d498fd8eac85f398e384a710fc9c16b623d659671c455ad82ea49a7337ad3960

Analysis

max time kernel
143s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Firefox Installer.exe
Size 364KB
Sample260910-dcc1qsxsb1
SHA256 d498fd8eac85f398e384a710fc9c16b623d659671c455ad82ea49a7337ad3960
MD5 df5c04e4c1cb9cda2442fd12fe575873
SHA1 c5fd39b4f4dcf08350aeba22b841cfdc695b28a9
SHA512 cbe95c0af6681948e076d7e4a28f06f802a1eee787dde0294ed7531ce7fdc73902911c37bddc7ea79931eecb6f7aeb78435fa18aa9b19977c9197a1879212ea1
SSDEEP 6144:naVWdyzOxeA1DfdwX3MmIOon68FsQ8CLSx6mBlXNQqk+3dooQRTXeFuvrg:nMROxdDfOnMmXUFsQ8WSxBLdQqk+tDQQ
TLSH
T1B48422365F7C0CC7CC82B5B5A42D548B5EB8CE6902066177AE20B9523F8FA17368F352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	1104	setup-stub.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4632-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4632-87-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3932-137-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3932-469-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	firefox.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nszDC53.tmp\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\mozinference.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\install.tmp	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\removed-files	setup.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\notificationserver.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\freebl3.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\update-settings.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\Microsoft.UI.Windowing.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\Microsoft.UI.Windowing.Core.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig	setup.exe
File created	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf	setup.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\msvcp140.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\InstallationDirLayout.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140_atomic_wait.dll	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.ini	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nss3.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\libEGL.dll	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\xul.dll.sig	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png	setup.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json	setup.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini	setup.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\	setup.exe
File created	C:\Program Files\Mozilla Firefox\crashhelper.exe	setup.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json	setup.exe
File created	C:\Program Files\Mozilla Firefox\browser\components\shell\assets\kit.gif	setup.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nszDC53.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gkcodecs.dll	setup-stub.exe
File created	C:\Program Files\Mozilla Firefox\nss3.dll	setup.exe
File created	C:\Program Files\Mozilla Firefox\desktop-launcher\desktop-launcher.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	maintenanceservice_installer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nszDC54.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nszDC55.tmp\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\	setup-stub.exe

Executes dropped EXE 26 IoCs

pid	Process
1104	setup-stub.exe
3932	download.exe
6008	setup.exe
2076	maintenanceservice_installer.exe
3464	maintenanceservice_tmp.exe
5548	default-browser-agent.exe
4312	firefox.exe
3164	firefox.exe
3372	crashhelper.exe
2432	firefox.exe
2116	firefox.exe
5360	crashhelper.exe
5804	firefox.exe
2760	firefox.exe
2872	crashhelper.exe
2516	firefox.exe
4780	firefox.exe
2344	firefox.exe
5404	firefox.exe
576	firefox.exe
4868	firefox.exe
4176	firefox.exe
3800	firefox.exe
5808	firefox.exe
1964	firefox.exe
1272	crashreporter.exe

Loads dropped DLL 64 IoCs

pid	Process
1104	setup-stub.exe
1104	setup-stub.exe
1104	setup-stub.exe
1104	setup-stub.exe
1104	setup-stub.exe
1104	setup-stub.exe
1104	setup-stub.exe
1104	setup-stub.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6020	regsvr32.exe
6020	regsvr32.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
2076	maintenanceservice_installer.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
6008	setup.exe
5548	default-browser-agent.exe
5548	default-browser-agent.exe
5548	default-browser-agent.exe
4312	firefox.exe
4312	firefox.exe
4312	firefox.exe
4312	firefox.exe
4312	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3164	firefox.exe
3372	crashhelper.exe
3372	crashhelper.exe
3372	crashhelper.exe
3372	crashhelper.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenanceservice_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Firefox Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	download.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1272	crashreporter.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Colors	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Colors	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Colors	firefox.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\FirefoxPDF-308046B0AF4A39CB\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\FriendlyTypeName = "Firefox URL"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\ = "open"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5F7D8F3C-1EDB-45E4-B986-77051D87F4B1}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5F7D8F3C-1EDB-45E4-B986-77051D87F4B1}\InProcServer32\ = "C:\\Program Files\\Mozilla Firefox\\notificationserver.dll"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\FirefoxPDF-308046B0AF4A39CB	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\FirefoxPDF-308046B0AF4A39CB\ = "Firefox PDF Document"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\FIREFOXURL-308046B0AF4A39CB\SHELL\OPEN\DDEEXEC	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\ = "Firefox HTML Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\FriendlyTypeName = "Firefox PDF Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5F7D8F3C-1EDB-45E4-B986-77051D87F4B1}\DllSurrogate	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB\DisplayName = "Mozilla Firefox"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB\IconUri = "C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\VisualElements_70.png"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods\ = "8"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,5"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,1"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\URL Protocol	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxURL-308046B0AF4A39CB\ = "Firefox URL"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\FirefoxPDF-308046B0AF4A39CB\DefaultIcon\ = "C:\\Program Files\\Mozilla Firefox\\firefox.exe,5"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\FriendlyTypeName = "Firefox HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods\ = "18"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\ddeexec\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ = "ISimpleDOMText"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\FIREFOXPDF-308046B0AF4A39CB\SHELL\OPEN\DDEEXEC	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5F7D8F3C-1EDB-45E4-B986-77051D87F4B1}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "PSFactoryBuffer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods\ = "9"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\FirefoxPDF-308046B0AF4A39CB\shell\open\command	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_CLASSES\FIREFOXPDF-308046B0AF4A39CB\SHELL\OPEN\DDEEXEC	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxPDF-308046B0AF4A39CB\ = "Firefox PDF Document"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FirefoxHTML-308046B0AF4A39CB\shell\open\ddeexec	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\firefox.exe\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\FirefoxToast-308046B0AF4A39CB\CustomActivator = "{5F7D8F3C-1EDB-45E4-B986-77051D87F4B1}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "ISimpleDOMNode"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32	regsvr32.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	setup-stub.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	setup-stub.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	maintenanceservice_tmp.exe
3464	maintenanceservice_tmp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	setup-stub.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1104	setup-stub.exe
1104	setup-stub.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 1104	4632	jaffacakes118_Firefox Installer.exe	89
PID 1104 wrote to memory of 3932	1104	setup-stub.exe	91
PID 3932 wrote to memory of 6008	3932	download.exe	92
PID 6008 wrote to memory of 6020	6008	setup.exe	94
PID 6008 wrote to memory of 2076	6008	setup.exe	95
PID 2076 wrote to memory of 3464	2076	maintenanceservice_installer.exe	96
PID 6008 wrote to memory of 5548	6008	setup.exe	97
PID 5548 wrote to memory of 4312	5548	default-browser-agent.exe	98
PID 4312 wrote to memory of 3164	4312	firefox.exe	99
PID 4312 wrote to memory of 3164	4312	firefox.exe	99
PID 3164 wrote to memory of 3372	3164	firefox.exe	100
PID 6008 wrote to memory of 2432	6008	setup.exe	101
PID 2432 wrote to memory of 2116	2432	firefox.exe	102
PID 2432 wrote to memory of 2116	2432	firefox.exe	102
PID 2116 wrote to memory of 5360	2116	firefox.exe	103
PID 1104 wrote to memory of 5804	1104	setup-stub.exe	104
PID 5804 wrote to memory of 2760	5804	firefox.exe	105
PID 5804 wrote to memory of 2760	5804	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Firefox Installer.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Firefox Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\7zS812B3898\setup-stub.exe
  .\setup-stub.exe
  2⤵
  - Downloads MZ/PE file
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\download.exe
    "C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\download.exe" /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\config.ini
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\setup.exe
      .\setup.exe /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\config.ini
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:6008
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:6020
    - - C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
        
        "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2076
      - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3464
    - - C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        
        "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:5548
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Program Files\Mozilla Firefox\crashhelper.exe
        
        "C:\Program Files\Mozilla Firefox\crashhelper.exe" "3164" "\\.\pipe\gecko-crash-server-pipe.3164" "C:\Users\Admin\AppData\Local\Temp\\" "784" "20260903215306" "796" "844"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3372
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2432
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Program Files\Mozilla Firefox\crashhelper.exe
        
        "C:\Program Files\Mozilla Firefox\crashhelper.exe" "2116" "\\.\pipe\gecko-crash-server-pipe.2116" "C:\Users\Admin\AppData\Local\Temp\\" "784" "20260903215306" "796" "844"
        7⤵
        Executes dropped EXE
        
        PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -first-startup
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies Control Panel
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:2760
    - - C:\Program Files\Mozilla Firefox\crashhelper.exe
        
        "C:\Program Files\Mozilla Firefox\crashhelper.exe" "2760" "\\.\pipe\gecko-crash-server-pipe.2760" "C:\Users\Admin\AppData\Local\Temp\\" "784" "20260903215306" "796" "856"
        5⤵
        Executes dropped EXE
        
        PID:2872
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260903215306 -prefsHandle 2620:29656 -prefMapHandle 2624:304813 -ipcHandle 2656 -initialChannelId {9ef33811-d5c0-4b04-b5fc-45dbd419133a} -parentPid 2760 -crashHelperPid 0 -crashHelper 2664 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        Executes dropped EXE
        
