hxxps://download[.]winandoffice[.]com/Volume/project/2024/EN/project_2024_EN_64Bits[.]exe

Analysis

user interaction
yes
max time kernel
130s
max time network
131s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://download.winandoffice.com/Volume/project/2024/EN/project_2024_EN_64Bits.exe
Sample260810-maxf2afl2s

Score

8^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	3448	firefox.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	project_2024_EN_64Bits.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 4 IoCs

pid	Process
1684	project_2024_EN_64Bits.exe
2916	setup.exe
5380	setup.exe
5732	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\project_2024_EN_64Bits.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4580	cmd.exe
5660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	project_2024_EN_64Bits.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\project_2024_EN_64Bits.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	firefox.exe
Token: SeDebugPrivilege	3448	firefox.exe
Token: SeDebugPrivilege	3448	firefox.exe
Token: SeDebugPrivilege	3448	firefox.exe
Token: SeDebugPrivilege	3448	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3448	firefox.exe
3448	firefox.exe
3448	firefox.exe
3448	firefox.exe
3448	firefox.exe
3448	firefox.exe
3448	firefox.exe
3448	firefox.exe
5732	setup.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3448	firefox.exe
3448	firefox.exe
3448	firefox.exe
3448	firefox.exe
1684	project_2024_EN_64Bits.exe
1684	project_2024_EN_64Bits.exe
2916	setup.exe
5380	setup.exe
5732	setup.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3448	4948	firefox.exe	83
PID 4948 wrote to memory of 3448	4948	firefox.exe	83
PID 3448 wrote to memory of 5076	3448	firefox.exe	84
PID 3448 wrote to memory of 5076	3448	firefox.exe	84
PID 3448 wrote to memory of 5076	3448	firefox.exe	84
PID 3448 wrote to memory of 4272	3448	firefox.exe	85
PID 3448 wrote to memory of 4272	3448	firefox.exe	85
PID 3448 wrote to memory of 4272	3448	firefox.exe	85
PID 3448 wrote to memory of 4272	3448	firefox.exe	85
PID 3448 wrote to memory of 3596	3448	firefox.exe	86
PID 3448 wrote to memory of 3596	3448	firefox.exe	86
PID 3448 wrote to memory of 3596	3448	firefox.exe	86
PID 3448 wrote to memory of 3596	3448	firefox.exe	86
PID 3448 wrote to memory of 3296	3448	firefox.exe	87
PID 3448 wrote to memory of 3296	3448	firefox.exe	87
PID 3448 wrote to memory of 3296	3448	firefox.exe	87
PID 3448 wrote to memory of 3328	3448	firefox.exe	88
PID 3448 wrote to memory of 3328	3448	firefox.exe	88
PID 3448 wrote to memory of 3328	3448	firefox.exe	88
PID 3448 wrote to memory of 3328	3448	firefox.exe	88
PID 3448 wrote to memory of 2708	3448	firefox.exe	89
PID 3448 wrote to memory of 2708	3448	firefox.exe	89
PID 3448 wrote to memory of 2708	3448	firefox.exe	89
PID 3448 wrote to memory of 2708	3448	firefox.exe	89
PID 3448 wrote to memory of 1864	3448	firefox.exe	90
PID 3448 wrote to memory of 1864	3448	firefox.exe	90
PID 3448 wrote to memory of 1864	3448	firefox.exe	90
PID 3448 wrote to memory of 1864	3448	firefox.exe	90
PID 3448 wrote to memory of 4732	3448	firefox.exe	91
PID 3448 wrote to memory of 4732	3448	firefox.exe	91
PID 3448 wrote to memory of 4732	3448	firefox.exe	91
PID 3448 wrote to memory of 4732	3448	firefox.exe	91
PID 3448 wrote to memory of 880	3448	firefox.exe	92
PID 3448 wrote to memory of 880	3448	firefox.exe	92
PID 3448 wrote to memory of 880	3448	firefox.exe	92
PID 3448 wrote to memory of 880	3448	firefox.exe	92
PID 3448 wrote to memory of 1684	3448	firefox.exe	102
PID 1684 wrote to memory of 4580	1684	project_2024_EN_64Bits.exe	104
PID 4580 wrote to memory of 2916	4580	cmd.exe	106
PID 5660 wrote to memory of 5732	5660	cmd.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://download.winandoffice.com/Volume/project/2024/EN/project_2024_EN_64Bits.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://download.winandoffice.com/Volume/project/2024/EN/project_2024_EN_64Bits.exe
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27100 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {d49f1c25-72a4-4f5d-879b-fe0c0e892fb4} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27136 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {1a195207-3645-41f4-abd7-5b318a0a358a} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 25164 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {30e8fa9a-b9b9-469b-99f9-f87692d9ea38} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27277 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4144 -initialChannelId {4dc3d73c-00c2-4653-95b3-2ba4867bb76f} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2808 -prefsLen 34776 -prefMapHandle 2960 -prefMapSize 270279 -jsInitHandle 3068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2668 -initialChannelId {831b36d0-ee0d-4bd6-bde2-fc73e32cfb21} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5008 -prefsLen 35013 -prefMapHandle 5004 -prefMapSize 270279 -ipcHandle 5012 -initialChannelId {e406f099-f910-42f2-9d88-634a630c266e} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5216 -prefsLen 32900 -prefMapHandle 5220 -prefMapSize 270279 -jsInitHandle 5224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5232 -initialChannelId {b5c100c1-4ca7-489e-b999-63080057257d} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5256 -prefsLen 32900 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {64be4e5d-9d1e-442c-a659-deb29d679b01} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2856 -prefsLen 32992 -prefMapHandle 1624 -prefMapSize 270279 -jsInitHandle 1636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4908 -initialChannelId {8ecd71b6-c371-488b-982f-e7919e386e83} -parentPid 3448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:880
- - C:\Users\Admin\Downloads\project_2024_EN_64Bits.exe
    "C:\Users\Admin\Downloads\project_2024_EN_64Bits.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\start.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\Users\Admin\Downloads\package\setup.exe
        
