a5e33bcc0e5ef4
MD5 844d358243972252d616fed9fba38690
SHA1 baca68e91279c60a2f85313b3f7c43abbd405baa
SHA512 c54bccdec1118c716125d03bd572bf284468e0fa195dfa2b16187c7ab9538d865516424092b02e13b8e544a6eb4c962314a251f0c3c001e775be8b8278bfed7f
SSDEEP 24:HuhMZaWDB0j2us+lzHjGqheGbGE5uaTsF2TvhTLu3qhezyuUGsF/G63GQuYFxu:gmJ4HjGPGbGoBf934XzyrNv3Nn
TLSH
T10322C8F722725162F0A28FB6906572C8CD33222E5478D58A8B28C0DA43D57D5E89FB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\AlternateServices.bin
Size 10KB
SHA256 0fabf065b1a43271e68ce32f421839655e6cf915f3f83185905401f9e3b6fcc2
MD5 3849b76cc698ff110a8a2e33af078c47
SHA1 87cdbe75f7c3fab23d0f5305493e5bd00edd71b4
SHA512 fdfd93eab6fbdc91fa3465d543b9afbff04d0f4fa5db68713e793108e20b05477c0fcdbc70157c659b36cea370c496f8664dc6f78c8d29f0950f9a6f91bc7422
SSDEEP 24:HuhMZaWDB0j2us+lzHYJGqheGbGfuUTsF2TvhThugqhezfuXGsF/G63GhuNBFou:gmJ4HYJGPGbGfbf9VvXzfYNv30IU
TLSH
T1E02204F7123154A2F0928FBA906572CCCD37123D5878D58A8B28C4EA03C57D5E89FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 edf399eac58d85ce189f59aa888dd47d80753f38d29ebb598f69fd46884f5c7c
MD5 3e7da306a809da39b323c0539a9a138d
SHA1 9cd94a7efec0e8dfc5a2554e40113c7551c403a9
SHA512 3f448abdef81a67471bc998325062eea9e92fa7eb52674c50aa295b9a3bf84ea18a675e8165a132f8bd9b301c9972bd37e7242c6a6ce3501e281be4a0e086527
SSDEEP 192:BL4Ys1d66JoztdzgCl6mc0d3wWwPOv5zbo7lZUwWlyj7wZT:0d66Joz/zgC1jnboRZslyj
TLSH
T10AE11F64F6288A3FC815027BDDA61B840F35388A984E7F29759D700C2D972DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d63429ac262ffd082e4f52ac4faea9b510bda3ec4dbf40fdfcd7fedc02c67d65
MD5 1b66091e47e3703d32b36f453b656c15
SHA1 c1acbf9f5d110a95bf25e5417d501abce9e873ef
SHA512 1bd2fa1954ab02b9796cb151766a7e0512340f2ac83ec6eb94988c092559813ede98690abc1236a39e54c94b6eb8b1898e2de069cb3b918faaab2d76d385cc27
SSDEEP 192:5wWwPOv5zbo7MkUwWlyj7wZTJL4YY1d66JoztdzgCl6mc0dz:7bohslyjJd66Joz/zgC1jd
TLSH
T1F9F11064F628863FC805027BDCA61F440F35389AD84E7F1975AD600C2D972DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 83ebd01e73e53f062f8e363284ed1226536385d93faf03f9d625f5ad07e6b8c5
MD5 9027d38047ac862a2df26ca3e535ca4e
SHA1 339aa66f4a32bba65e8688a01ad946dee99c127e
SHA512 5148cd8283841f0e3acb4f3301fcea66ba875cf63e874c977aadfe0186005e5b6736f909d11ceb3ecf6c0942e7dac842805e5958bfe45608a569cce48c6b9789
TLSH
T1D8216A9C3AF84D6AB88BE65C746113CE93558A0A05871D439F43EE8CCEC59DD326A538
MD5 SHA1 SHA512 TLSH