        PID:2516
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260903215306 -prefsHandle 2880:29656 -prefMapHandle 2884:304813 -ipcHandle 2892 -initialChannelId {3f3a07bb-d3da-4e5e-86c0-28c2484e12dd} -parentPid 2760 -crashHelperPid 0 -crashHelper 2900 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        Executes dropped EXE
        
        PID:4780
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2040:27699 -prefMapHandle 2088:304813 -jsInitHandle 2092:160936 -parentBuildID 20260903215306 -ipcHandle 2068 -initialChannelId {81cbb6d7-1e20-4520-98ae-91cfd0a52618} -parentPid 2760 -crashHelperPid 0 -crashHelper 1792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2344
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260903215306 -prefsHandle 3248:29826 -prefMapHandle 3252:304813 -ipcHandle 3320 -initialChannelId {6d3ad968-09e9-42bd-b462-01e6910c6058} -parentPid 2760 -crashHelperPid 0 -crashHelper 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        Executes dropped EXE
        
        PID:5404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3632:29957 -prefMapHandle 3636:304813 -jsInitHandle 3640:160936 -parentBuildID 20260903215306 -ipcHandle 3644 -initialChannelId {d7be3836-7d2e-4619-b77a-10d49c077b17} -parentPid 2760 -crashHelperPid 0 -crashHelper 3652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:576
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336:30033 -prefMapHandle 4340:304813 -jsInitHandle 4344:160936 -parentBuildID 20260903215306 -ipcHandle 4312 -initialChannelId {451ef102-8fa7-4e15-b976-3347c010b536} -parentPid 2760 -crashHelperPid 0 -crashHelper 4352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4868
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260903215306 -sandboxingKind 0 -prefsHandle 5788:30741 -prefMapHandle 5792:304813 -ipcHandle 5800 -initialChannelId {2032b0da-307e-4d5e-b871-03b5303d2b98} -parentPid 2760 -crashHelperPid 0 -crashHelper 5812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4176
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3980:28814 -prefMapHandle 1908:304813 -jsInitHandle 6128:160936 -parentBuildID 20260903215306 -ipcHandle 6240 -initialChannelId {22e1e859-39a0-41f6-904b-610c1e46560b} -parentPid 2760 -crashHelperPid 0 -crashHelper 3272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3800
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6316:28814 -prefMapHandle 6348:304813 -jsInitHandle 6352:160936 -parentBuildID 20260903215306 -ipcHandle 6176 -initialChannelId {32682b61-0026-43b6-b1e8-5fb80c3515c7} -parentPid 2760 -crashHelperPid 0 -crashHelper 6160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5808
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6664:28814 -prefMapHandle 6668:304813 -jsInitHandle 6672:160936 -parentBuildID 20260903215306 -ipcHandle 6680 -initialChannelId {708a7e31-c1c4-4ad0-b9d5-d21f8a0f6f9f} -parentPid 2760 -crashHelperPid 0 -crashHelper 6688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1964
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --ping-cleanup "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports" false
        5⤵
        Executes dropped EXE
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\Program Files\Mozilla Firefox\install.log
Size 8KB
SHA256 473301c6d5a068226654eceaa902e26285d83af69bc823c0718ebfd226c94a54
MD5 5378fa862f192c9a8e9d6ee612ab371a
SHA1 184bb0ae0530417c475a82831c456b5f68fa68c8
SHA512 47c5f828255a4e3c3cbd364474b08477c5023e409be4f1e3bb80d119113506e0cfade972f321ebb30c3b65459a708a68f83c4098914afb55d0e122b06bdb32e1
SSDEEP 48:IDucFKdGuqAbzAW+zxSd9APSddhKdwSdJSdFSdovSdWRSdVdLSdrSdxSdgSd6d9z:rRDI5G+VMGQMVOr8bSXSF
TLSH
T162025C522BFA0158F2F39A667F3352A6C637BC114D78AF5C91C4614908BE538CD62F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shortcuts_log.ini

Path C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini
Size 222B
SHA256 79d1631316cd79bc5127f745aa6707b4445f7d0432b685ef2c3ec3cf3a62ecba
MD5 4b8dc92a079f224935392f9b5a2dc051
SHA1 1027fc1b3e2e8ae78c60bfb25c5c9f87f9b3cae2
SHA512 ad0186cfc9df574e4a3c7c209b5dc3078fb86f6b1de0008bdede6768ec08d61b20f371d7b2d01dc50aa7d094b150db816358f03fa0d9135ce26d80d8886a1704
TLSH
T1D5D0C9320BF30208EE979691DDE8103EEB733559748ECA0CF087361E06F24408C97AA3
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox Privater Modus.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk
Size 1KB
SHA256 82744394c181433a6533f380a7013048e88c79055f580722c6997e067bff0b09
MD5 840625ba9cc1b95778c7a13cce4ad460
SHA1 4e31b1c3904d48cd767d93a237cd4496cecffd4f
SHA512 17de95523065c14c8018f2d333ead2251dce63a09e59794f821a9a68b040252dfb77f0b071ee33c7296b6418c9b1d0e73e25e17ed0f65b5cd48cfd3f90af1d98
TLSH
T16841CA1107FA0669F2F3A5716A72B6230733FC426638872D828D92C50936130C6AEFA3
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox Privater Modus.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk
Size 1KB
SHA256 0332c3dea5552ad54cb03d0499d81019fc16ceb3b148e0f28a71846918880de9
MD5 37e1ad319e3fefc58e17eb58f35472ca
SHA1 2207deb320cbd5a34759f8652f55dc416941af95
SHA512 d227bdb59d77af3123191e46267b16ff822b973105e2e8297c121c87d1c80025842ae713f5871861dace4482e71812263932061763ea73faff498e63ced9fc75
TLSH
T11741AA1507FA0669F2F3A5716A32B7224737FD42673D8B2D828D95C54833134C6AAF93
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
Size 974B
SHA256 4ec08cc315e6a23f2d9383b95cd594fe5b8e19dc3b8348096eed0131c24f1eec
MD5 1a7b4e0f3fe77aeb1ad96bf55adfd1c8
SHA1 63d36b1d6e879c9f682f6826e35aa22b822d2d12
SHA512 cc0675ca4e036ec1d3c471c1b5e878567456072bc6080f4f06da2b5aad9aea21ea407ef315f2be6339648c183b44b0d38acac9faa9d3bcaad31cb75195411a59
TLSH
T1B811661547FA0A9AF2F341713E7262629733FE0196790B2DC1CA21800977364D699F63
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
Size 1KB
SHA256 705e3b19e0243ac717d740fc6f2168977f51b3866e2947d5f17f375caf892bde
MD5 2e5233c3b7672c8c778f305d4dc3c893
SHA1 680a564f3f73d2fd41bc052caf988fee2670fb50
SHA512 5b66f24cd47bb19b19b57b5f2fb8601c27666f49f09ca46d317b5f29fd28f0f766248e8cddbcdb47617170e15621651f2a1f6dd2f1218316f0efa2a8accb27c9
TLSH
T19811761147EA1AAAF2F341713AB162635732BE02A6794B2DC08A22800977260D699F63
MD5 SHA1 SHA512 TLSH