        setup /configure configuration.xml
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5136

C:\Users\Admin\Downloads\package\setup.exe
"C:\Users\Admin\Downloads\package\setup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\package\Click To Run.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Users\Admin\Downloads\package\setup.exe
  setup /configure configuration.xml
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
Size 1KB
SHA256 866e41ba5052294917993d0cbccc35f786c5b4588f3e6294154cc4696d81b4a6
MD5 5e690050b081c85d1f7654be09fc908c
SHA1 e1202ce92f782d7209d24c07475c7f90467e1748
SHA512 8770bd247930c3faa4edb5612baabe029a4c2092bc24012cb5865b97498b877c4cf11a6d160cf1877786a909a0b31a9527382dfe534764cc24bc7ca4fc622927
TLSH
T17B31E963923466823D45F80676989E133CBAB6D1ECC44C9B460D92706DEA7D7BB5450C
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 eae159a3ae2b548e81bcc40b2a51b85491f797d2e09c669817869232315c5469
MD5 dd1fc376ca26085a2dfc3e49cc15aaa5
SHA1 d5f272f7a146af50bff92844c504400e22e1add3
SHA512 99a2665de24cbf99815b251f4019b3dd514a34ead783a4c2b2ae11b6d64fbfd2d69b2aa73c442aaf65986048ca30df0ab255fa0a68fe1fd18c4a62570aba51ca
TLSH
T18FF05CF2D08DC8842C82D48C10C08B3A2860E21620E20912E0AC6CB000E7FBFEB2F0FD
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
Size 422B
SHA256 c516d82996c351689105f17d29b81729bc0fb05388add26f0a317b4d4b0de90b
MD5 9a649fa31ebbd76137eadf11ad51be97
SHA1 3a983a9cc6c256c81c0037419498d4232633f0f5
SHA512 1e95fd7853a02f46798f96fe43ef57728f838eff28de3eb3bba995eb5c74938bbdc845da183c882e70fe610fcaf50e4837e816764905743cd98f0dbc2f2fc83f
TLSH
T18BE0C0542EFE4165E3327E7D4BC9553E9A3EF173040867B57610431D551ED404C26B32
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 2b3f46c6d9d27933c34ff9608da5ef124a7a55a0c6568666628e8bf047a48e1b
MD5 6ecbfe7431addb27c1ad68557a75e69b
SHA1 9ee79f9bd857eb67be263eff1bdfc97e0bf17146
SHA512 7176cac8708fda410c622ba5021b32dd638f62a1b7420d06143a243547c8115ec071348f5e57fb04671cafa2aaa6dbf96517242fc63dab727aa2697efb569640
TLSH
T1BBE0C01418FB421DF1F7D67A07DD78B48466F0251404A1B29AD417046306A00DC12E30
MD5 SHA1 SHA512 TLSH