Submit Download

4214814c-3244-4dd2-9214-18a7d0ddce2f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\4214814c-3244-4dd2-9214-18a7d0ddce2f
Size 235B
SHA256 41c8f46a9fc482e2a6ea16c6b605208a957fb5f7a56493b863b1d80853ecabc6
MD5 fb2329b07b2034eb497223f21c1e8c88
SHA1 8e74b25c82335e06072f8dce411ed56b13d85637
SHA512 dbfb3cbeedf9fc26788fbfcd3d5b77fdc363d05f0c4ee72f0f4d56e81ed1e0157b3c7ab3d979501604cc2f2903e1ef9ea6f69f3f0182307b1c24380ffd386278
TLSH
T136D0978818C867AC48040F06F0F079C230458C3B30B46810F6A084749DF99C48222E17
MD5 SHA1 SHA512 TLSH

Submit Download

5bbc5549-9bfd-4092-9f41-4a446c8b8a85

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\5bbc5549-9bfd-4092-9f41-4a446c8b8a85
Size 16KB
SHA256 8bb0db30ec6781e62cfe84c344e48c532495b4e4a0f818547a0d3d77fc09f43e
MD5 be44958d6cc9653e6bb81ac8b631f77a
SHA1 f9a1d392402717b945729997f6c07c4f3124be23
SHA512 73c8ef1700b9322be8e6803fc8a45162185a67ffa6ef3c460f4ce7fa464de2bf43aa077a694681c1279c059a57c732a286af39c25237fe1f41ffaf9918eed0ce
SSDEEP 192:ut7Sz9B2jR7i5CTk/y8YaXQLCd1FAsiEC6Kp8LpcGlq2OoGiuLWdBTYvELmT1/IL:mSBBoR7i5CI68Y4siyWd6vEWjm
TLSH
T19172C8566860457A8291E76894FC7FC3E5F128CF4C419FCA9BF4BE082DDA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ac843b7-76f2-46c6-9020-ff2d7c152fb5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\9ac843b7-76f2-46c6-9020-ff2d7c152fb5
Size 2KB
SHA256 f6708dc5bdaac2d93a8d105c85572718578bb05a90012106191f90d2f48639f3
MD5 f2de90774b47af73d1c7605f92cf4e53
SHA1 726ae962292d4cc80a3c2d98c17fc258cf4b192c
SHA512 55658c56a68cfec1f9943f82a037eb81883d6291c94c796927f58d8f732cfd19706d514012202bdfe774324cf5b9c2b2dfa7c010d814927982f51b0a3933304a
TLSH
T1F841116C35744DB64CDBE15DA4C2238E93A0995304C628432E6AEE0CCEC679E736A52B
MD5 SHA1 SHA512 TLSH

Submit Download

a45b24a2-70d4-44fd-aa92-6a5f0207f234

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\a45b24a2-70d4-44fd-aa92-6a5f0207f234
Size 886B
SHA256 69afcbf6f21499970b4bcbc41d11eef5130957dc5c13d17c43cd1e60e834dcff
MD5 58c0cfc6c9d9b4c1abba78672a290bc6
SHA1 1d9aa6df4392cf39f769030f79920effef6f6e69
SHA512 691e05f0fe45f0bdf6d23529c9cca2406accf4d69d441202c3d822e82b4391086a5b745a6b076af504eda20e989b9c98babdbe3a367054763b28ffb8270800cf
TLSH
T14F1127509670BDB2CC75D15FD9D1779247E0B423C0C989187D62AA080EEA65EB366707
MD5 SHA1 SHA512 TLSH

Submit Download

d72cd509-9ea8-4fd2-a6e4-f803273f2f91

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\d72cd509-9ea8-4fd2-a6e4-f803273f2f91
Size 235B
SHA256 3e954e9ff844f07251a8b24e928fa9895f6568f9e22b3da292433f4019f59554
MD5 857a355c47e6a8649b9c9508814be2a2
SHA1 7368a414c3ef26d4e6032f4def84613d3a0fa610
SHA512 ca0735229f3019535abe4dadbb68800c323e6ce088a524012fef7e226aef1aa77730390b0cbf42e7d886752f06b081aaefbae105b8046f088f7d65e08c22c2d1
TLSH
T104D095945498237D4C041F43F0D065E231594C335460E81099B145B4C9B9DC40195856
MD5 SHA1 SHA512 TLSH