Submit Download

setup-stub.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS812B3898\setup-stub.exe
Size 630KB
SHA256 8f8531c8b0cab1ce873721c175a6bab91caf4bfecf30cfc6190ebe5b729376fe
MD5 b8fc1047630245c65e07e9b8958d5f63
SHA1 3321a39f52310ddcdb4511f39b6895af5f4053c0
SHA512 736ee34e05ea05071423e89502a926649c339ff2205cda9eda649f5a656eb6473c995d88e4a0c7d9fa70149f10837757463718149bf664a9b8de9500749f383d
SSDEEP 6144:AT4DtrzU9JFTK9es0mitrE7xPCtkPOz3U6uW/ns1VIdCPiS9ff3lG/lLFdm:ATsUM9euYrE/OzhuW/sTIdCPi0fWLy
TLSH
T166D48D12B7C09932E57F4A3078B0D7266B3ABE81AF508A972315769C5F713819E3825F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessibleMarshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\AccessibleMarshal.dll
Size 31KB
SHA256 c38aa3c0fbdd72ac22db433de75b52eae024f4ce891c113c3a0fce34cb7e9450
MD5 7652c8d47b6097218010ede966705303
SHA1 34348c46acc6306f85b5bb3446d60a0410b38885
SHA512 86a99a2beaf939d174b8fd9d641861a102a9441321d497882234a86829656e5579e1a8d90eeff29e866a41d6e4a88bde686412489a7b4ceb67159c1d736cfe94
SSDEEP 384:LVNJGXaZ+nviTGeUMc255eVT2UtLIYiOkxPNyAmL46rA+6UheUzt:QXaZGvUGeq20T8YieL9rA+tt
TLSH
T149E21852FA808815D81E8434989F8AAA9B71FE045FA183D73364B31D1F723C27F756E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\CoreMessagingXP.dll
Size 1017KB
SHA256 00a4f20a39a24542024bc091b939f6f3852f6aa24e30286a3fc183531e165606
MD5 95c92253ea5d939eef09199709822127
SHA1 734d5c5b904ed48f6c33a551472957bcf28cb37c
SHA512 b0ef52e053866bdce3f5c27e9b0911a3de74f3a7cb38bd0f89cec76d6298a9a4802e73d46a69517f9e8494e55206aa7b19bff7a2d38ca5d0fb31051eed7db8f0
SSDEEP 12288:Mtl2DdkYB2Zme5NY1RZq3SzFJeb8HzroHCpstWcLObI6DPsb8UsAC:6gdP4meM1Rlwb839pwWrDlUsL
TLSH
T109252C6F6FA84097D17AC27E85BB8A8AF2F1B8531B3187CB0451426D3F27BE45979310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationDirLayout.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\InstallationDirLayout.dll
Size 21KB
SHA256 7eb9e3d0861dae61774e36df9ba8b2af3221a26bb3d1b784f37796b42fd2f709
MD5 03d1d076034511af479df471fe711f13
SHA1 053f5dbb7e0325d99bf813cfa716e20846a3e111
SHA512 b51524eda22523216e98c2e9ac7ac599aaff61f7b33797ed4f20f9a81da5913662f3ca3ebafcadce1af9d1e6e8e3ef7bdc98ea7321eb4796888efc98df77cd71
SSDEEP 384:Q5mbN3TCFn2deeeZj92UtLIYiOkxPNyAmL46rA+6oLGkdP:OWSN3j98YieL9rA+/3P
TLSH
T185A27E67CAA44C05ED174A70B8E44A27BA75BB511BD0C1D72319C1050FB23C27BBD2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InputStateManager.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\Microsoft.InputStateManager.dll
Size 445KB
SHA256 0445c8d2f062462924ade3f2c5b66143f9e837e3e69e2012a07681ad555356e4
MD5 a984d5f1013048ae828b30291350ede5
SHA1 764056263e1c027bb1b26517799a21fe8838a029
SHA512 0e78f31f1a993d94f683f75046d898dda25165df74db50154732959c68c7e6d292ea10cdfe915a980bcd4984274f9c8fb2509fe7541fbe771c2612697ced2beb
SSDEEP 6144:O5YXfO3nTzqL57bBXW5uwjq949FYlhsiaWivdnZYgMz10AmYBG+TcT2gW6TVCS:ECfOXk5FPwj04LiaHVnZWz10AmzdTVCS
TLSH
T154A44B7BEBA844A0D176D13C85A78A07F2B2745907329BCB42A0926D1F3BFE45D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\Microsoft.Internal.FrameworkUdk.dll
Size 909KB
SHA256 b31013f23a1cb8129e2c57c0746116e819c24950c07b539a549abfa08f4acbfa
MD5 8f8233b067763b969406a4fa6cf3decf
SHA1 05e343f78f0dfff5939acfa7486257345c8df71b
SHA512 21f65a9da2f38b4b9628d3c145082f8794f24dba84fb238bdaf9de52a4dfebec85da0a7fbd0229d20acdfcf46738b993adc796511b04b22107aaa016dda26366
SSDEEP 6144:bq2pdSEZxDjmUlfp04mtVkookZea4u2IUWB8Yi+c0p20GHs667I7IK/ECQ23YP:lWYdjm9VkookZ4TT+cHH6OIK1yP
TLSH
T14B15741BEE6991E0C4BAD03D9192622FF8B170A68B7057C3D6515A1F1F32FE4A93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Composition.OSSupport.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\Microsoft.UI.Composition.OSSupport.dll
Size 65KB
SHA256 a80774593ec2af30718099e318c12c5ba40476af9d2b07154713645c043e88f9
MD5 1de9aec5e5c2e6d5b1f894b50aa2d8d1
SHA1 a39b5724a873be28873900ea989f97dfd5cee8c1
SHA512 3543a03752f691fe5bf9621adb648e1714d5806997bc40781be81cfa255e21e14773e3312092f883165811bb289e737f1e4e3711fff1fe4df4bbd68ba538213f
SSDEEP 768:+sDumj6nznhIpkTVgSj5GshnjI41gQFPva4/tGrYvFQPO59z0Cp:+cum2n7hIpk5Bsshnj9gQFPS47a4z0Cp
TLSH
T1E7637C85A59820EAF577117DC4568F09E8B4B26263406BFF03A0C2BD1F93BC5A53EF94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Input.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\Microsoft.UI.Input.dll
Size 1.5MB
SHA256 7e24fb014303d387c140de4fedd4c65d079a2b0dd6ddde01135972b887a8e403
MD5 ba63de01d78434c734e25baf0cb316bc
SHA1 7babd4c44eaa499d723c642bfdd7ddbcb5bc7c2e
SHA512 9c6f26c3f09dff946217876a65b0777390da595916c345d9c7cfd966247c62554a27888684a3a05a3a6e652e1c571f56d4f28ae57c9b4a20ad81740db881198c
SSDEEP 12288:s6Kfr16TzoQMNNAuJdPxZK3yKmwPjIukjtT4i3RHo25pQ4zLH+CXoqWwkbKOlVWo:AB6TePxZNKmKI9tp/jLNXoqWnbvxtXjL
TLSH
T16B752A2BAFE881A6D331A23DC0974E4AF2B174421B7166EB0165412E5F3BBF45D3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\Microsoft.UI.Windowing.Core.dll
Size 529KB
SHA256 ccc64f8f6b07c8e39ebaee6e51346d8214ae606a5e2a8fb402d955a5eee61f41
MD5 5b3ff10613a0a9677b27aa933ac165b0
SHA1 f254da435b9758710fc6e370b817e64bdd3e8274
SHA512 a20eaf71bd4ab718f28906e1f567eb252ea2e0da60e138800cda9ea9eda39dacf740a49dbe4818c515a32f0ed997d6ec07d6edd752994ccd6595efb5617aadc8
SSDEEP 6144:js4jY1PnSzURJG9m3+v6Vtcu5/gm0qV1OU4IkhNFSDm/RuZ2QlgP:QSY1PSw+5CcuOm0q/OUhUNKm/Ru+
TLSH
T175B44D6F6BA84492E22A613DD6978B0AF6F174125732CBCB0111D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\Microsoft.UI.Windowing.dll
Size 537KB
SHA256 de777fc7f88256dc3158138b5e267a151fda461a2ef71b24320ccac7cc5a3b75
MD5 a43ebd2823466d062844f1cba4878aa0
SHA1 07135e939dd53a392d9004c7155bda3d6754e12c
SHA512 1ca6429b74c156607254e9697d369d2792710fa2e5e762f60f572bdb56baea822463b9cae0299d41707037b6c9e3978ad8e0b707cdc270d5ed6e26a8d8bd0448
SSDEEP 6144:nlLJdDCMslOzqjXsvPueIP7mNq6CIRPDoxSTHXapklto2UInrMRAc65:lLJdDCrkqj3eIKFC6DokjaaBjck
TLSH
T15DC43B6EBBB44696D12A913DC6A78F06F3F0B8554731DBCB4161823D9F27BE8593A300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\application.ini
Size 899B
SHA256 05e2f540aa5aa6466a8a81eaa51258fcbc9096d5746d68afd6e475a0723edd3b
MD5 f7bf19a4616a574df72433394a22477a
SHA1 adae9f914c20819eb5e1fdfa848459d7d6c6b752
SHA512 53f9ed519b6b250b4b3b618c9e9bc1d04181bd62e9a52ebccf0db4d2bb6b9a2fdbf4883b272661a045d55f9aee42f4d0dff5d9d113bbd3c0090959f963c71510
TLSH
T1D31123F363616AEE4AC219FF70369AA11273592D1ADB381CD04572450B1731E066E7D8
MD5 SHA1 SHA512 TLSH