Submit Download

C1598564-A38D-4C87-9598-E2B29894AF1E

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C1598564-A38D-4C87-9598-E2B29894AF1E
Size 193KB
SHA256 b1a26f943e82a3e773c10370868b0bea43c8e1f46ba635c2796e5640c84fb40f
MD5 b3d43b2f4b87dc43b8230ce8fdb1a1c9
SHA1 c5aa7c89ec7c1c5825398b76f170154eeaa3c40e
SHA512 48ee4de4409839d16f86258c8eeb37e19c99488b8eecbf2825554c1b75c28653a2081fd256d2839932f9089be771554cad190985eafc60577a6518a7f1a7601b
SSDEEP 1536:trVe3b3yFKzyb8xsghEfIe7HWsDXjj/r/JblcAZl1p5ihs7VXXBEKD0aO7qamZdP:K9e7HWsDXjj/r/tX257cL
TLSH
T18B1412A6B2C75C628B33049D5B57A094FE6E129708D5202873FAF3178FF2E1CB947291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\setup.exe_Rules.xml
Size 2KB
SHA256 6953985462d188bbc02be6ea419a14fbfe1f216ce30ed454d05f0a3737177e58
MD5 a4262baadd006537757d7cd008748d06
SHA1 9883d086e5524529e839a5fd19c7903865766b0f
SHA512 99e81940d3b5ed5b624eb68c116c0145755ac11141b16f7fec4acf749e4d886f1316553dee8ee8bdaf397613b9739069123f2acc439f3ee414ba23c86cba1fa5
TLSH
T10041028494E32413ABBAE110B732D3CDFFA690A30CD46480709E67379F368A6080F637
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db
Size 24KB
SHA256 10a17c4e5b5afcce8ae5a13f879e270ae8db598bde3c483a2b3be867f4fa5418
MD5 34ed672c6e690044fcc370709ee1e0ab
SHA1 9750f944d56d2cb667df57086f8111e46b9a0b9f
SHA512 dadd52c7c3402b84f3b12065df63d5ffb08a13ade26675534b4c1851d4fdb6df5add5cd78454a03f0dd2ab55a107696b5b05c2a6fd986ac99a82d9c9fb39d569
SSDEEP 12:TjNqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:Txqt8VtbDBtDi4kZERDEe
TLSH
T1A2B2ACC266B86121E05911B7C8B31367173AD1690433936329F254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db
Size 24KB
SHA256 62e64a14419bc36e39ad84693acffcb3a29338ce6f1aa3dce4620d1f188e0b0f
MD5 78a2309d9256b526aad124c73b8ab19b
SHA1 7b37c16482a82bb48475375a1301321d2fffdbb4
SHA512 9915189e8ae2b4daac72162ca7f86c3f2b6a19a2f0f89f53f43e532561dca5af97caddd883bf2d88b82066ab902617680fa5e7d27357a75d078e8d4301637543
SSDEEP 12:TC8qtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TBqt8VtbDBtDi4kZERDEe
TLSH
T17BB2ACC266786021E05911B7C8B313671739D1690433936329F254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 ec9f54df9e56afb91a12c72e18fa77df66f9da98e7b9cffe1295cd20af172965
MD5 585b648e7e3dc1422a3785817b6f2af4
SHA1 3862397ceda4a01f203451a669a0c3955bbce5c5
SHA512 bebf878066ee4a2d87d08e6c8386c2e979a7668968df5bf7b2f77292143ba3b91c9943c2b11dd7043b5951d7a530897281d11fbc31ae686b2ceda950390fa653
SSDEEP 384:HwCe7iO024YyDL84JTUKisj8wkac8Woh1B9M0lpDIIO7yqy5:QqZYyDL8EUKisjBkaBxh1B9pD877yqy5
TLSH
T11872AFBBDF413C781E83D0E4DA7842554D18EA6BEED3D07A21683C09CAD06D8B1F948D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 a0a7bff48b251cdd3dad07e5120927ab2eb9a4968e33870cce1915d9668a3980