Submit Download

efe5b54f-d8c8-4d05-bcbd-9874213608ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\efe5b54f-d8c8-4d05-bcbd-9874213608ba
Size 14KB
SHA256 52ba759cc7a3c8bf6f0d599a6cde04aee747c4ae9ee6c1a05f1248a9d0ff4554
MD5 4166f8945bd03d5828ee6deb82232aee
SHA1 a7f24cfce78a8b949b25e084394429178a866de7
SHA512 7e2bc4c90e42af1d3df1b70d97045fab1820bff5a40631de043f13f0aee8becdbf4c93732b3c435db868bf1681772c0bd65f5937112cb08da09fbe697bee98ad
SSDEEP 192:P5vkIXDdQMGcdQb7PJkG8e7mz9eH8zqgmSBDF7:VkIXDdrGcdQb7PJkGVmZeH8zqgmSBDF7
TLSH
T11362A7FEDD2241573A6AF52DF1A8ADAB0056293109CCC79C6AEC4C3A33D2EB71617714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0fcc4b5-a594-4f69-a341-2309c9a8836b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\f0fcc4b5-a594-4f69-a341-2309c9a8836b
Size 883B
SHA256 bbe33564eef0647118334289b9e1d8b7b9e47ba9436c10206d772d72a8046a73
MD5 6e787eaf1a0ba2b9b68faf99f9af294a
SHA1 814fc50c932160b9681b07d42113b9ede156451d
SHA512 f101d6c81d5d81056c21d791232d2340c461ecba5ae171ba194ad0c9e5478c6cff1cf7c13a3ad85145d4c132f3893abce5b75061a2fdcb884d0b243a0c228371
TLSH
T1F2110080D634BAB2CD68920FCA91374687F4B42380C984043EA269080EFB65FE75661B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\extensions.json
Size 16KB
SHA256 63b55fd183bd6b6592a2b40be148ca9849533fad5078cb1c74a2487ac5eebd3b
MD5 7288a6cf255c620a7e8cc8cae74c29b5
SHA1 f63f18137bbcc8385e755757e53edb9140a8608b
SHA512 e8ef517c7bf586366720fc4512934b0dc58c6a2af8871085085d96369650d6491dbb7b45854d23b6c5b8ecf578d79f54820b350698041612c6e1333b7bfa8011
SSDEEP 384:lkI4vlUmldvB8dhWM94ze96oML4HIL4PqtL4H6tL4HxL4HEh4hg:2I4dRfSXJ42614q4St4at4J4M4e
TLSH
T14272531545049EB8298FA79BAA367E01C37D573B60845C38F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 6KB
SHA256 07ed787ffc4ac9e6f15a17262575f444b3ac63e9a909c954534126929ba9e4d4
MD5 7227c29ce583caeaf1f73d3a98ca9707
SHA1 4762054f50570673f8b9202d62a2a61b05301e8c
SHA512 88a666e41ff50665607dd476378409c13f8878aebd1413f1ebd831f81aeec5b39223d0a4b96bf2ebf57ef959805d716bc5fa774595966dddc9c451b1eb3b2291
SSDEEP 96:xHLUTUhRqGqUfjZA1zS5SSlcdv9j2nTRH0wkysLBw88u8L4cndBOR:B+RUfjZAQSS790wkZBw88Ri
TLSH
T19EE11F7894088BBF74B6776CAC688C316AB2013BB7BF68D650B64485054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 7KB
SHA256 178c1e5b7293645b1341a286c8ee879ecf215fb2a29ff13d7bbb8b2f61c29ce9
MD5 cf3ca379bdccffb9d63a5ee890e84bed
SHA1 6c12c239d57b5102cc270df76ee647fd6b4d8844
SHA512 339a1ca30ac84e812c8660e8ab58f38bcdebf8b613024f020532ff42b8f251345320b556b7a0b5fb16a37093476962ab9a0736e192a50703a99ccfe5a8c6d9f3