Submit Download

crashhelper.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\crashhelper.exe
Size 365KB
SHA256 1638f616e094c476c0e54539a96017f392509467fb4ea193faefbd1b2a38056c
MD5 c5355bd29ccfb90cb1dac6084fd751ef
SHA1 1682401dbe213296607ccf4db990ff8025b59c55
SHA512 a0b1c99baf305aa40da920940ed26ace52bc99a414ab6583ed22666fdd035aee3e97953668f213f15b042513487b60fbd47334ae38bce10df7773aa933f2adcd
SSDEEP 6144:tsgpqULbjbkm5p00LW+aMw/zZBrFKNFz6um:/plbHBp0ow/zZBrsWH
TLSH
T127846C23FA4554EEC45EC478835A4533AA7278CD0B21B6EF27980A742E5AEE47F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\crashreporter.exe
Size 3.6MB
SHA256 3c2c44d6cf61e8d9bac01b5b39e3ac988170fdf15663605dac6f71600c6a0571
MD5 094a9f98472df7068255fd77de9c17f4
SHA1 505782df2fddb156a85e55a9a830e511c8893b1f
SHA512 d66bb4096e3a586499890ba1d1b75ab7cae56f45c1aee0564ccdf2f9161700f4e4fe8ac2d8e62a88d50fcd52a8d4868109c778a243bb5732978a7a60620d2586
SSDEEP 49152:x5V3vQ5osKK9qv/RvKYxwiesdYgNfMruJF6DINImKmQaQmG6Nim0uhmnYi:5Q5otdvpSlga4KmfOZuhmYi
TLSH
T109062912E76216D9C069C074C3267323FB61F99D033036EB1E905F39AE65EE05E7AB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\default-browser-agent.exe
Size 33KB
SHA256 3206619fcb53a688fdc887b1193cd37cbbad3854ef3dc954cf9ae0590626d3c2
MD5 c3669f12e7e8dd176be19045dfc00005
SHA1 2df657bde126c9495710f00eee7ae777740761dd
SHA512 92dfd26fbc49d78bd97e50cf998ef26c5ada2310278b4961211b15840170016d5525bcb363daf238da8af263f73876fe642a4627924d03334330368c29b2304b
SSDEEP 768:o0NDYssHSyZhIkcHxfUSh8YieL9rA+8zy:oaDYszGhLmfUSS7ty
TLSH
T1C2E27C63D9D448D5FD16C13922A06637FA72BB020FA291DB675682180F707C16F7E3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\dependentlibs.list
Size 55B
SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
MD5 a515bc619743c790d426780ed4810105
SHA1 355dab227f0291b2c7f1945478eec7a4248578a0
SHA512 48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b
TLSH
T1C6900252006F40226145A5A1684D890C80186146DC9101901567260E16259C008D456D
MD5 SHA1 SHA512 TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\dxcompiler.dll
Size 23.2MB
SHA256 0f448b8c8951c33193e37f6c39bfac6b2a5e5617e66e8fb7a06bcf89de2f24f4
MD5 8797ca6b5d36382a96e68c3310d3088d
SHA1 729916e36fe1215322b5a5e48dea8bc390fd5df3
SHA512 05d58885d83af8d293dfa88d0e903f6c9ff85bc23ad49e82ed2ce42ffca692b7c2f18b27417ce4a1016061e27c120a7c33a3c32d15606af4e8da1056754f81ea
SSDEEP 196608:FLn8gE6byTF5lWua5oiVfMn6puhDpn5yMKr0C:FL8v6+TFvWuanOXhDKx
TLSH
T1D3374C123686946DC05AC878C3574B279A2870DB2F7679EFC1E482352F79EF81B39634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\firefox.VisualElementsManifest.xml
Size 557B
SHA256 3b25ae142729ed15f3a10ebce2621bfa07fda5e4d76850763987a064122f7ae6
MD5 0aa43576f0420593451b10ab3b7582ec
SHA1 b5f535932053591c7678faa1cd7cc3a7de680d0d
SHA512 6efb63c66f60e039cf99bfaf2e107c3c5ed4b6f319f3d5e4ef9316c1f26298b90d33c60b48b03699059d28b835fbc589417ac955fc45a2bc4c116a5200dfdc32
TLSH
T10FF0C0DCB058131017CA6A556523528FB10F11FB56D501DEB0DD80381B4AB4C442ABCC
MD5 SHA1 SHA512 TLSH

Submit Download

firefox.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\firefox.exe
Size 1.3MB
SHA256 59b449aeefab2bf68e7cc21fbf4b6ab54d11a441b4c107137cb9a14bea167453
MD5 5e76b2945c317c663b4ac3e6e13537a4
SHA1 9c9d372b1adc889d667378add65647f9091a9a95
SHA512 463fa0b76708a8434923e8b74e76ffec627d7f9bde25ed6b369dd89f7dc20962209eaaa51bb56a2ed563ebaebbfa958e25366013444a3e876c983eae5a550efd
SSDEEP 24576:3nGDarQe4nvKiKpIbYEXjSwpemIwpelfErmyFAeCHCFQl:3GDargCpOXjZpeapelsyyFFCHC0
TLSH
T19555CF43B34497F9E05AD6749A82D23364767D802F1165CB1BE43F6B3E31AC52B3B229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe.sig