MD5 aa23462635248020a418a7fadec4b2f1
SHA1 22cb17d842eaedce70e863c99ceaad7d231f1e38
SHA512 a79a55c51d82eb94cd16726c7248147f233d365ab35462179b0f00f7cde30b8095ed2eed6096aa5e58445577bec2445b5164ff673616cd31b8ef0142ba9242ea
SSDEEP 384:HXkRyiO024YUDL84KKDL849B7SOEAd9KVRaAcP+AWRMAz:3mZYUDL8lKDL8CB7S/AmVAf+hRM2
TLSH
T195727E3D4F003CAC25A7C0ECC5B992AA4D18B7A7DEE6C06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 e74ebc72cee8bc7248a16740ba031b181a4394a0900fc580d873eef37c101940
MD5 d27cd930d266f4faa5f10d8b669b5864
SHA1 64baf27a583b9c6b8ba6c313d1044d2c2a51e191
SHA512 2927100be2a94a59e27df29da9ca96a553dbcd3c306401fcfa1e9ad6c89a7341b66340863022e0cb5bfb22d0997f472d2f17ad9a770871a2a527c9a129f76e2e
TLSH
T13A61C899F628863FE445423ACC965B411F307453A8AF7F2A39AC604D1E473CE368D57D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 5a5755e8a29c9af51df794dcfe89c0315558565f1df7c6a420c19d944f98cd6b
MD5 adcb543f5f3835a8eab776ef0f13c733
SHA1 a4b43c78a4b88f0d2671e2d179c2cc2de60b9305
SHA512 4410ac360d447bc3ff56bc1cfbb3d0cbae17dcd13c5912434fdb5d947ae573a177c7e6471cd977706f56467499d7b748eb9ff8c89f29b4e776699e07ebc75906
SSDEEP 96:dZuFZ2FfJFfE/FfSfS/dd66Joz1zgClKtmc0d/UUpSdF95/7bkW6BrcEJmyUR6fB:/Kj1d66Joz1zgCl6mc0d3Ov5zboBbJmg
TLSH
T12BC1EE68F629863BC844023BCCA51B500F76395BA84E7F2931EC64192D962DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8f903d3c1ee496015a1eecad650ad1b0c083f284726480ce26f939b4522519bf
MD5 b7251efcedee9d877ee319ecb2089f8d
SHA1 e3672964bfe3b804288d19d857d3063efa06da7c
SHA512 1e0f1764b4d169c77f3343445d654d4e3c8b0816a723f965252e5124f93e3af247897fd7eb07dcf8c436d093415e225f9c19d661e4b8f5545d0e0322e9d3131a
SSDEEP 192:wKj1d66Joz1zgCl6mc0dyOv5zboAiZJmyjsO:Nd66Joz1zgC1jnboTZJmyj
TLSH
T131E11198EA28867FC444027BCCA51B410F36389B984E7F29359D701C2D572DE778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c97638c25cc5ca34a405c220d5cb2765504143f46e7e507b5a038a9f3b518e1e
MD5 9095370d1fe6122a944ee25f711c3cb8
SHA1 35415aec4c3efb6eb99faf15925ae1011faa769a
SHA512 281b85e7993750c53eab820fba967930e3ac942756adf7bb472c4dd011d2a391636ee6b8f455505f43ffe985ffa4bae4273dd829de35da69662c61c2f60543eb
TLSH
T12F11309C3AF84D3A9C87E29C7445068D97924D0704871C479F62EE9DCEC1AE9326D47D
MD5 SHA1 SHA512 TLSH

Submit Download

a31335ff-e99c-4f1e-b912-e2293eaee727

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\a31335ff-e99c-4f1e-b912-e2293eaee727
Size 235B
SHA256 a9e607c8659061af6c99742ee63627cb4e98068cbc6a557e0a463bd4d940cacc
MD5 54bc09ff3fc96c40058faad2eea72a46
SHA1 29b95354fc4714ee3918e81bc002f5511dd6e1d4
SHA512 0362a2326b68db5f5ea4d4cba7d7053bb92e85a2ef23d7f1fb0e96d5b71d8e5944c8fbc9455bacd114059b685dbf62ee0f757052bfa264dd650b55d261d4db88
TLSH
T1E2D0978414A823AE08040F0BF0E128CA30988C3328689860E65046389EFCEC8526180B
MD5 SHA1 SHA512 TLSH