SSDEEP 96:xHL5TUhRqGqUfCZAObzS5SSlcdv9j2nTRWRmowkysABw88U8L4cndvOR:BzRUfCZAXSS78R9wkaBw88Bi
TLSH
T11BF10E785004CF7F74B6766CAC6888315AA2023BB7BF68D751BA8489014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 12KB
SHA256 a3323cce16ce68d043763fe30718d8b64393b65629291e56dbf649840158d2ec
MD5 dd077a0be82b5e0032c0243e895a13ff
SHA1 de59f18a10898df9ae50f50e5ea27a6cf04bda8e
SHA512 b942ca1cf72d544006fc2cda4c528d787ccce65c97181bf9093be24f7e702391708e299703b03adc3fc7bfdb37bf8257059d1079517c24c3b0d96a61074f44e5
SSDEEP 192:BzCRUfCZAXSSQXLR9wkjOBw8OXA7HObLni:7kRdYwee2
TLSH
T10842DF7C50448F7F20B2327EAC6549B019610327BA7FBCD607FD88A6059CF6941E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 0b559864e115523bf9b46a6da57039eade2d71c910af1612243be973adc90efd
MD5 f46f41888f9c9b47a4638703c58d557b
SHA1 dea30e65a6104ab9b88d9beba2e0a0edd6e797c5
SHA512 209247e657c92a550327e608172eeada3ce3ab5a4c526b32d12dedeb69e273501045b6a24fbb0ebd63382664a0ae9cd40b07ce80efd798891902c4c84314d0dc
SSDEEP 96:xHLUTUhRqGqUfjyq1zSRSSlcdv9j2nTRH0wkysLBw88u8L4cndBOR:B+RUfjyqkSS790wkZBw88Ri
TLSH
T1E2E1107894088BBF64B6776CAC648C316AB2013B7BBF68D750B65485054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 ba99e75897eeef03a0a9eff29e1f228c22bfd3679886a9e2053de0f0e3fd8c38
MD5 5e92190452c96b0c7d6f981d023a701d
SHA1 16053901320094b559ce4d993933cf8f6b7feb99
SHA512 8b80428216f04d953b39688cd997dc462e120ee860a3d5ff3ceee7fe179a528e6853271a0616a07c7ed12e814a86ff6ce579f8638c197aa2e2ed756695e6adde
TLSH
T1E3412B8777126FF537A3A4588085AFF58BBE303741B08DE0C1AC1990448F849756233C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 00a59cca439d702009d750e595421ca0da0dae4be04a8ab6d87579e6f776f213
MD5 6d3cc2ecd32b1bfccb26ffd43c70d244
SHA1 4fa9ae4e691b8608f915cfc24a027e94e7ed863c
SHA512 db69b6fa790b8dfeb7c7175a8157c489614c42a99182d4018cc19898dd838b984b50b300b511c37bf58bd00537c46dd2dcd8f20cdc32b2e27dce0c010c21c979
SSDEEP 49152:rfs/u7haIEoNYYcG6eY4goM+HpAg0ZjAf:7s5U6V4goM+eg0Zjy
TLSH
T1304629E860D1A257F3814033724993EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 672949ade2452ce462db47f13e93d71fab856ef62b6e61726913e66bd9ad8d9c
MD5 aa3607893272c2807ae8be1656ba5fe1
SHA1 a39acdb4e32864e045a90c506ee1c51decab1433
SHA512 81ffa9b5e3810a38bf7d899536854e667c1489ea09c2ddb48d3de5496b3194793b618dacf66e9e0eb87511cb4c7a9ed9b0b0681e555d8a54c7ae906627cfa1ef
SSDEEP 49152:8L+LyVaeU6f9Q2J9ywUykC56QC5zYY4WLYhTcdh4dhn73slOcAoka5oWQY/xOxT+:kMITV4zzEzCgTWwnzKV+bB
TLSH
T18E767DE860E1D252F38644B3719993EB20EFC00C6036CE44579497FAA9748EB8D977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BigWalk_Trainer_v1.oD9ilSqH.0.zip.part