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\firefox.exe.sig
Size 1KB
SHA256 278dac11a93666e4a3997a9f685d10ec97cb571ed6b96d9896a286971f89dd9c
MD5 4f904ec66ec47dac78efd7f5ac34c425
SHA1 70f3d80073bc9112c8cbffedaa17fbda28c6192c
SHA512 2212b30eaee0573c7a13efd25f2696e86adfe0bf6d077f61e2b9756caa6ba36fb90ddfd6f292924f33843e073d1c89aca0cd1e23f03eb8fe9a8a1339d898e756
TLSH
T1CC31A7B11BA5100036414E4262E8CF2D0FF267CAEC7148A6805997A13D96FA42887A6C
MD5 SHA1 SHA512 TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\freebl3.dll
Size 1.2MB
SHA256 9e821a395d7995cf022a3f3427db161c511c58f4c8c4c52effa00eb4a5d01425
MD5 4746bc155c01609c6ec3acb2bf110d1b
SHA1 46bbbb501a8fe8f3eecdc5d96b688055aac08e33
SHA512 598593f4d23ea50d2d6626080c122971fca12bb7f17b59b55a9ad12869b6eeda06a4c64dd4ae57204536235690c2983907a0fba57a7db0f62f0d7813a3776375
SSDEEP 24576:wuWHcXH/fp99XZnnnxnnPQYzWNNiEbfUUxvf+BSjBJNV/nvilUKM+hBZ9:JWHcXH/fp99XZnnnxnnPQYKXiEuBSDXY
TLSH
T1BB456D0BF2B647E0D067CD7C1396B623FA253C5D4B5136D357C886213AA1BD4B21AF8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\gkcodecs.dll
Size 10.6MB
SHA256 92f6ef7808256bacb650f268096d83cd5c771dc3c4003bca84d2e8c9df5b67a4
MD5 55153440429e6f8542b8f1c1591c5e6a
SHA1 35f215379f9edaf1f7e6cb6001d244aaa6e90fb5
SHA512 4b13637d9c5c079514ccf89492a3c9826a209a73a6e4fc6ad9e9a7f95d42896d2eb25fbcfef0b2b34a3e47512e60a692eaf985bc915b901e493beac78c6d04b0
SSDEEP 98304:gUK7xE80nNKu4M4/0+R8UrKECFqUqg9Snr72Pfxhq+QqPIi8s/1aOO9kMlY6XKlF:gUKqncu4/nr++ufxhqRVi8yd6a2RQZAu
TLSH
T131B66C4EF1A351A4D41BCCB8527EEA12BD18385EC718D6E777DA15243AE37C0AB29F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\lgpllibs.dll
Size 163KB
SHA256 09b3b1df0d2de83628ce45f5861b8ae818d8b3749709130be4471f956e4508b8
MD5 6b4bcd71d73a323acb838f372d2f33b4
SHA1 4f31e9661a1175ba5e8d4c74c1229b98d9914bc6
SHA512 e17a2e9314c76f32adaaa1159aaa0b3d0d2faee3ff9fe929ce2dd21c23408caeeaf44d8ac59669d991635546befb2e2b0fe0e20688ec400444bb1e7b5ca7034d
SSDEEP 3072:bUtaNDj5hM28rio9gWBLOxZ5FGFvqGMjcdseZBvWnr3S6q93EduDoxWWOx5Gp:bEODj5hM2Y9gWBwktdseZNWnr3S6q90L
TLSH
T126F38D26D984882AD43A4C758DB28E17A77E7C8007545ECF5BD45EA61F1ABC06BFB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\libEGL.dll
Size 59KB
SHA256 077330005ade604560affbe2ae37f4d21e13f13e523134284690f61525bb7149
MD5 3af5a89e8ea83152e23cb9c1913b225b
SHA1 319d32435d61111262e6db3eae079471d05b2cc9
SHA512 c817940e963bfbe2673fe4ec244bbb73830711f85b28cfcc26484ced18ea981694567455d80842cf27ca60e443d614a746cd44f6dca3514e1770275dde0a86e1
SSDEEP 768:5uZqPDiy2Kn/qM+3TxUumLUC0wsxBWufEHAB5/98YieL9rA+lV:4Z6r2Q/d+3FgqxBWuMHAD/e7A
TLSH
T17453F83BCD7AA433DE0D8DB4C9A3081AEEA5BD864BB2B0CF57644DE109946C4A77D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\libGLESv2.dll
Size 4.8MB
SHA256 533bddbf1ef3bff0a9adde81900198351ae1f6109c1bb4f406faf5c56564584e
MD5 8ccf237be038685bff7d27b7396a785c
SHA1 a6151ff92a8251979afdb8c78a4a7327df8086a3
SHA512 14a3d78278e9e5acd1cd2649e4ff8d11279c7f776e94cab14e7647721e2837d40217458c51e2ae1d05500e1696dd4d86ecb0105d0f8af53609976b7196c0c206
SSDEEP 49152:Lv1NhJ4VT4wb5VtvUm2M6byDrV0bNqGP8y3JsEPNP2AjJwkAuEFzML5GbHD/q8mp:pNhJ4Xb5LvUm2M6mZG5GifhIzM1+nXO
TLSH
T143367C13F29240AEC46DC279979BD223F636B8851715B2DF269843323FA67E02B7D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\maintenanceservice.exe
Size 269KB
SHA256 60b0d2761afaed922804b05973e6613849e91ad422ef0fc7026a3a7526432e47
MD5 17118e781102aadf4e8a188b32c94c15
SHA1 b0c57108e66c5fcd328cd6be4667ff94300926ac
SHA512 0af6b4000c0965f2db1ab420ffffddfbf46a7e7e979af77d14717806e3090d8385b496aecff261b545fe3b471e8792bba75ec3ee5fbf2c9bfc12b3fe3a9e5781
SSDEEP 6144:C5NOpjWqrSE+MfhyWlg9/U+yIZJwJEQgwjB3Y0:agpWqrV+Mq9/U+7Z1UO0
TLSH
T182448D2977E408F9ED6BC23CCDF28516EA7278554360E6DB03A489251F237D05E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\maintenanceservice_installer.exe
Size 183KB
SHA256 20b3a4851f2f85f2437a38ab65dee0618310e4bc9586b68bc7651d76baae956d
MD5 d6997c8bf04c921950fde3823f876054
SHA1 1f338b079b037b748ff3f0cdc0479b88f2afb496
SHA512 077cf8960b36ac9e7284d050c6872731af7ab41c2a9d8f907426557f7eb48e7afaf2ecf042fdaca963f6b4d8f617f3999f8bd63837a47f88c7f1ffc293dd9a54
SSDEEP 3072:yNRCywDw1DiJkuKUNRD5b3p90jem7y6tuU/RDObU7y4jem7y6tFA:yT4DteUjD519g9oU5DOY7y4j9M
TLSH
T1AB047D02BBE0D991F9B20A303C76DB365F31FC666E90874B6350B35CDD72381A96935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\marshal.dll
Size 497KB
SHA256 d00c3d3493b50688e2ef6cee5f9f05699950b7258ac6496bf48959eb2e4c9717
MD5 4d6091104fdaa454def1a6cb71cb625a
SHA1 668ceab7d06781b30d6afeccee835791667ebe8b
SHA512 5fa0986e8ad4888503702b9d29d03b5777c0a62d16320ab5959db63fb47de2ac8b4955cd0e8bc3eceff60b84022fa2251ef5a76ee3f7a38cd4da6046bb3b5dac
SSDEEP 12288:/QFOnIXiS/m+7FpMenWosalm9r/0jX/L/H:/fIx/maFpMValm9wD/H
TLSH
T181B4068F616104A3C57F5378B95F874DDBB1BA1103509BCF026072A99F5FBE42C7AA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavcodec.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\mozavcodec.dll
Size 3.8MB
SHA256 5d84568300a8e6609040e9c8401c56334805151b164e0286f9957a4b9c0c680a
MD5 ffbad8293125ebc2330b92fd5b32c85c
SHA1 9ff8df6c21ce16e0dd85ef970ad31bc5a62b378c
SHA512 5fefe05c9624a9064c9e731b04856daaee662d7a46e9ebf029644fea74144ce8658e6514bdbd223b46d995ed3b1f8d60f6c895722724e747106db9338ea38904
SSDEEP 49152:jRflVhtsLRNAxi13aIcDi+WZ3K0cqnHlCg7AIXGJFVbIBOB0jiCPMoIhLXkarHMH:jURNXaIcDi+WZK0cqHB7AJJFP0jyE
TLSH
T19716AF4EF0A34194C50BC9B4937BE722B924345DE71475E71B8A86247BA6BC0AF3DF48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozavutil.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\mozavutil.dll
Size 564KB
SHA256 96e213837913ceef677fd931ae35004b792f356652a0be68897f7b0218bcd59a
MD5 ea660a1fa3b613b672d678dfa1ef7ea8
SHA1 b790e76ed284372fa521504ae8b35056afc61362
SHA512 d641be68016229f745f0318379e1f61f4f46c6fa3aeaa2bd05075ad0e3cc092bfd6b0c16b0ed4d547ab3604e555c5e2b0beb41e38422ea83c91cf7bcd8395f75
SSDEEP 12288:Noy86na/2hPsBZgFMZfIg+Ko5PbwoCboTb+JP:NHnbPkZZfuc
TLSH
T1BFC45B16D6C2082BC4068575878B5558F2723443CB95BAEF379206293F28BE27E7EF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\mozglue.dll
Size 712KB
SHA256 7c2d230d6214eebe16b860c9a6e09109d4796261d23a40d1284a6e030c7ecfec
MD5 a00e749ed8c992627102875ad24c8263
SHA1 0439ddda2333f64ac6653f1e26c041880af8cdb5
SHA512 2a0fde4e96112853d7a78dd6c01ec2d3bd334ff1de39f49872f82663fdeb7bbbfd3ef07b0c0062f0e4f8b5f166f86ce837ca21f95a5a89b90851c9438f862eeb
SSDEEP 12288:EjUw/HcUyWLXa81FnVEf6gGVhDJkg/EwE+wYmjVlKRiOjrkvVV:EIKHc5Wba6FOf6gWJkg/ERYmjVlKRzrU
TLSH
T196F48C03F69A41F9E048D5395B9BD523FAB278450720B9DF0790562A3FA9BE0B77E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozinference.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\mozinference.dll
Size 3.2MB
SHA256 a7bb744ea07263eca66f92a097949de70b94dd13dbf91f32b14c7eed6606a3ea
MD5 055545a2547464f66ecf26807d39729e
SHA1 c4243cd377e611988b1dd09e55c5692835062ba3
SHA512 20d6dfee75c65f5f23b8fb65658a3067615e83f915f0fed6d02aa5a6783c120d39e220f301f74ba9cf97db0483ed9a1e49651a0a2e2920b80f996026a057551c
SSDEEP 49152:rrT+/0CqeQGx613HqrN8ovWUVc8mAlGUn/ukP3McCZWV+Wcx4clZG:rm/xoovBVc8mIROFWcxbl4
TLSH
T160F51817F69A4098C09AC1B8570AE673AA34BC4C563876DB9F448B113B76FA0FD7D324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozwer.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\mozwer.dll
Size 311KB
SHA256 6e6340bba7244fde2aaab8d393c9b298750096c406afe234a14533df69a822e7
MD5 e22a95b3d8e781cc04c6ee0f7ea9624d
SHA1 d1bd9b6e3f86388c6a71a233a4f7cf6654d15e8c
SHA512 ba32e5f958a7a28a8dd834579b90307ff095a60200f04afe7c54d13305f709af84ff49653607752e507b83eb89b27ab7a4e925447274fefecf466c6e4e792757
SSDEEP 3072:GD/touvoaICsOuX6PcV6PbzMWsi0hg9aCqLdP3doQt3JqMhEBhZN6pR1jONFMYjB:ONM6Pi6fqi0hBhttpJqMi7sWScE6
TLSH
T148646C16B59454B9E05BC03883678672A67378850B21A9FF23A443393FBAFE15F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\msvcp140_atomic_wait.dll
Size 47KB
SHA256 e7963645e0d1db08e300614d4c5fa7194bd8173e9ab7a5558859e6b232ed3241
MD5 23d24c039c2b4dc4ed855be0275e605c
SHA1 ec28606fc22642e8d0354459dc7b710f93306c40
SHA512 ceac73d3653bbbae3ab37729b136e67e3ef29a0625a251a22ed32a3fa9ffe999501b6ae1007cc9045ec39db438ec91308ac28c426d7c6b288e9c1161885b3c39
SSDEEP 768:7PMo5RIqKYwIgMhpLDQl4wFbRgU9VF9zUe4SoSS09zN:gOR+tMhNQl4wxR3dzl4SoSSczN
TLSH
T1CE238E89A7680082F9974A30C1A9E61BF979B7E247608ADF1362F54C0F937C5FA3471D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nmhproxy.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\nmhproxy.exe
Size 643KB
SHA256 b05b2269cb9ac17b690146f979eac7b393f4144c0cd8d3cecd2f1e3d695446a2
MD5 b9bad3203365e5caa96a384ee4d8e920
SHA1 d794d859989a5250a205f678f9c8a7f79177449d
SHA512 cf898ea4ee54a8935459f13ddc8a6881bb635fe303fedf7b43d1516c16b015ca10eab3d7f5ce9fe1e2184ca6fef40965d2ad964d80fff7306389f76e71c8c2d8
SSDEEP 12288:Smdsr1PUt7ZLzWaFeU9iyxOeOOD54QgIrFfFj:S4sr1PstJFeU91xOMdvtj
TLSH
T15AE43B13F64685DCDA1BC07D862681326636B48D47316AFB21896F3C3E67ED22E7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notificationserver.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\notificationserver.dll
Size 59KB
SHA256 89250d90df5d878f5915685fed44a1d6e1254082e39de573a94d8c75bdd7ce7d
MD5 5482c80455043aa23f6647a456b007bf
SHA1 ea73ff9c7ef128fb39fe721e6ee9cf0c8e812fa9
SHA512 b42f78937b9b345d303857be62f08795dccad208cada269dee9fc68274c7462f26745c5d55a449b18da7dcc232a29321e1feab0f567afb5b20a8d81f084a2a5a
SSDEEP 768:iAssHfCjDLETsdbrKXaqEYWjHgFrSszoqr78MK8YieL9rA+nM:bssHqDpd3KqDYWnsEC7nX7YM
TLSH
T1DC433B13A7950458F8E7D738A2B72E129636FD5E077091CF0381D22A2FB0BD0AB79795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\nss3.dll
Size 2.9MB
SHA256 0d8aab7437e8fc3a627fbf928a410133e90ef53b5cc47c71dd50242a291dade4
MD5 6bd2b65f079f53f4994d9d055c2261eb
SHA1 cacf376374fc6f20ed8598e1733c3f7e8c086ec7
SHA512 4da08bc970a4b663d81c2347528de25c3f4903030b653b92b12bea04c0dc5a2aaa1d5b28501c6408bede33cf3901839f85670f2656e626134f57e7a3711bc53c
SSDEEP 49152:x7pt3n91xcGiUewGAmD+zFibrt+Rf9ab8TdBc09r4wUHw6YHuAPEpdmiQhZap6U4:p33S7ZwGAE3b5+R+udBcGkDH2spXoEpe
TLSH
T198E57C13F69A10F8C429C175978B9323A9B2B4455B3866CF52844B163FE6FE03B3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omni.ja