Submit Download

a36acd93-ac96-4989-9b73-e935a2b7ffd2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\a36acd93-ac96-4989-9b73-e935a2b7ffd2
Size 2KB
SHA256 90a72eb2cd6e4bcec8214501b847aa3ba5ad70a2f2591059e1fb78b349f63605
MD5 b8bcf6808767284e155e75b03f76c86e
SHA1 3963a224fa8fec0f382538953a67f0cf9366c8a4
SHA512 68a360d65590ec2db9ad47de8b2fdbda8c50fc71b3fce13e0609b4d23424e4849f5ba0b523f9a6e4bf4957863359dac03fca44814ecd7ec0a8d8edb17a8a1104
TLSH
T18741235C35785DB69CDAE54DE483238E57B08E0340C61CC72E61EF0C8CA76E9336A57A
MD5 SHA1 SHA512 TLSH

Submit Download

d65f6c38-cb2f-41cd-ae50-322c626d0888

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\d65f6c38-cb2f-41cd-ae50-322c626d0888
Size 235B
SHA256 b8b34811e3893bf9601955ae36a3c4057f0158cb560ad261f10125aa1fa09f96
MD5 43bde0ba960197acc34d8d8381e56d41
SHA1 e4643d12995cb8f0f4c42ee5c7603ea4b2a37004
SHA512 3c61ee0b1dc4d81b6469c32ffb258a8278be734c3e9799f60e20be65de6f9f6e10a15bb753fbc7495f0345608ab12afcee88afe978dbf15944078733fe29871d
TLSH
T10DD0A7D064DC676F08545F17B0E07DD631854C3714B8A850D6A14A74EAFEFC58262916
MD5 SHA1 SHA512 TLSH

Submit Download

d925f14f-ac46-474c-b78a-320ada9e3483

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\d925f14f-ac46-474c-b78a-320ada9e3483
Size 886B
SHA256 bbd398c3be2d6bae1632d89d982975840a012fb924483ab8a66ec0842d790c5c
MD5 bcb2e8b69a83d16141ab712f2e750525
SHA1 1dc71399008a310a75b46263deff9d6bde1f4b90
SHA512 7c9659c2539c5a6d35bdc91a42e1a2e79147512ab5421d07e7a2c365b0c468ee9a626b8a712a1fb0a98d9034f8b694f47cee03088e4c9b0963da2f45e70ce2ca
TLSH
T15A1104459928B9F2CC64934B9D9477424BE06023C0CA99183F955B180DF754E9756717
MD5 SHA1 SHA512 TLSH