Path C:\Users\Admin\Downloads\BigWalk_Trainer_v1.oD9ilSqH.0.zip.part
Size 16.2MB
SHA256 7dd327155e16f834090df6d3d311f6cf47c95cd7535848c9796d6cd61b01f114
MD5 74185ef4a1b7dcca0bb33a27e371529b
SHA1 edb85d68d490aa27c0b14825866c9b99db317b14
SHA512 ec7b5f7e4b4541747b8de42f3577a00c73ffac849bc0cbb317701c972214620318f4429f1e1163a43993c40a47e2e322a91035ee1616d190054d52d0066aeee1
SSDEEP 393216:Gs8bkg1XFSYFObmAdPe/vgmpF1ZqbZlAOmXNZoxqz5VdUcBo/:GFbv4YIbfU9pFMZUHoAzDdLo/
TLSH
T13F0733C0BE5B4501CCB41ADA890EE06B376962F7438FD05E0B6CE55F855EA1C98F4F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-901-0x0000000140000000-0x0000000141DDC000-memory.dmp

Download

memory/4924-897-0x0000000140000000-0x0000000141DDC000-memory.dmp

Download

memory/5392-910-0x00000000077E0000-0x0000000007816000-memory.dmp

Download

memory/5392-911-0x00000000708D0000-0x000000007091C000-memory.dmp

Download

memory/5392-870-0x0000000073E90000-0x000000007464C000-memory.dmp

Download

memory/5392-871-0x00000000057E0000-0x0000000005802000-memory.dmp

Download

memory/5392-872-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/5392-873-0x0000000006060000-0x00000000060C6000-memory.dmp

Download

memory/5392-876-0x00000000060D0000-0x000000000642B000-memory.dmp

Download

memory/5392-877-0x00000000065A0000-0x00000000065BE000-memory.dmp

Download

memory/5392-878-0x00000000065C0000-0x000000000660C000-memory.dmp

Download

memory/5392-879-0x0000000073EA2000-0x0000000073EA3000-memory.dmp

Download

memory/5392-880-0x0000000073E90000-0x000000007464C000-memory.dmp

Download

memory/5392-923-0x00000000082F0000-0x00000000082F8000-memory.dmp

Download

memory/5392-922-0x0000000008300000-0x000000000831C000-memory.dmp

Download

memory/5392-921-0x00000000082C0000-0x00000000082D5000-memory.dmp

Download

memory/5392-920-0x0000000008220000-0x0000000008230000-memory.dmp

Download

memory/5392-919-0x0000000007C30000-0x0000000007C41000-memory.dmp

Download

memory/5392-918-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

Download

memory/5392-917-0x0000000008890000-0x0000000008F0C000-memory.dmp

Download

memory/5392-868-0x0000000005930000-0x0000000005F7A000-memory.dmp

Download

memory/5392-916-0x0000000007950000-0x00000000079F3000-memory.dmp

Download

memory/5392-906-0x00000000075F0000-0x0000000007686000-memory.dmp

Download

memory/5392-866-0x0000000073EA2000-0x0000000073EA3000-memory.dmp

Download

memory/5392-905-0x0000000005810000-0x0000000005886000-memory.dmp

Download

memory/5392-867-0x00000000051B0000-0x00000000051E6000-memory.dmp

Download

memory/5392-907-0x0000000005490000-0x00000000054AA000-memory.dmp

Download

memory/5392-908-0x00000000067F0000-0x0000000006812000-memory.dmp

Download

memory/5392-909-0x0000000007C50000-0x000000000820A000-memory.dmp

Download

memory/5392-869-0x0000000073E90000-0x000000007464C000-memory.dmp

Download

memory/5392-915-0x0000000007820000-0x0000000007840000-memory.dmp

Download

memory/5392-912-0x0000000070A30000-0x0000000070D8B000-memory.dmp

Download

memory/5740-894-0x0000000140000000-0x0000000141DDC000-memory.dmp

Download

memory/5740-892-0x0000000140053000-0x0000000140B71000-memory.dmp

Download

memory/5740-893-0x0000000140000000-0x0000000141DDC000-memory.dmp

Download

memory/5740-895-0x0000000140053000-0x0000000140B71000-memory.dmp

Download

memory/5740-887-0x0000000140000000-0x0000000141DDC000-memory.dmp

Download

memory/5740-886-0x0000000140000000-0x0000000141DDC000-memory.dmp

Download

memory/5740-882-0x00007FFE5B170000-0x00007FFE5B172000-memory.dmp

Download

memory/5740-881-0x0000000140053000-0x0000000140B71000-memory.dmp

Download

memory/5968-889-0x0000000140000000-0x0000000141DDC000-memory.dmp

Download