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\omni.ja
Size 42.9MB
SHA256 e9a05183b4c721ae09c9223f7ac402c9e7a1e9aa2a307846f8abc002de39c3c3
MD5 8382d7d7ce8ce414686fa7738d1a4360
SHA1 1028939991f6fb2fbac72c7b3da2a7d5d20442bb
SHA512 c387fff6e4ac5b62c0dd2a3e331c9e060bd29ed8400373b35ee7b98e8c62b1384a1acd27e1c6d16a6fc7fd917cb10f6d91f26a78b413e0bbf1377b405d56943d
SSDEEP 393216:HqyB+znoZNhPiVSfi72NehghFBF5VMP1I:HqyB+znCNhiVSfiOeuBF5VMP1I
TLSH
T181A75C0977FB1172856370395F5F60C1B334800B2619EE587DDD83A86F8AA3886F6BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onnxruntime.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\onnxruntime.dll
Size 9.3MB
SHA256 96195343a322f3e9ef67ba4ff8b051c4d49fab849ee2e16cfbc1f9a880c03b73
MD5 d3511d90fdaa27f1084e74c1dea34e39
SHA1 11996c2a46416e322b7e2eff837a18253420ee11
SHA512 cb77099e0134011f55747d905441f034acdf084085dd7fca8a52a0a5b73d10ab612526bcbc3ee980619ef8b46e9ffa759cb14684612207411e1f06c7b1c89837
SSDEEP 98304:qXZX3zN4LzHGuBpr0xYwANFWRc1rTvSbxumndhRTzlt04/yQ:qJX3zN4LzHDQxYwAORivSbxNndjf/P
TLSH
T1CEA67E2A62A4029CD0BFC1BCCB579D13EBB1745A4339B5AB05E244912F67730EA7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pingsender.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\pingsender.exe
Size 79KB
SHA256 12eca4e367413d63828de9e7fb650baf5cac6c897ef3c60931e6c7946d2a99bd
MD5 f54126cc84b9656def5f28ac741ec548
SHA1 1cec2823860c68032f67096a00cc27f7275aeafe
SHA512 d0edbec33a06b74b8e903f0d6c3895c4f56d9184b860a573400b7670f0572e81d249ae5203dcbc664ba2d4b2d73b2a2773fb3e9c5306493bb7019417743779a8
SSDEEP 1536:xiDVkMM4PZw+aDSaweVazakiRn6dhmTx7o:AVk6Zw+aGeVd/h2mTxE
TLSH
T1A3837EDB595010EAE451C2F0E2E61313EB7A758D2B6662CF938483622F067D11FBD3E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\platform.ini
Size 167B
SHA256 cd9de5a6a2e51e0d1a73bd414809b70d51663dd3877aedea1a8713058be62560
MD5 03daa8afbb975d0e6358bfb7ea9f3fc9
SHA1 c2b1a6cb71886e379f48e96bdded42e1e57cd28a
SHA512 08121e63d5505ca1f82a927c8b35e3d9e5667798c370de5739d0ad5a7534d2c945b1c1dc9e26e2760c26abcf0d3ed9578a903737d204bdf9bb27ec80221d6e41
TLSH
T11FC08C77B470052C0240B8A321B88E425463CA890BDF801AF0A062928EB3216057B1F8
MD5 SHA1 SHA512 TLSH

Submit Download

plugin-container.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\plugin-container.exe
Size 171KB
SHA256 808c2f8753978d4aa1977b4629733778276ab81f24848c5d6f97105f16837f66
MD5 8c345a7c9c82ad2919116908f903e341
SHA1 0c24871dfe14ddc82363e7418698fe48cde4acb4
SHA512 e3e5da701b7fa0fb0352368a5504bb155d06d38e35c8b8a3b666beed3709aef58f2c87e86b9ebf72f758df167a5af290a507dc071d70f7012b390590f3e5d5ed
SSDEEP 3072:x40Z5/EsBBueBFowN7PgfTml1jo3bLUzVmclHp5wzVxU:x46/NnFfPuml1srw8cxshC
TLSH
T141047C13F95950F6E45DC8749B824222FEB2BC860B21A5DF27445EB01FA4BE4BB3D352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin-container.exe.sig

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\plugin-container.exe.sig
Size 1KB
SHA256 c3686079c0f2478ee6f22d3e58468a974b3fbc5d7f7243cf28fe25a30949feb6
MD5 404b15bfae5be9b8a0c65d18c2892982
SHA1 d4f56df5a10c0e10b7af67f7ac0b25ace2e36f3c
SHA512 d1aaf5068827a32bf565433f42381815132f78ddf40291bc47f38c5b04c4f894b5f6b7c22761fa8ca892f6479f059bf76ece797ae77de0423d28ce8207c187ae
TLSH
T1D131C6B56E65140126804F07B5F48E1F0FB353C6AD6284E2416487F03EB6FA02DD2A5C
MD5 SHA1 SHA512 TLSH

Submit Download

precomplete

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\precomplete
Size 2KB
SHA256 4b8869791715483597dbe59253f8a111550f674371b053722a2bd6fd360eba80
MD5 dff998da8c3b9f25277d52b11a2be41d
SHA1 3df70fc504ac09e4ccd569e51fb032da8a3da49a
SHA512 055ead1a34288d99a9f08fa5f97a41936a33c6d03ec2ce2d034b8262a69afa7f29d625e04a611d45a7890663fa0d2174b73c8476ea8bbd5d7038bd670a11193e
TLSH
T18F51628CD01EEE6178D651C884E35D8F3DAB02A6DC8EE6781ECB01443F935EF020DA29
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\private_browsing.VisualElementsManifest.xml
Size 559B
SHA256 9ea86a18d41112e25b17454044ac29b458f508d9814700a6f4c0f9370678f3ae
MD5 b499ede5c9228c742578086591193efe
SHA1 18e682ec73ed8fcea99893142fa8b08ee8a32b72
SHA512 b99ef0e9152da3bf6adac5fef67b44738ae7a2d1ef0041786a5700b8389acde7380f1bc9bf1402c7a356f1777aca7c2b05af5ee22b7297bc879fe2e6b9741f13
TLSH
T1C0F0C0ECB148220016DB7D756513D28BB20B10FB4AC811DEB1EF80341B4BB0C496EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

private_browsing.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\private_browsing.exe
Size 63KB
SHA256 c70351e8e77d8cf5a7cc97d1bc98a745654bf54c3232625bc5290cbe5f3d7b88
MD5 f28466464bda6383bb918ebd3dd50351
SHA1 ec225d476bc8259fc9403070f84c91919c13ab47
SHA512 3720599c7f27811a4885994ada635cac4d7f128f43c17de2382e7d549096cc2031ffffb797df826530f13f0b4735c1e30b8cf0e283aa72e07d892cad3bfa897f
SSDEEP 768:jgI6iqiWN2EdcEr5DWrXSHaJf8qffCPD2FliAut8UavrdR8YieL9rA+a53:jx3qiW3es5DWrC6JEqnCr2jEYxi7/
TLSH
T116536C42AAC01489E426B53490913E199D76BD155F6382C743F3B73D0E7A3C37BB62B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

removed-files

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\removed-files
Size 16B
SHA256 52523da24287c4d459131c2e4818a713a732765e06e9bbba1cf353888ba34f9f
MD5 fefbfac37461bd30e05f5befaa1f7705
SHA1 74f9024662db06184e645cab76bfecb0e6897545
SHA512 874d6bdef28dea531c858443810d0b026a3a5667e0b9985bce84b7c5ab63d06a015487bd1da2a914d28af7b6568335b1927f9fb9656715947929cd6671ccc4b7
MD5 SHA1 SHA512

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\core\softokn3.dll
Size 359KB
SHA256 db14430b8d0dd108933df2293f5f51e14b3d23ec93511621deb8e9dc54e46641
MD5 05f4eaadcdbd3e744150b0d9c31d6f23
SHA1 3814299fa47dc5890014817d9937e37fb0f4dbf6
SHA512 3243fafb4c82886d3672f13fb14edf10418ca8f8e9b82174eb91ac26cb1be679b925b937f72b7f9d941aed91cb2b052ed9ee6fb510aac9401177b03d2cc03abc
SSDEEP 6144:6PexXLLbmQ3ATjGf9LLQFOO3Gkxnp1ozszX6z4G9UEKEbEo9p/0Es:6PeNdAHiQFjMiqz40UEKEbER
TLSH
T184744B03F69191A9D815C4B452A75732B5B3B8950370BDCF53289B6A2FA0FD0BB3C798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5F7A7C9\setup.exe
Size 1.0MB
SHA256 b9ebbc7ecce185de2e2ab4654394a8a43032e23886963eb29572a08692ccb8a9
MD5 40061a813bec411d5cbb65909874624a
SHA1 6e0d99cab99039e0fb9c32528d0db15d9b795095
SHA512 28825d54757576acfec9156dd129f5fb812da0462e124617bbd5fad146d01128ca6b6d6bc5e6d83c83eb25c5599f60eac8b69dae642ab36e8a1ae8d70b4c0334
SSDEEP 12288:fT1UjD58hPBp9euP+bnEPeqSjwSoFWKtsm45q:fTPl9hmbEPeqSjfoF1tT45q
TLSH
T1A0254A41B790D822D4AE493078F5D7162B39BDD2BF61C6B7332AB38C4E717509A6831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\AccessControl.dll
Size 21KB
SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
MD5 eb7a540d0d2e28f6bf524d2cdbe0f478
SHA1 76204991c60913cffeba5595033c4f79e1e89bd8
SHA512 947132d07f7875dc99fbe8a87757f6efee0a8c6271f8a3bac6747f9f4f60ed7e203e28a588db8c55ee898ba8f3dcf640f6562c49c45d6c6d8fdbe2d2309b9984
SSDEEP 384:8fX/qSSu13X9dGY+M47iw93L/pvDGFtart8E9VFK4imkGu6m328t1:8fXSz8X9MCqRDGFo+EA6D8z
TLSH
T1B9A25B968BF059F0F8B38E3531B45D1A4D7A7B5319F0C49F6226CA484B80746ADB83B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\ApplicationID.dll
Size 55KB
SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
MD5 fdc0338e6faeaf6f7c271982e103473b
SHA1 9a41f7932abe8be7e32c6371f085cf14de355d00
SHA512 a766eef11db4c94b1445d1cd70cf1d3b6141d6b3973562e9fa8d81c79195886b884dbc9b9f6952f8a6e8619534a6bf2d615d539d2cace9c8843dc19415051cc0
SSDEEP 768:oY+N1V9Ek9B/3I2IIk85ZLa342QpIK0+KE1zRBoSLDGFo+EAM:oY+LpI2IIk85Fs+LNRBo1oyM
TLSH
T167438C10BA80D473C556983970E8DA225E7E7D122BF090D37FBA83694F617D0B67E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServicesHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\ServicesHelper.dll
Size 14KB
SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
MD5 b9e8c2212ac8dae4b0eaf97c048529fa
SHA1 331d172323480b0518abdb0cc9e256dc7f46c357
SHA512 d93aa032e27c8268a4f6883711cf41f7ee2b5d33673a26d78db24456f2c548af39b7b98ed4b4737245c278d524fffb3e4bf708b6815dc866acd371427ff6be96
SSDEEP 192:UIHxGS7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHR5tHPk6NM:UR4vDGFtart8E9VFK4i/9kSM
TLSH
T148622BBB86A06C51DD668D3231988E2ABE7577456B90C0F7532AC1504BC1F8376FC2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellLink.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\ShellLink.dll
Size 14KB
SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
MD5 fa94d120efb029b43217c66bbc8c650c
SHA1 1fcf2d76adf69b403b7400681ac91d50ed20385f
SHA512 07ed0771d5bbb651ea7421a5f6b08fa234f9cc041315d9360a7135ba12180064fc99a27725385a8ecd3ceb25bed5c00de169f7dabb3ccf6e987f45254dff8158
SSDEEP 192:46J7JQCdiaR+7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRqt8kzN0eM2s:LJ7JQG2vDGFtart8E9VFK4ictvU2s
TLSH
T177623A6AC7A1EC90DC2BCD3730D4B9376A71AB8156A184EB576CC54047827873EFC0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\components.ini
Size 44B
SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
MD5 c9b5d86a9a0f014293b24a0922837564
SHA1 3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a
SHA512 790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62
MD5 SHA1 SHA512

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\components.ini
Size 638B
SHA256 de822477bd396df2d1eb2d4f1754a40157c9442360f5bf4a1ff7df4a4027737b
MD5 0dff227e179e32d279f672174d629e35
SHA1 589c182639875de5264a52784b67bdcc06e03b6b
SHA512 2c55484c3c7f6805215432dd1b1b0e8fd73ecd9bc475f6e79767f20f057eeac47b3a2ec3b60eba5a2472fb6c010e1463fe108c9baa0dbb08abd6277ed713f8c5
TLSH
T177F04F131AE91519F6F6EB09FAB451759B36BC061C3EC90E91D0090E09F5A809877FFB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\extensions.ini
Size 402B
SHA256 4e3f2413784c7e3666c667eb2c35084154536edf9335d96f24d18a1d17590066
MD5 2ed482117f3148d08f92e22bed69f5ed
SHA1 2ac31eb3b05d73d23bd946d6b7c9a7a461d1bdf4
SHA512 3b84ec3c4aa29e70b428535d9f34577d69d6373772d96ebae71b27a73cbe6d7a82de1163c71280e7b0ca906f4fc3b995f3626988776b6116a2d81a5e82153d93
TLSH
T10EE046072AF94018A59AF608EBF480B1D7387009180EC80ED0E14E0F8CE9681422BFDF
MD5 SHA1 SHA512 TLSH

Submit Download

liteFirewallW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\liteFirewallW.dll
Size 92KB
SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
MD5 f5a3005a46e051b8d9eb5e2be7802f7e
SHA1 4fae43843bf6210d5d98683b50705824877a7d9a
SHA512 4993fcfe6669dd1e3621ca50e35aad750bc6c89838abf94da4303c5a31e958b3d3bc2cf70c268590c8cd5cdbc90f015ffa37cf98548c2b54ea8171b63a3bfa0c
SSDEEP 1536:tNiXc1jND/x0LI7W2kG3Crh520Hsy7xxz4J:79N7iPrh52ssyXe
TLSH
T1BE939E21B6E0C472C88BA9395464D7B25BBFB5316AE089877B68077D5F303C0977938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\nsExec.dll
Size 17KB
SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
MD5 0e584c7120bd474c616013c58d51dc6b
SHA1 0bc980892341b52985d92fb3d8fbb6be77951935
SHA512 aa3a471b3f33c3ffdbe1b1e3c1e5d04367bcab3c16049396a8dd12c5a8317e4b153761f74f39b756dd4fb1806aedc4f1bb38bfbc12f16480eed3fd3087a0d157
SSDEEP 384:qDrvAxnJGernNQZGdH7vDGFtart8E9VFK4ibEge:qDrkoernAGRLDGFo+EAxe
TLSH
T12C824CB685C02C55D85A8D353098AD1B6BB5B7462BA184F3533FC19057C1BC3FABC2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\nsJSON.dll
Size 33KB
SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
MD5 e832077eaee06f3b2ac9a8d2e7264567
SHA1 decbc329257c9c7fb67d3c449b4c5dfc1f87471f
SHA512 c1bada98c52ee2318d23c48fe202380eb42c5e1f18226cdc017f264c8c34f548bfe4d9b6eef13caae69ba321a71b199431b249fdec65f8bb1c386810932ccf6a
SSDEEP 768:QoZ1ZnhrTfldqk7Yyy94RxOcVQJrTuDGFo+EAe2:Vpi52vOcqlTvoyr
TLSH
T191F25D96977058F0F97B99B670B06E232E7EBA05295085EBC33785145A50B43BB3C337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\options.ini
Size 1KB
SHA256 e5e9ddfee7c287ae7776ea1e828bd2bbb1bc0ca37e280823ff9a0fef63409339
MD5 46c85587498164dc61a44f2dbdcc09c8
SHA1 4f2dd531e6581fa18ae9444cb4132163abfeef19
SHA512 cae2abd26f9abac7ffa3b515a7add5e7fc4fb700602a372e8a92ece27001e17824ab7507eae6d14f93333e7c89246042d956cc33d5923228f337c35c4efeb256
TLSH
T1FD2115532BE98225F5FAB718FFB58130AB357C86583DC91E82D10A4E49F52804167BFB
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nsdEEDC.tmp\shortcuts.ini
Size 678B
SHA256 9273d5dc8f4b67cd6b00594c7cf5797b9d0a54e74bc2e69842ef5cccd6e6c172
MD5 9e6226dd038710cfc4c1511e135c44e9
SHA1 ab2a21af55f761cc1f3ca48ed057544cfda4f85b
SHA512 16df411ea26273e1dd6fbb3e703647cf159ba060367f85f5ada5cdbcc0add61d970eadd4e61d3c1949fcd6dc2f3b787528ec16737539d590ef08f4cdb0efc1a0
TLSH
T135014F033EF91014F0AAB61DFBF5417597397449191DC90ED0E14A0E48F56804527BDF
MD5 SHA1 SHA512 TLSH

Submit Download

CertCheck.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\CertCheck.dll
Size 15KB
SHA256 d56e2407b6050d669e94e452f1a54ee1859a1751179a3f1e2b4253305a23a0cf
MD5 aed814f87d862cb5ceb00fd0a6d60fb8
SHA1 097418e9181e6b4d95f40410cd4dd962fe27c41b
SHA512 69593e12efe0736ada5a9e1b6f3c238a6434b88068361dfd2f7bb3e50addbf9b56ccaee30321362ce085ea700fbab03bae8494bba8c72e9e9983d3faa569b3d2
SSDEEP 192:xVLS6KjE7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRN/M/X+6Yt7onk:a6zvDGFtart8E9VFK4iz/T5mk
TLSH
T1C8625BB6C780AC95DD77493530D8D9167B34B7265B40C5E3662EC0908B81FC2BAFC29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
TLSH
T1C8439D31759189B3D59AC97230E49F2F7E7E7A011BE488D35B7984001F60BE1B27E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InetBgDL.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\InetBgDL.dll
Size 95KB
SHA256 3921dec014fadd1de7f3a36606ac95882a17cb96df38a5424e58531a169f825b
MD5 af9e2d138cf17b8ff4d4b8df7fddaefa
SHA1 539afa302bc5cae7022896048cb7a0f3f2ab6907
SHA512 631ad8bbb9eea42b230f2729714874c921677c4be91ac0b35ab9e7751613045eb249f8a0dd1d5ce06bf2cd544507795836dcbf42be79f01a71333570ea27c840
SSDEEP 1536:E5Hdo/N8Hu9M3hd2OR4svcXn9vh1cWir+VrdukX+ePTGnutmfsbLj7lkjDnblYWA:E+Y0M3hd2ORk9vXyk3Piuz37lIDblLA
TLSH
T156A37C52B5D0D831E9BE193E2874DA649F3E7A11CF909CEB235406694F302C1DF74AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
TLSH
T169622BBBC6606C12DC668E7670E49D2B7A71B7916F9080E7132AC15047C1783BAFD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebBrowser.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\WebBrowser.dll
Size 103KB
SHA256 281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec
MD5 b53cd4ad8562a11f3f7c7890a09df27a
SHA1 db66b94670d47c7ee436c2a5481110ed4f013a48
SHA512 bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81
SSDEEP 3072:XfSOjAHW06ovW1UOBnuW/0L8ieV1QWZxs1VIdfyb:KOz3U6uW/ns1VIdY
TLSH
T15BA37C40B5D1C871EABE49381460DA715F3F7910DEA08DAB3768567D8F703C29E28A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgstub.jpg

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\bgstub.jpg
Size 66KB
SHA256 4b7e441d51b790ee1c0baff19e4e968392a937877dfa8b84e74464f5ba7a4cf4
MD5 c55f15ceedc724d6c6e15d1daf96b698
SHA1 af6bf647d708ca7a5377925d521097b67a269ae8
SHA512 05ccf388364d511ce3da14c9013b9a9128c16044713f19bb752c053ec7ec25cb3b47600b23ae6de7c8a62d817fa03ea4bd9c95fa6abfb0714bb3dcbba56de75d
SSDEEP 1536:UJFE//uqpq16OXAXZYiQiCIiuVpkH3KQO82ztmIdQutOC91d043:UrE+0q4xPCnuVWH3KQGzgGjd7
TLSH
T11863F1FE63813543F4272A721BA9E653ACAB3EB5D823ADDA42D54E8443127B1B50D08C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\config.ini
Size 160B
SHA256 dd3b0366606bc8f619f1512b41b863795865eddc5fdca79282002c35c501cf1d
MD5 0ed160f1ac401449648d3d7a9be283be
SHA1 aed0749c541f84f37e91f429f73098d506f42de9
SHA512 2f0d0a82df8c3cfd2dca257609224b7c73676eb0ebeb869e67d170e02d93d51659748632c4bc7a573c2beec21ffd93ce6fbc9a78d031510fb6c30d0edb9b3a5f
TLSH
T1BDC080857884F0F838077145C39D5901CDC3090532CFC41047C04F07A2D1F0420D9882
MD5 SHA1 SHA512 TLSH

Submit Download

installing.html

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\installing.html
Size 1KB
SHA256 4d1f52b24e1e460e3b2aef617b3a68b4aad062c016cb5d6fbd9660813f3fca91
MD5 167904d9f340244fbb3a303f50e7dd04
SHA1 cd9d3708e321c33713f2e6982b81f4e3a65b6bfd
SHA512 b5b436bbdb972ec0da20cdc70706825a497f0da1df1ccf05decfdb0b931571d1db2fad955b07e0c592ac0e8ec7794563442d8f22b7a98cc7f86da64229b136d9
TLSH
T18A21F0045CF8096551409A107DF1B50F4A42DB47820F6E90BDBD95E40FC368CCCDBAA8
MD5 SHA1 SHA512 TLSH

Submit Download

installing.js

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\installing.js
Size 2KB
SHA256 254bd34973522c900b2c480186dd26d8885f448023dfba244af88726998c36c6
MD5 5d880454577d033215b9153e956ff37b
SHA1 d609bfabf790817e2624e538c1ccae8143731ec7
SHA512 13b27295b9707b9f0d9f41be3af67dd49b7bcf79b3e58b065e6bc55f7eb59f9c8f79fff2126355748c14a16a9f1a884c2040bb196630e39cb51f9b4d1642ffe3
TLSH
T103410323344614304CA36AD6A39F6684B22580123C66F914DDBF8589AFE2D5FC53E7CF
MD5 SHA1 SHA512 TLSH

Submit Download

installing_page.css

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\installing_page.css
Size 1KB
SHA256 43c38801c1746880625f97eee3fe37fe94d1300adf812bfe26e47b094b87523b
MD5 6582e207592b60a995b4510cf959eb03
SHA1 08afdebde481b653e04f89bedad0cba6c8dbd999
SHA512 0a5a5ce944b89f552a38300674c44cc9de4920e87c2aa2c3c63bbceedff1d80ab35ab31274bfa89e0acc518470f466a2d67d483147f2ca8061d68b770e2ebe48
TLSH
T10931445697F01A30B057E9043665FB60731D407A6A1FD778AEE4B058EB4657388237C9
MD5 SHA1 SHA512 TLSH

Submit Download

stub_common.css

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\stub_common.css
Size 684B
SHA256 4d9495b6f0e18331659993b79440e414a6e607fcdaeacbc7477e0683cc0fa98b
MD5 544b51f11ad19df720669478d28f129d
SHA1 d238b604fd3fa37dfd552eacdc6aacc474fcddad
SHA512 bbbb0f31839316c51464cfd225166145f968ce38995dc2748df5402b7e109ff6119d65b6774fc4738638ad4c9d89776516b00ab5a700097d9d74e1824a11dc5e
TLSH
T1C501C015269667087089CAA677B39714F30F0471636A8A54E5F874A14E8B10580B3BD5
MD5 SHA1 SHA512 TLSH

Submit Download

stub_common.js

Path C:\Users\Admin\AppData\Local\Temp\nseDA4F.tmp\stub_common.js
Size 815B
SHA256 dab39cbae31848cce0b5c43fddd2674fef4dea5b7a3dacdaabdc78a8a931817e
MD5 efce3dce0165b3f6551db47e5c0ac8d6
SHA1 1e15f6bb688e3d645092c1aa5ee3136f8de65312
SHA512 cec12da07f52822aaed340b1b751153efa43e5c3d747fa39f03bb2800bf53e9416020d654a818a6088acb2cf5581714433d818537f04af150e6bfb6861c03988
TLSH
T1AE01F13E3884033944A7ABA4776F5343F125C04372AA9D56EDBC2191ADD6C26D433FE9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\nynhg9hy.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 0e0c377f1bd0818ee6f3d6edab397d3050931360fad17b3a5b66cc2589b13dc5
MD5 80bd641cf38210cf454b7e236376a0b3
SHA1 1ec14907868979767bcc50bac5bfa560645dfb4b
SHA512 35b6e399746037ed9697365d284bf5c5702265f3290cfb6b33db2177b9ad31c93c0bf12898a2477936c9dab539603f8c34e792009817428018651a0974257948
TLSH
T15A21A084F764963AE049C33EDC4697214B306014E88FBF21306D701C9E5A76A36DE83C
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\glean\db\data.safe.tmp
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\glean\db\data.safe.tmp
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 6dd3392e9fbbc97e748d65b26ce81a8c9e5295abc5f3dd1c35d7619e5bf4a3de
MD5 1727ac9c57e121c40b238401e4e32649
SHA1 5023fb0dc17bfcd97aa094ea0a70f2b3c47c8b2c
SHA512 950969c75bf34b944dc8208b301d7da2922ae27a99aaaa13063e55629ffd08c1e424fcf55d2cce3fa581a8ccc32aa6cd576449dbdf96bc34487d8bd0bcea68b3
TLSH
T17F1159114BFA09A7F2F741713EB162635732FE0267294B2DC18A22800D77264D699F63
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 962B
SHA256 73da6084a7ab6a4906c08af8f9c8c098c2ad1983851ce8890f6e461eb2dc8286
MD5 15c97d6480f8026c146308dfc21c6bb2
SHA1 12dbefb3b87c5aac3f288d09b93ab4502c8e94b0
SHA512 fadb4eeb33732fed02ee84bb44449a5ffdb881c1c945fb93b45a6f7be7afb66d9dd6195eb8a327f9f7c37d1df700bc4df42ba8ab1e826d22681ec418420b30c2
TLSH
T10C11661147FA0A96F2F341713E71A3639633FE0156394B2DC1CA21800973364D699F63
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3932-137-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3932-469-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4632-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4632-87-0x0000000000400000-0x0000000000446000-memory.dmp

Download