Submit Download

fe6f1547-99e3-4b02-b7e1-82c8767ebdad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\fe6f1547-99e3-4b02-b7e1-82c8767ebdad
Size 15KB
SHA256 2df420d9a6d303ddd5792afd2f18dcccf6e3471f5f933d6f497e83a1edf6d99e
MD5 b67a1e248b0ac2c5646db1019b944969
SHA1 16bbfdef57ea81035e9bd01f2a823c7f944c46b8
SHA512 0d78405c5276ca3c4c4b900c9f944b600fab39ba0a3bbeda16fd55a4f1e38c7d53acb42a0cf448796627e205569645d4f3d1f8b1e25d59d06813c9ab67c5aee1
SSDEEP 192:0QSKzSj0RcfImEo1C1Ty4B+1rsNpzvMMp8O0JmwARFmY1hUNRDIzszf9r2vl0bZO:jSKmj0RcQmn4Ry49bMMp8Omm/aS
TLSH
T1EB72EA56286045BB8291E39998F8BFC3E2F538CF4C419FCE9BE47D0829DE05D112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fef35897-26c6-4f25-b3aa-ff803229154f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\fef35897-26c6-4f25-b3aa-ff803229154f
Size 883B
SHA256 e552d7827dac29d3b8336ff5fd593487c4f24b36c35bf34e5a123134b2900dbf
MD5 e2bc09f63ad982e7c4ea0f5fbf56a365
SHA1 a06cf93c244c90edeb49845e1aadccf8980c929a
SHA512 9c1aa147dc4569b742e0703ad2323794c24c2862abde55909e9bac10f71f78ff99f031eba3583543fc2a79a42e9531d85e9479becd76bfe47f1760a405a36c5e
TLSH
T1DA1123819538B9F2CC68924B8DA537424BF47133C0CA941C3EB29A140DBEA5E932A31B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\extensions.json
Size 16KB
SHA256 69790e48e52154941b1a81c4e43602fa865de55c8da5dff848761005b707a77a
MD5 4eb7ca3ff077539a013a3e7cd3a5a083
SHA1 1f7cb95365bc6973af34c6a8356df35ed9299635
SHA512 2c6f8d72711032a2bd90d7229ad411cd8198d92ed20f3d10f6abdada2f33ab82ccdacb5b80d96534e03b04434ef74979f06a2d82f9bbeefa9711cd99194c1074
SSDEEP 384:7kI4vGUmldvN8dhWP94z+96ofL4HwL4PVL4HZL4H1L4HqH4hRU:II4+Rf+X64m6w4S494x4V404A
TLSH
T1B872511545049EB8294FA79BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 6KB
SHA256 1efe5a8a506ca8422f30c9fb0a2ebd8004a9b6a39fb07e22dc89856b0f954c00
MD5 61025d620fa795306b52927ef2ba1f88
SHA1 f4a45c496baf35d8008dbad16b5c055c67fb655f
SHA512 f977baf77093a814424da110dc6c0459345f6c5f0a08f6e321bec9268365bb715414fec054788f96eb3132fbb396f0f709ae6cd68ff4551ffc4cb8d9380b0dfd
SSDEEP 96:xHltPUTUvPqGqFQPfaw41zS+9SSlndv9jOnfyHVd7Bw88P8L4cnsr1z6:3tP/CR4faw4n9SSq8Vd7Bw88Bh2
TLSH
T109E12F789108CB7F64B677ACAC6889316AB2013B77BF68D750B684C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 7KB
SHA256 391a31bf519a72c3cc1fac722d34c00dc8e232a7f35e98b2b3b9886eabfc84f8
MD5 7bf278eef3212770f5c730a13f75d7be
SHA1 b2270a92c20bebfd28faad06958abeeb1afb7ae5
SHA512 756df2e2cdcdd1af60894cb77e1eae8748b673aba935d54b39dcc56e40247781f4d3bee7736a755bf75537c6c75c37b19cfd3750ce66652e205a659ce74ab096
SSDEEP 96:xHltPtAJ0AojTUvPqGqFQPfxw4ObzS+9SSlndv9jOnfyHVdbBw8808L4cnsr+6:3tPtAJ0AowCR4fxw4k9SSq8VdbBw88QN
TLSH
T1F1F10F789104CF7F64B2376CAC6849319AB2023BB6BF68D711B544D9055CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 dfde203265ea88633f6edf04f0fdb12821605169cd040e4153bdad5609429055
MD5 c5677388bb4867e31699ab4da9381006
SHA1 47b72a657016a7df2ea24c6e83ddef181dc637c2
SHA512 78ee7f1c86dca4c0fd1f1371561418020ddd48fa335f770579cfa316df670791e5f982e58239c5c0c6fea83a5a7c5dacf430b83f5d15aeffc392746bd988c4fc
SSDEEP 96:xHltPUTUkqGqFQPfaHm1zSFSSlndv9jWnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faHmYSSC8Vd7Bw88Bh2
TLSH
T17BE13F789508CB7F64B677ACAC688C316AB2013BB7BF68D650B654C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 a17b2b7d73b589bc50387ba983573bdc57e942624e126a50748c26579b527984
MD5 4f9d29c18a0ce659c6298e95326b682f
SHA1 ce04eb595dcf8f7d90cd13f1b0798aa6c5852d9e
SHA512 80267b958bbfb4c3ebd5ec4202b4cec065431d39928ef51d1fa23ac4c16c9e6b7b3c9938d9b75f32fef944b79da2848291172ef6ca85f910296c319212f5f717
TLSH
T1E321D563981A1EF2BA52019E80C44F998A6E303201740CF080FE8F16289DD66B6822AB
MD5 SHA1 SHA512 TLSH

Submit Download

Click To Run.bat

Path C:\Users\Admin\Downloads\package\Click To Run.bat
Size 34B
SHA256 413b8e555d8f42c56d22d6843708f7bfcb0bbedb4f833bf3c89880665925bd14
MD5 ad3ed1d41f9b51f7f203d56597c05958
SHA1 724822195edeff84c01f298212dbaebf1b55a0d2
SHA512 dcb33488d6a8da2ca6ab1307fba58c68e62cd31e592058bf9c6a1621bff20da4b5df49684a7cac058b522619fd8b785446a251ae5656fba7a4d666dfa303f290
MD5 SHA1 SHA512

Submit Download

configuration.xml

Path C:\Users\Admin\Downloads\package\configuration.xml
Size 188B
SHA256 0a8a3745b4341fee9ed1cefb8f9fdbabde16cd35fc9244d1145ca12342c600b3
MD5 12271eeb6ea3f59a6355e7cc5cad483c
SHA1 f6ddd92eedd2e7072500cc25e7fee8083ca9f301
SHA512 2163421b2331f79d3ba20b12ad91ece0ad3884a327933d7186ef12f940b9bd33c26b406733bcc4979e2ab685b5b8c05bf33d0cccaa074e671d602702d457aebc
TLSH
T1D0C012D3F686585771328157A2D28E50BC73520389254908F06F716B89A5021630311F
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\Downloads\package\setup.exe
Size 7.4MB
SHA256 b03c4cc3c1377ee81b1f94da126e58a30f484d4d935889538fae1c650dd6828b
MD5 7488d696f9a3d74e093b4c31ef7282c6
SHA1 777a182ed8ca8377581c91ac3d91b4b4fe233353
SHA512 a40d074243ec3ced28fc8b4f3e00ccbfb755415540e655e29820b96b2569d530c21f46e3cb7aee24e46de2339207e46c6c4a05f7bd7ce5d85485952b9f881e08
SSDEEP 196608:NX4RUixxsuKuIGizTftIEgBkXVKJw579eRGzouxdxGXaI6HMaJTtGbFK:qnmuKuE3f9gVG5xxGo
TLSH
T14D767C237AD58077E3B202306E39BB1A4D7DBE7109B1F11F6B86161D0AB09D295F5B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

project_2024_EN_64Bits.tn0TkZXs.exe.part

Path C:\Users\Admin\Downloads\project_2024_EN_64Bits.tn0TkZXs.exe.part
Size 2.8MB
SHA256 3c5840bb757d1f5c38fac3c64652813d64c2d18c465a6c34b535bdb9410e0f2a
MD5 eec29bbd59ee3b74ad6a76b99a1c13a4
SHA1 f68861eae5e21e9427a2b1cd7466a8af07a4f49a
SHA512 5de66ee280783ab2703db8f7729c72680251c8fbeb998ceb4393743e9b23aa3035521444b32d6152cc7ead09bd36e4fbaf483508d16f459afcba0ef504b61d09
SSDEEP 49152:Xsv5dypEIJFS6G/9nQ0Ra15r80+qRnmMbYgtLg93bBhYo0Z043k17t6OXoCi/:XsR4WuFSH9nQ0wF+snmMpLgdwo0ZcxV+
TLSH
T168D52353B7C080B2D4712B312A79DA50517DBC941F72CBDF63E6A82ED6205D28B32B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.bat

Path C:\Users\Admin\Downloads\start.bat
Size 49B
SHA256 d7d4b20eb7e17dcf3ce914aa1bc29a94427434cc67519cacfde2c13419c70fb7
MD5 83eea8c8bf2c4e394bd3d7b5e99b2ee3
SHA1 e20292207e34ea18dee06ba57c218ac85096b7fb
SHA512 9e10d9a4553c0fb125869d6575ab744568a9da71ba0b18c8bdcc31cfa53b11a20ee6c1dafc3645c31bae6b75955317a0b294b7c7e18fbf5c123f087154335fb6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads