6001832efcbd72550f2260533a2da63a28265979af180b60d80cfbbf917d99f6

Analysis

user interaction
yes
max time kernel
163s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Oyz1Gvn8.html
Size 3KB
Sample260910-evtxmsztat
SHA256 6001832efcbd72550f2260533a2da63a28265979af180b60d80cfbbf917d99f6
MD5 bee2ecad568cca3bbba7dcb9f3ced48b
SHA1 927852d4fc04ce2952187f54179d0f651be57179
SHA512 b759f1f046960c2c9bc20b1f874fadaf76ec9caa7321fcb0bcaf5ffe7b7a7828a84ca4b7d3a0030c08aa20966fe2394fc071b5b1b5de0ae938043b8a2b96ca1b
TLSH
T1656142038840C8279165A3347AD2F508CA68D183D35DADA9B29E119E5AC7FA1C7F72F5
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2036	IDriver.exe

Loads dropped DLL 21 IoCs

pid	Process
1356	MsiExec.exe
1356	MsiExec.exe
1356	MsiExec.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
2036	IDriver.exe
1356	MsiExec.exe
1356	MsiExec.exe
1356	MsiExec.exe
1356	MsiExec.exe
1356	MsiExec.exe
1356	MsiExec.exe
1356	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
131	2224	msiexec.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
88	api.gofile.io
89	api.gofile.io
90	api.gofile.io
92	api.gofile.io

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\objpscnv.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Boris FX, Inc\Downloaded Installations\{FD21283E-7491-4560-9B35-3DBA22521C5E}\BCCAE700Win.msi	BCCAE701Win_CS5.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ID	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ISRT.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\iGdiCnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IScrCnv.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver2.exe	msiexec.exe
File created	C:\Program Files (x86)\Boris FX, Inc\Downloaded Installations\{FD21283E-7491-4560-9B35-3DBA22521C5E}\BCCAE700Win.msi	BCCAE701Win_CS5.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\_ISRES1033.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IUserCnv.dll	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{790EC520-CCCC-4810-A0FE-061633204CE4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI962B.tmp	msiexec.exe
File created	C:\Windows\Installer\e5992d0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5992d0.msi	msiexec.exe
File created	C:\Windows\Installer\e5992d1.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\e5992d1.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCCAE701Win_CS5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDriver.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{78994A88-276B-4F15-BAF6-FB4CD3F9E223}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{9C0BA3C1-2B67-45EB-BF69-BED9658D28D2}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5CDB19F-95A7-4DFC-A65F-D01CB17BDAA2}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{52305DC4-1B79-41CE-90D0-0B84AF096018}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2F653E7D-0010-4751-BD83-92EA472E641F}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FCE0140-F00D-4466-80E3-07992FEB65C9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}\1.0\FLAGS\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8F814097-CE38-493E-BFCC-CB3599998D05}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B8E161B8-9B5A-4DD2-9B93-1F558A7FAD69}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppId	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2BF7C25E-DA1D-4E34-8242-5DCDD9F18245}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{82C616BD-E4A4-4556-B775-8449E75E191E}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8919C3B9-E8FF-43A7-86B3-FA09E0201947}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B8E161B8-9B5A-4DD2-9B93-1F558A7FAD69}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FD889BE8-F7D6-415F-84B6-B17CCCB29A6D}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{293B98DF-5B92-42D2-A409-FA9A0C0E1E68}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{AEED9AE1-AE66-4065-A274-DC7BBFEE354B}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{28A18BE3-9194-44B1-A5BB-7245C5D344B2}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65CD17AF-CCEE-4CD6-B304-A3BD48237B67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC892E93-C765-4E5B-AE0C-BA2476655532}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{06FC2BEF-62EE-4724-8FEB-64C73B939BA3}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD549FD5-6590-4F67-B60E-E7422ADAF1B3}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{92559C8C-F9C8-4BE7-BA9D-26AFEA5E4389}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ISInstallDriver.InstallDriver.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}\1.0\0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F6EE9F4A-2D30-4A78-8720-90B6ED68763B}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB7CE443-5294-42A0-8BC6-C3584A0E9E5E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFB69D-57BB-4963-AFA8-09FA9614E1CB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30350C57-F1F4-4ADC-9ECB-FA66FD8A3BE6}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B3ECF2E-3F2C-42BB-BA02-049A739F12C0}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0AA8743E-3991-438C-8631-3C8C169399E6}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2BF7C25E-DA1D-4E34-8242-5DCDD9F18245}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11997148-EAEB-42A2-B3CC-B7C5A7199107}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACC4DEAB-2CEA-4869-A2F7-5C7E5A6730B5}\ = "ISetupBasicFeature"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAFAF854-1BF8-4DE1-8F96-752839422F73}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{738891D7-3A18-4839-A5E7-EFD2E7DE002A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ABC466D7-B7AD-4872-8C72-ED582EF279CE}\ = "ISetupBasicFeatureStateEvents"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{AF21D406-D32C-4413-81CE-B9AF860E1361}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CBF197F-754C-4011-9019-1C632FD2897A}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3392A51F-A498-421A-A02A-6804C4270A21}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FB74205-04B5-4683-B5B5-492FCFDE9ADF}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D86AEAFD-A3AD-4F9D-BDA5-D70696A1FEAB}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9E8176B8-C130-49DA-AB56-F3378E54ADFD}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A10FDF47-9E29-401C-988C-A7A28434BCC2}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{06FC2BEF-62EE-4724-8FEB-64C73B939BA3}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBBC99EB-259B-4CD3-B167-3D75539D9E9C}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46E4AEB7-19C5-4A43-AD65-FF6859E43C2B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5886B1FD-4C9E-41DF-9098-9A1AB8F02AA9}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDF81340-0BD9-40B7-825C-29AEE7A64D4E}\TypeLib\ = "{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46715E70-0B7D-45BA-A447-AA0951073C78}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DAFAF854-1BF8-4DE1-8F96-752839422F73}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0AA8743E-3991-438C-8631-3C8C169399E6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39BB147B-55CC-424B-9B10-C5052E5939B9}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EE02E74A-C645-4C6E-BD1C-4099501A9F52}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FC8AC65-FD78-4439-90A2-291175681698}\ = "ISetupSharedFiles"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42814CB5-E1A5-4F07-9D38-18CE4C2AB4A2}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}\1.0\0\win32\ = "C:\\PROGRA~2\\COMMON~1\\INSTAL~1\\Driver\\10\\INTEL3~1\\IDriver.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{9C0BA3C1-2B67-45EB-BF69-BED9658D28D2}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{184C53CC-8D6D-4A58-8108-90167678B84C}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3392A51F-A498-421A-A02A-6804C4270A21}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{6FCE0140-F00D-4466-80E3-07992FEB65C9}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED5FE20-27D3-4F38-8DF3-93659038C417}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5416	NOTEPAD.EXE
3356	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	msiexec.exe
2224	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	firefox.exe
Token: SeDebugPrivilege	5040	firefox.exe
Token: SeDebugPrivilege	5040	firefox.exe
Token: SeShutdownPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeIncreaseQuotaPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeSecurityPrivilege	2224	msiexec.exe
Token: SeCreateTokenPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeAssignPrimaryTokenPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeLockMemoryPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeIncreaseQuotaPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeMachineAccountPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeTcbPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeSecurityPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeTakeOwnershipPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeLoadDriverPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeSystemProfilePrivilege	5988	BCCAE701Win_CS5.exe
Token: SeSystemtimePrivilege	5988	BCCAE701Win_CS5.exe
Token: SeProfSingleProcessPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeIncBasePriorityPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeCreatePagefilePrivilege	5988	BCCAE701Win_CS5.exe
Token: SeCreatePermanentPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeBackupPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeRestorePrivilege	5988	BCCAE701Win_CS5.exe
Token: SeShutdownPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeDebugPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeAuditPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeSystemEnvironmentPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeChangeNotifyPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeRemoteShutdownPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeUndockPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeSyncAgentPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeEnableDelegationPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeManageVolumePrivilege	5988	BCCAE701Win_CS5.exe
Token: SeImpersonatePrivilege	5988	BCCAE701Win_CS5.exe
Token: SeCreateGlobalPrivilege	5988	BCCAE701Win_CS5.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeShutdownPrivilege	372	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	372	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	372	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	372	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	372	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	372	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	372	MSIEXEC.EXE
Token: SeTcbPrivilege	372	MSIEXEC.EXE
Token: SeSecurityPrivilege	372	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	372	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	372	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	372	MSIEXEC.EXE
Token: SeSystemtimePrivilege	372	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	372	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	372	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	372	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	372	MSIEXEC.EXE
Token: SeBackupPrivilege	372	MSIEXEC.EXE
Token: SeRestorePrivilege	372	MSIEXEC.EXE
Token: SeShutdownPrivilege	372	MSIEXEC.EXE
Token: SeDebugPrivilege	372	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5988	BCCAE701Win_CS5.exe
372	MSIEXEC.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe
5040	firefox.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 5040	4860	firefox.exe	87
PID 4860 wrote to memory of 5040	4860	firefox.exe	87
PID 5040 wrote to memory of 3060	5040	firefox.exe	88
PID 5040 wrote to memory of 3060	5040	firefox.exe	88
PID 5040 wrote to memory of 3060	5040	firefox.exe	88
PID 5040 wrote to memory of 1144	5040	firefox.exe	89
PID 5040 wrote to memory of 1144	5040	firefox.exe	89
PID 5040 wrote to memory of 1144	5040	firefox.exe	89
PID 5040 wrote to memory of 1144	5040	firefox.exe	89
PID 5040 wrote to memory of 2444	5040	firefox.exe	90
PID 5040 wrote to memory of 2444	5040	firefox.exe	90
PID 5040 wrote to memory of 2444	5040	firefox.exe	90
PID 5040 wrote to memory of 2444	5040	firefox.exe	90
PID 5040 wrote to memory of 1812	5040	firefox.exe	91
PID 5040 wrote to memory of 1812	5040	firefox.exe	91
PID 5040 wrote to memory of 1812	5040	firefox.exe	91
PID 5040 wrote to memory of 3476	5040	firefox.exe	92
PID 5040 wrote to memory of 3476	5040	firefox.exe	92
PID 5040 wrote to memory of 3476	5040	firefox.exe	92
PID 5040 wrote to memory of 3476	5040	firefox.exe	92
PID 5040 wrote to memory of 4256	5040	firefox.exe	93
PID 5040 wrote to memory of 4256	5040	firefox.exe	93
PID 5040 wrote to memory of 4256	5040	firefox.exe	93
PID 5040 wrote to memory of 4256	5040	firefox.exe	93
PID 5040 wrote to memory of 396	5040	firefox.exe	94
PID 5040 wrote to memory of 396	5040	firefox.exe	94
PID 5040 wrote to memory of 396	5040	firefox.exe	94
PID 5040 wrote to memory of 396	5040	firefox.exe	94
PID 5040 wrote to memory of 2848	5040	firefox.exe	95
PID 5040 wrote to memory of 2848	5040	firefox.exe	95
PID 5040 wrote to memory of 2848	5040	firefox.exe	95
PID 5040 wrote to memory of 2848	5040	firefox.exe	95
PID 5040 wrote to memory of 1816	5040	firefox.exe	96
PID 5040 wrote to memory of 1816	5040	firefox.exe	96
PID 5040 wrote to memory of 1816	5040	firefox.exe	96
PID 5040 wrote to memory of 1816	5040	firefox.exe	96
PID 5040 wrote to memory of 4856	5040	firefox.exe	111
PID 5040 wrote to memory of 4856	5040	firefox.exe	111
PID 5040 wrote to memory of 4856	5040	firefox.exe	111
PID 5040 wrote to memory of 4856	5040	firefox.exe	111
PID 5040 wrote to memory of 5856	5040	firefox.exe	114
PID 5040 wrote to memory of 5856	5040	firefox.exe	114
PID 5040 wrote to memory of 5856	5040	firefox.exe	114
PID 5040 wrote to memory of 5856	5040	firefox.exe	114
PID 5988 wrote to memory of 372	5988	BCCAE701Win_CS5.exe	125
PID 2224 wrote to memory of 1356	2224	msiexec.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Oyz1Gvn8.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Oyz1Gvn8.html
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {c9067d06-4f95-4fb4-a073-a7b4c29444ed} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {4d6db844-1584-496b-a515-e29f471aea7e} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27276 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {c8dd778a-a781-4e4b-83de-293d5581c600} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27276 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {11aeecfe-aa36-4c3b-bfe3-71a1147c2d16} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 888 -prefsLen 34775 -prefMapHandle 1240 -prefMapSize 270279 -jsInitHandle 3140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2676 -initialChannelId {fa040bea-1b9f-4ab5-bc8e-35131a84b8df} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4900 -prefsLen 35012 -prefMapHandle 4896 -prefMapSize 270279 -ipcHandle 4840 -initialChannelId {0bef1c90-cb4b-4946-ab44-e7ce4d2bee89} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32952 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {eef2d931-7db5-4c8e-b79d-07e9445a52a7} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32952 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {1a7f9512-c29a-4c59-a769-bf633d985c17} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32952 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {9429f085-71f9-4456-a6f4-7b279b4122fa} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5960 -prefsLen 36718 -prefMapHandle 6264 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6304 -initialChannelId {8c806bb2-5b65-456f-b168-b21139b3ef11} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6264 -prefsLen 36718 -prefMapHandle 6156 -prefMapSize 270279 -jsInitHandle 6212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6092 -initialChannelId {385611a5-233c-4452-b94f-620af836cadf} -parentPid 5040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5512

C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\BCCAE701Win_CS5.exe
"C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\BCCAE701Win_CS5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "C:\Program Files (x86)\Boris FX, Inc\Downloaded Installations\{FD21283E-7491-4560-9B35-3DBA22521C5E}\BCCAE700Win.msi" /L* C:\Users\Admin\AppData\Local\Temp\BCCAE7InstallLog.txt SETUPEXEDIR="C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:372

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\CRACK\install.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5416

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 95652EA51E3E631CDD1332C5AC465A94 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1356
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1900
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6E3824A51521F1AAB2A2D05B7AD0AB4B
  2⤵
  PID:3928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A65A6F6D2A30932FF19F3997857C9BCC E Global\MSI0000
  2⤵
  PID:4200

C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2036

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\CRACK\install.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5992d4.rbs

Path C:\Config.Msi\e5992d4.rbs
Size 51KB
SHA256 8378e8e171f687dcebf15bdcd3ea78847772ed874cdbbf98f16c4f9851423775
MD5 b476306d7bc8e79bc2b9541330574b63
SHA1 c9686dbdfd010aa0f382ceaf216d2def3e5e6b98
SHA512 e328fefe456065e40c1942351d021f410894bdbca4b0d2efdfcf7d649dd7edcfe12f7d9650e3fcee3fd9a367c85e0e3303e8e3c3be5eef2ef3c31d801465b469
SSDEEP 1536:X3cc5WWMmRJu/xtispnu/ZmAxq3A+ESAaYmAiBLH6slri97HkvvXRTisHBczayH4:HcGWWMmRJu/xtispnu/ZRxqw+E1aYRi/
TLSH
T1AB339F86684212EAE905033013637D686ADFB42E0DC6D60D052AE5EF5D7BBFDE841FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5992d6.rbs

Path C:\Config.Msi\e5992d6.rbs
Size 442KB
SHA256 06fdd507d11783e99196601fbd3f8d0de21e95c59a96a39986be6e9cc177cc59
MD5 2a6649173ef92606267a24b92da478c2
SHA1 cb7878b2510280fe29cf9409b199d57f2c202b5b
SHA512 b9cfa90a5ba9eaeae86b31d01d81bc6f6d41aeb3c3d80e2099f01d222dab94c0738686c95475ebabe988c694b39e7210f27410c25a42d47a172d1a229b550e9f
SSDEEP 6144:gf8e4vcDkMCBCviXk6Kod3It/tCTuSdIwqCV0t:y4If
TLSH
T13BA4C8278B1EE2D0AA16BEF173C06C4873557F06A6D6425331ECA756C8D3C6E21F8A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDriver.exe

Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
Size 744KB
SHA256 e398cb00486e49de8f3dfa278cce395fd4c02a4795fb61b2e73653cbcdb75eea
MD5 5e73b8fb3ddbba8565d9c4705c14ba3d
SHA1 ffce57f44298ebfea425f42696227054d5c5cd0b
SHA512 8bc0261c0a92d9caa76ec90583ea01a4ab743a084f0e4e0f6debdaf0bfdc252d95d6929e3ec66be5ad95ae593685fb50da2b9be0a1d457b8acb7c137e3cdab79
SSDEEP 12288:IpTvNjWfXBINq82NwfN2LdV98XErOKqfref8/2W:IpTvtqXBIw826fNOl8XECKqP
TLSH
T1FFF47C3A36A1C13AC61205319E69C7E4EEB9FD368D2305073B847B1D3E75996CD13A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISRT.DLL

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ISRT.DLL
Size 400KB
SHA256 dce057a7eeea266a1cbc630505d08eed458284b30e25dab4f7c7ae142835b660
MD5 22ee6fa7a604a5e7298acd95bc7c80f7
SHA1 31e6809bd9929b594d087b7cac8558b8117484c9
SHA512 3e13f7e2032228f1d6a84566b49cb5aa6845ee9bcc83d350eba382492db19c3cdeac8ab75ea285b1b1f285c373fc829a2c9571b0b64e22c216470875458a56a5
SSDEEP 6144:9IZCfF6pJASHMvaFs5voS7ClvGDwkfAZWl90gH1JOh3ImQyXqhDj7OnQ:9IZCfF3SHOaFs5voS6kIWl99Rmr0jcQ
TLSH
T177948D02F6F2C07BC29F0130FB696BE5A7FC57551C719887DF940A1E1B72986D226A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IScrCnv.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IScrCnv.dll
Size 256KB
SHA256 02a761aa2c05fe1b3f95284557bd55ac9d6a82ab72a18de70dac1820c6f03751
MD5 926a5bfcf2173b178a4d080d47efbf2a
SHA1 c24a62c2b26e12879a9c013c3d0b8054828e8ac5
SHA512 4a5fe52827068e9852e65a5570c105b183fa35dba342e715850ada258cb440b033dcc47047b59eac83401d9690979f661c77200fae0ea69a9944558b5265b1b3
SSDEEP 3072:WkP5rmx6IWkNtEXrSHGWJil+2b4+gRCP726+681eunwb4NohWGFVbotBJuJ4mcB2:QNaocU/U26+6duI4qhpFVAT1DETzjf
TLSH
T15D447C123DA8C936C7DE0B31FEAA6F28E2F9E2119DE588431F584E1DDE37905C92151E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IUserCnv.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IUserCnv.dll
Size 168KB
SHA256 820a03405d4a7a0ddc20f7be3c79266d1bbc6a7778c791c6de260ac9c51e77ec
MD5 07096e9f097b44b3c24c15a6724de866
SHA1 a4cd6828554e295d0758ef2e35e35b0569afd44a
SHA512 2f3e7ce2b0d51100b2a61b5b0d4a3b5434095a411f92360818a0e3926d6203e85ec2b54d4a5ac01405aeaf1a570dc1d5a088f1654210d7cdbacae5b566092e6e
SSDEEP 3072:GDB8FBASHiVRVwPs2DMaEJ39aHwJdMcnS:K84SCR8sMfExQub
TLSH
T160F3AF033EE1C87AD28A017F5D292F3AB3FBA127CEE058934B184A5DAE71951CD27156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISRES1033.DLL

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\_ISRES1033.DLL
Size 528KB
SHA256 14d8231e716b79e66d2ef1a971f74ff6244af0c89717977e7131e7cf7de2072b
MD5 8f287079d126ad3b2487d704844ce497
SHA1 c42c7b96714750c497ae9bc2a4d4c64141ea7058
SHA512 f56e39852fb60ce94a7040644c5368cb15110b56e5b774edea14c4f2286d2087191276b4af860b320fe875f72f8df5214457ea12a7152e419b8848e578ffff54
SSDEEP 6144:yhs4dodcOaOdFGkdlbskkkkknffCp5CrRKluat+HLPKq:Is4dodfaOdIQxq4LH
TLSH
T1E2B48200E6E5804EF2FEAB749CB21BA54EA13C569B3486FFBA95711D1471AD09C31F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iGdiCnv.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\iGdiCnv.dll
Size 176KB
SHA256 aa86d6fa20a0be2d41aec48a47b5d94f316acb4c4b7d8c6054d9988b27d108d7
MD5 771bd5c8b8f219f5d9af0cb1a406a399
SHA1 1ded7e1eaeba25961aca784174f05755f6770a31
SHA512 5c843ddfee3a808bf4ba189243cda130557d7527416636a00586818ffa73b941fb0a34024966fb3316f6c913e73f2615927606258288dbb821736aeb645cfd39
SSDEEP 3072:pG+GfAt5bvgO8THIu7LU0P1UmaVHhXRuh8BZmBcbvcJMmcpLaSYE:pG+GJ7L1aVHCyA+HzYE
TLSH
T16904AE0475E0843BC39F0136BABB2F75F7FC65118F9909AB97084E5E1EB5986DA23207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

objpscnv.dll

Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\objpscnv.dll
Size 32KB
SHA256 dbe6d61dbd15894aa2a304d36c2a6ec0e8e3e78438df35124ba2bd58df9e6e6a
MD5 3f84ebead9f9dbbaeb27bac67e585c17
SHA1 87ec9c20274e6b48e75fd0e3e12df0bdc263d1dd
SHA512 4a64a0d9fc37f96a045652c67f48fdc943ccd4b84c6c81dc9571ed20105ca7e8bbbe4a46c849d9fa6d9e27c04254de85a044e1a8e8be7ba1ac0bb4f2e6ed8fe9
SSDEEP 192:XnlX6cRWMxG4RMG180GoxMOSkF7qoMC7znk4Al:33B5MczZqoMqgB
TLSH
T14AE25412EEB699B1E68A40353C761577663D3C3148D9E073ABC2DD4E287D2E3856EB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 5d984c49280abbf4e5a49ec3a9d4f9ce126ecd51c1c4be21609cd51fbbf5003b
MD5 898566a50d87f3e4dea0732d9b35ca05
SHA1 769672f161abb6a4f4101b0973a6bb7a587a9f11
SHA512 1f6a1a432a7a80c2729d25d2231fe2ed7036e24ef53b9075c15049f7add34a9346b56d6298e750e8e40c9f08104ca21f416a63c536573c537d643f988026a42b
SSDEEP 384:HkCjiO024Y+DL84KKDL849B7SOEAd9KVRaAcP+AWRMAhEC:EzZY+DL8lKDL8CB7S/AmVAf+hRMw
TLSH
T1A4729E395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

873c0802-5858-43e8-8721-5831ab36d212.zip

Path C:\Users\Admin\AppData\Local\Temp\873c0802-5858-43e8-8721-5831ab36d212.zip
Size 3.8MB
SHA256 0f26d820b4bbdca26b02e76d6c0647153ad7e1839222f15361fd2ee9016c8e25
MD5 332c58722feca58fafa164c84a73e390
SHA1 35a1dcd7a2c185c3d3cdd600fbe744a544d43b51
SHA512 50624e3b7b2e378e97551e2c725457ee9e4e45464ebf4f6161a23789cfd91dbf5435b28bf00e88ec468de5e47357ca5639d54a2bc935beee12aeed8e316dbbec
SSDEEP 49152:DnLfvscTV1Dwlboyf+y95De31Jmaj4qj9aSy+lEbmZ+s6FWsxcOeqsRTY+AgHIk3:7LfGo3MU1J7gQlEbW+sMxvUBHIkVJ
TLSH
T11106E07DDE5C1F0DC9CF83BBC50D2FC2984C4FAE8054A9EB6A6A9971DCA31E61B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCCAE7InstallLog.txt

Path C:\Users\Admin\AppData\Local\Temp\BCCAE7InstallLog.txt
Size 12KB
SHA256 1ddd6605887dce950a8d46c49e270f07d6eeddf812e9cf29dcb22523d23ad751
MD5 c34e7c4ce10dd4915f7d0eea3080baf8
SHA1 e78636a3334a363161e551daa337acec918d54b6
SHA512 28f2441fa61e068ec1ab136263c490b70eb5fef00803f99a191f92d32d9898aad9f091660e5e4bf3bb87e024e25f7258d86113b84db3ba973850e56fe1d6f595
SSDEEP 96:WATMWCMlM9YHCYAYOYHcY2YuMMMMJMbMM6MGzrJLM4P2U7fIMM/MWMVkhdMVYVs0:GQK+hnlrtmhCbTE3EcJqnB5KI
TLSH
T15A42C81267F84245F1F7DB83DABB0025CA337CDAD83AD65D6282410D05F2A46A968F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DLL_{A31D5812-F0AA-4AFA-B584-C2C4AC141518}.ini

Path C:\Users\Admin\AppData\Local\Temp\DLL_{A31D5812-F0AA-4AFA-B584-C2C4AC141518}.ini
Size 547B
SHA256 e5b34c6cc94c56f7d98611eeba76fbbec2615240cb2560850b89496e82c6496b
MD5 9b2e14d166302846d6a66086ce2ad6f7
SHA1 2ba019845651ec471ecf6413c8ed7357e0a5633b
SHA512 0e49b897826ecbeef8cc396921bd996ca3a9da14612e8967970732c4f8e309093e6828ef82292d489c712b40b2bd3a4aaab86c30146a0ebd3c418c18ec3383dd
TLSH
T103F0F647E94693ABC0A54466CAA01A9C2894096E37941650D64427DCC7F6B6FC37439D
MD5 SHA1 SHA512 TLSH

Submit Download

DLL_{A31D5812-F0AA-4AFA-B584-C2C4AC141518}.ini

Path C:\Users\Admin\AppData\Local\Temp\DLL_{A31D5812-F0AA-4AFA-B584-C2C4AC141518}.ini
Size 547B
SHA256 d54453d1cd4cd67ee22a922ca664a7cbc8883e8f419473f144fa51b22945e129
MD5 173536bb47d0f5b1a57ad7cc286357db
SHA1 15808dd80d2e2b52ddda19f972afe8a5585c1789
SHA512 54ed36dfc0275b35e8661a84304aff077a54cfa02b8020f3efa388437c8902c47fa48d392a0477ff17159fa6628870a1508adb8c7c64866a63c56ade2c61b14a
TLSH
T182F04647E94693ABC0A54066CAA01A9C2884052E37841650D64427DCC7F6B6FC33439D
MD5 SHA1 SHA512 TLSH

Submit Download

MSIA399.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA399.tmp
Size 108KB
SHA256 58170b73eb7a56c8aa2b2750b6baeecbb316bd44958722b11ae88806c0740663
MD5 da8c72f50e85a24dbe9addfe868d80c7
SHA1 ff2c45e20e93697ef795f0fdf0411c3d6d48bcf7
SHA512 2a185c33b63805a08cf0e032cae86773e8e73b7b40028bcc956fe6f3acfec51f62ef695e405740d4ce2fda9d9b6fc58ce7456230325349a6bb3e53d4cb1ae638
SSDEEP 1536:YiKtbjfNw4MMz6XEAWDooVSx1KMqATT7zh1XPNjAIbJeLcj5xzy:9QvNw4MMzxx2LHA4JeLcVxzy
TLSH
T1ADB38D06BAE1C0B3D3C9413E5966CB39E7BF6A709DA158C3AB640B8E6D71940D637243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA9C5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA9C5.tmp
Size 48KB
SHA256 e773262195ea40982cdb692ef53f65966b3e11c7cad9920098e95710b808f1fc
MD5 5709867e0e18a48e01c7581b6b64db5f
SHA1 0b8d5d44e84d47cbef4ffd8cea1c20ed86828705
SHA512 62d83d705e068811e8ca1858223aeea7234e1a3ecae092d1d2f9cee3d91aea12dfaee168ff172ffdfc891b5cd41d24b0aee7592811f1a6da713236c7f670a68c
SSDEEP 768:1L4sJXAY9TKSrl7DtrF0rahOCGJSmSvpESrc2c:18Y9TfrxVP8JzKVc
TLSH
T177236C11B5D280F7C38B467225A65F1B8B3F3A640FF20483DFB55E9A2D369D1923A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAA24.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIAA24.tmp
Size 212KB
SHA256 fcbb310b111c96909bc4dc3fa0cd6cd2e020e18b7321052cb5adebe6bc713e61
MD5 aef7174dd755cfbe952ebd20c01be057
SHA1 c8c4813a6d28a5d6c0786808c9d97df833f0e1e8
SHA512 8ba31732aa815a7a1171da82e13719ed3fae8d2081e4e21bffb44184c05e42740eed09b237c590f8ec81297359e0fc2541afecd9939ae7232116f7af9e701b33
SSDEEP 3072:cOTZdNubZd1mfKK86FfqKTpB7ASMDJjcUfYu1OPx8DYbp:cK/ur4j8wF5A5177OPxMyp
TLSH
T10624EE02B44C885FE2311A383EC97ED1E5AFB1375F9B4507DFED9D921972E1A828B805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegistryDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\RegistryDLL.dll
Size 42KB
SHA256 6ffa08d02669d0966e6c35847298eeeae20209e38134f8da81706f7476f2269c
MD5 af0e1969b8827b78892f3e129e5ea480
SHA1 416005ec20a1293c89dec3cd85c4546488041d38
SHA512 4eb924f4eea33dbcaec00667b246216b562a793fb4916c953f3bffd8674ba855751bf9c72ef59faaed803966c98333ad30fab3634030abdf52afc41cbea68fd5
SSDEEP 384:X3fxTCmJ7L0wbTHhvBUiETEOcjjSoodL0a0IXYZGyR6VkgDlYE8dhvJjpcdFKufo:ZOmOFTEOcXS2/ZMVR5YrhoFKEABIORn
TLSH
T1CD136B117850C473C10AA479506AC6619EAF6D122BF1A0877FBA17BE5F326D0A73F34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SerialDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\SerialDLL.dll
Size 141KB
SHA256 54c3d67758af1409f2d5a364c282222e878b80af07d77eb43985e9700a1754b6
MD5 3303c2ae8f958c782ccc6ad4ba760239
SHA1 c00490c53107c19dc46c3602cc848f97db478feb
SHA512 675bea3b21dbe81cf479c2873a1a33d5eb7f814ae06a4e734eae3032b489724d863f001eff477d889d04aedb43bdf391e928e4e518a90c0d74ba10782c019fd1
SSDEEP 1536:zarObjxh3vdpYvOpWRC+cZNxA/Yw7LSEDCkpXzx5nWF64YCKLhAgZ5Ri:zarObjzfdzz+cZ0j7+wXBrLhAgZ5Ri
TLSH
T1DDE38B113682C832E65F263E8421C7755B2BB8358FA49AC7BF840B7D9F342D2DE75246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\_is7E7E\0x0409.ini
Size 5KB
SHA256 43160e278e4302e378e754149c6394bc51d1969a7941687cfcc6c00b25151282
MD5 6c87581375d4e4789761b9833c2a1b4d
SHA1 310395fde36429b08b615831152399db7e4267a2
SHA512 ff499900dd9ae154825bb1b8a65f7c53367a4a75131ce1aa08ffbd0bbaae4d8e3a062455d74b8dce41fc89648bed33fb2ecd95e7ba57098caa7ca652f176dfd2
SSDEEP 96:VXoB2MQrl8/T3INLfRtMx76U0KOFWgVl2Uub0QAg80SbtEBapIx0KsLK3C0cTBAj:JFYT3wLfRA0viBAvCSEB9yC
TLSH
T1ADB1538F8B9A837E2951031AB15F2661F326926D5323D1B7B1EF00587283D18937B6E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISScript10.Msi

Path C:\Users\Admin\AppData\Local\Temp\_is7E7E\ISScript10.Msi
Size 876KB
SHA256 76e1acaa795755548fccf95bf99590febb1474d70ef107c4ff589df77d65df4a
MD5 fad28d1e21acffd6f031e4e3c4a92b19
SHA1 9797fe366535cb3e32b7337cc5645496e8459a00
SHA512 39c0e19a059074f5a6ac659f4ff794c9c388b159c6952ecdd027eb0eab10784b9507f142a58782801439a1b36b625c300878f011e1c886b2eda7163454a22b71
SSDEEP 12288:L7T5Dy+j1Xla1usJQWmJMoOHfxuP2eZROQoYfe8B8b3flJH7jGPYUfAm68laciRd:L7l2+j1c1usJQWhfEP2AjyflJbYbdFa
TLSH
T1D315F11ABC82023BC687033516175B725FBB8C544F224A078779F39D2DB7AE872B65E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\_is7E7E\_ISMSIDEL.INI
Size 224B
SHA256 d9f1b0a2473ece04e9993edb1dc04f4f6fc4ff1f45abb3dcb8b6988e47f94f66
MD5 2ff34b834386fe7059a397bb831d4845
SHA1 4b8f29dc86a8c74be11338e77503d912d448b772
SHA512 fe57b29056d820314db23287430d6e8406d39a4f8b713ead0aedc203d0003d06bf25e61b302395efe99784080a99b174df0cecae22140613a29b94fbda6c635a
TLSH
T12FD0A70086C3CF385480701B177B521CC3711C082E95A7728B60C80C27E0D1CF59620A
MD5 SHA1 SHA512 TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\_is7E7E\_ISMSIDEL.INI
Size 11B
SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
MD5 3fdd2635aa94921522af8186f3c3d736
SHA1 0fe63553e9f993c0cb2cb36b8cdcfba4f4a2650d
SHA512 ebdbeefbdc777937fce516a1cbd9af7c305fc242091d695ad919a27c98fac5b6b16b44130bdf97dbfd10561cce701180b1fbb303d848944c3b33b8a3c058653a
MD5 SHA1 SHA512

Submit Download

bcc7WinInstaller.bmp

Path C:\Users\Admin\AppData\Local\Temp\_is7E7E\bcc7WinInstaller.bmp
Size 383KB
SHA256 aae97f2c121156104d1c15132e34430960897893d16cfebff732df34a7c6c81e
MD5 0504752c5f4bf63c8e6ba644c5d86d4c
SHA1 cabee7b778d7e77c485210b50bd44df863e3d7b3
SHA512 f6393a72ce0c098a824d5a1025034d8bf451a2244350779d362854341c03e863fe6abf3f48256891e4368aa55e8d01ff3d1ea10dbf917f8c4d04b8429d1d625e
SSDEEP 768:Pgul2vQWyPI4OKBCAVSPUbmNAXJSpxmZL1pB1PUnEYqe+oJUzV8OFvkIHfk6e0T3:KDl4OKBC/EY1JUhhvpXxciVv
TLSH
T1FE847682D6771C93B37BD06C577F88D9F8EC6B311138CF9B539621B0A999FA5200924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsConfig.INI

Path C:\Users\Admin\AppData\Local\Temp\{A31D5812-F0AA-4AFA-B584-C2C4AC141518}\IsConfig.INI
Size 64B
SHA256 21a9be63265f62c1f890dcaccfc8e7409548e3a0c792d1281cb3c7906440a7f6
MD5 1e1f76d7af42510835035839536b6e9a
SHA1 6910cfa8de54acc427dc6e9c4eee649c1e6902b8
SHA512 2c8fcd5fb089826acdb785689422b76522d79deacadcf133fb5b6f6acbac08d99e4061caa1460575a40e6bf2f7ab18a27441564f27c11a78a4947f4325bbc194
TLSH
T105A0028E36C0F2786227F8A7ECAB00B81EBC3C01001218C71893AEC94D2022870CF9B2
MD5 SHA1 SHA512 TLSH

Submit Download

String1033.txt

Path C:\Users\Admin\AppData\Local\Temp\{A31D5812-F0AA-4AFA-B584-C2C4AC141518}\String1033.txt
Size 91KB
SHA256 efe0ef6c5d676625b9de35889df1e76ec841735ac4d279338e97ad2bbe2c9d8e
MD5 d927910aab17961388c1675b6b352a6e
SHA1 92e1fc5ac50579b402306a42f44bb3c97e8e61c0
SHA512 6313d207b60211d7d87e5ed68a7bf0934bd525971dfcf423d3f09c8ec6a7d7b1ebec1bff656968d1ba367e2cda8be0fd43e86f145eb5fe8882651c887e840528
SSDEEP 1536:trS8ISVvWA/z+wa3U4rP6wQvvOkyMJhce1VCL27pZI:t28PW9xZ7D
TLSH
T15F935652B7FA0118F6F37F90AEB951698E36BDE6AD3AD21D0140104E0AF1E40DA72773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.inx

Path C:\Users\Admin\AppData\Local\Temp\{A31D5812-F0AA-4AFA-B584-C2C4AC141518}\setup.inx
Size 236KB
SHA256 54bb48927090d183cfeaaa36eb658b79b8d76a643d266b285173427cf37cd213
MD5 2956777a780243c304c05dea4cb3441e
SHA1 3b793995e6dec9f09f0062ffa70c6be381cbbfff
SHA512 92a61a44f9a3034ac640c81ad244e8650d6400a32497a410e53998bc126cf7ebe804177409dc58c33dbe39742fbaf0e3f792ffb6de899cdc176840ca3e200b83
SSDEEP 3072:j4syf4YFs25N1RH4MO0fBURDzs+cCaOrDOCSFS4N34lA3Xb9dqSuHtrPlICyY4NH:j4syf4YFs02B3f/MnA2pY4NM5qnay
TLSH
T15634AFAC8DA50F8E73388ADAE837199039D5EC0DF1E55697A3B2C590CF394F940ED096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~7E7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\~7E7D.tmp
Size 2KB
SHA256 77d5cf35a9b6ab4d33d6b2dbf3136c073887b7cd8d496f2c1eb477a6bcad02ad
MD5 1f7956c2ba9da7ba05a4ec9d90cc10ab
SHA1 4253c1b86c73f6715730ffdbc249490a5d4718aa
SHA512 dde4ed1eb44b60082674776afefb7b17c3a67eaa8ae84a1fd75fd9da5efd7446b00af66e18c5ab95d4524f64850b5dfb09090772cdcfeed5329bbfb0ce33f6db
TLSH
T1B841EC1532BB09AC931B72A76EF717D73AD222940D063209F3444AE1DF99927033F2A5
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8ff1f6497069c3a602cf925ab2e7cd960306ec12ee400d47cb5373f1302a3eed
MD5 a9aa8eb2bdcbd70a9def180f7ad22f4f
SHA1 1a04eee50a4a6b3621747c42165654133877c750
SHA512 f5b72a6e3a531ec8422622fe5be346f7e0876420b89b91c5eedd964cf78bb2ae00c00bb5fa5eb8ede5ea2191ac27c4dcb3ab4c20ccea0889c56b0bb31b97555a
SSDEEP 192:MR1d66JozGzgCl6mc0dXPOv5zboSbqmyj7I:MPd66JozGzgC1jxgboSbqmyjU
TLSH
T1B9D1EE68FA28463BC408023BCDA61F910F36395BE84E7F26319C345D2D5629E7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 96KB
SHA256 d4bb2d9024d99afcc434aa995f0108a9df264d3b8a7658e4f788890130ec67d1
MD5 81f6b28351ab6a6a9e1bdfc894cb9f36
SHA1 1e4a5aa5dc5de33f1334ee259aae400a65e67673
SHA512 633948ac0860a39f9b056acd40d846192ccc75bf00cbb3c5b941a2dee5394544b8646eac36a4737d23b7d21987ff36cde3f1599d2275e2825ea79c58a6903345
SSDEEP 3072:l7GbfJLFTEJacP2AU6cCduak4HTN4+My7Y:l72fJLFTEJacP2AU6c2uak4HTN4+My7Y
TLSH
T127A30084EB1B403BEC1445BFB8951B282735F4654A599B0B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5d1d2b7fb64e17aded40824b755814d4b73b7c86bec7377edf2a0f56fd3e40c2
MD5 65e8b040ed96ba3cc6fe060dd5c8c498
SHA1 139f331b674040fc699cac2a2d6e18c1159cf0d6
SHA512 1f1231e9e83948ccdbac9188bdce3ea50daa11d9472b45f70dd9d37fe5751f4a1cc7b7aa42908f9ed5819912969d3bd14db7915c4ae9c039ab9168db6661ea9e
SSDEEP 192:xR1d66JozGzgCl6mc0dRPOv5zboPHZqmyjVcD:xPd66JozGzgC1jjgbo/Zqmyjy
TLSH
T113E1FFA8FA28863FC408127BCDA61F814F39395A984E7F25319C741C2D572DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 d1245ba9f3950d2d498ec8c91398687a18055ee97604cf420504e34133558dcc
MD5 fb284ef425b979b310dd2b74d39c8e5e
SHA1 2990047d5bd50b13594be0ca0d4321cc1fcbeb9f
SHA512 fb07f156c47b524090fa50d92f98186b83fccf6e327d34a9a1e8e5dcbdfdfa45d29fc4f918faa35a16e3b64410444188560e33b295e8893b0b629a3395086797
SSDEEP 1536:+74c3fpqY8vm6XHlaPdcAyHiMf0PVgeHz58yzTgqjj:+74cPwHvjXcP2AmXKVVH1Yej
TLSH
T172630245EB1A953FD82803BA9DD61B003F78F8895A1A2B67371C64386D873DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 cbbd764de79baa917116454d7d825b6ad73f5c74e5f7404e648b7c80d95d00a8
MD5 0753519aca18b4a515a1f9128e586ffa
SHA1 4db080770e618d203bfc4ae8be00b082fcb5af06
SHA512 217aaef1d11da8a6c4f1f79b6b56e6b6eb6f4d84e392aabf99e0b3002f8ef2ea5955f3020c2022f48585f65bd2483ae30e1522f68fc5ff5d2d103dd6d149e4d7
SSDEEP 384:GLCr/SL4Ozr9GcmhucYGtqAKqngsubkbC3PPd66JozGzgC1jlgboWqmyji:GL4Ur9Gcmhuc5XKqngsubkb+gEcFZ
TLSH
T1FFC20084FB2A953FC41512BBDCA50B402F79B88A58092F673A4D646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 066a8e9267f0bd09af2dde42b8456fe5fdd53d08238821662200068b7199cc0e
MD5 2e9fdf0d0744ef6b940c8b73f9a2c16e
SHA1 71262563adad4b7fa2a71abdaeef64572f2f4d90
SHA512 6b2959e1ba2b7d84590d69d065d1aa3f291ebe6b92bf02289a5366d0fe5b139979855a48bb7bd5b7938cbf655c7b0c21876cff8d7a70d9e8c7918b82859d25b3
TLSH
T12161B858F628863FE445413ACD821B411F34345298AFBF2A39AC614D1E5B2CE778D13D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 91c80dbd73ed510ba2b69fae2fb4119d9bffc753b548f5bdff7ffaf3c80dac49
MD5 3e5f6af55416924ab1fe84dcb42b726f
SHA1 f0d77595ae8901e7edd64b6082189075c5487d2f
SHA512 f0b1f39712c9e253637afd49965c05129b50ebf1f7ebe73e9d83aa62da9f0782ad9f92d605e6a259f24f23596043d44a16ed60ea825248f285142bb5a3991f32
TLSH
T133214C9D39B98FAA9CC7E3AC7451118E53564E0708871C435D12EF8DCEE1ADD327A439
MD5 SHA1 SHA512 TLSH

Submit Download

02fc6f15-27a4-401b-96cd-344171ea9f31

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\02fc6f15-27a4-401b-96cd-344171ea9f31
Size 16KB
SHA256 9ddea73b0da179508f7fdcfce1667d87d96464fefb47ab86758dbd681e4dc6ef
MD5 2d4d8e6a31790c9b564f78166abcd1fa
SHA1 c4ce125b8335cd7c48afb073e9f6f3069b2ce027
SHA512 1bba3127e12d048d169e12f597d7e4d0437fe8953998eb0b660479fc91e1d8ee99a18db2ba4f6f86e54f910da1e0f272193307acc9ec0acc95a3b8c6c52b1801
SSDEEP 192:8h3g1RMLRlU3b4Uk7mTVCvVOdLHH5azKwe9NA0c0US8Lp0UnlBow1fuN+QUzx7tq:sgjeDSUK3aa8LLlW3N+fl7t2umxKO
TLSH
T1EB72D956682045BB8251E36994ECBFC3E6F628CF4C419FCADBE47D082DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dba6734-2854-440a-ac82-5ed6a005a6de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\6dba6734-2854-440a-ac82-5ed6a005a6de
Size 12KB
SHA256 449a3d786975cacdc12a416477ee742d9142a8f46eabc8d16ad366fa3320fcb6
MD5 34bc12d7c570b02daae000dc1e2a7994
SHA1 460575413bf428cc500b4590d48c7373d4a49b17
SHA512 ac5707fdb1b70997334386b41df0c08f3d98162ec4a09f40f235d4923fdf3edc4b1347fdb0c23bfddb228d1d05eeb3568a07b6ce8c7cd2ab0433f1e8ce387f5f
SSDEEP 96:szKzvfN/UDZ6DBnFyLhpUEFY01hH9EQwzD0Dcbrkjn/odC8/BJgs0V3/f/SVd5pM:TzvVTgZsASlMpcX4IZgkc
TLSH
T17542CAFDCE13004B3D65E52EF5A6E96B2057293219CC879D6BFC483A26C6CBB1027319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70c413a6-f210-4724-8f4e-16defe0b55ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\70c413a6-f210-4724-8f4e-16defe0b55ad
Size 2KB
SHA256 c60d941b21040d2292548986796326ea92f79d51a6cdb1302c1c42ffb09e7ebd
MD5 80fb03e2ca8a42343d0a3e8ed1a41c06
SHA1 e869c432ad10128f5de3435886119a871f47cce6
SHA512 34618d30a3fafda1d13846ec34b3e9a18abfe608dd5cb00365033e581f67d5bcc6e867d88d25b1601eb07048505906913872929ca1fd04869f475e6c3ad67f30
TLSH
T14C4134EC36784C775C9AF59DD591338E57604B1344C618832F62EE4C8C996AD236A43B
MD5 SHA1 SHA512 TLSH

Submit Download

7b7e0281-e9f9-421c-831a-42115d13c3ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\7b7e0281-e9f9-421c-831a-42115d13c3ce
Size 235B
SHA256 4f7ceac9a1022a194d36984e41803135f5c53c2c05b35ba61c2ff17bfe875aac
MD5 edb2958c7ebaa1e9c32783377bf2bc89
SHA1 f79b4879a0d296aee6949ba6f847d78b3f6a18a1
SHA512 674cea1fd7e20129608e592eae65ae0e0bad24441bdb5d027a9ec8ceeabcad2cb431a04886e913f770b77b09aa83893994c228437b91af8f513aeaa77f650436
TLSH
T169D097C924A8672D08140F02F0E039C730888C3355B4E86089500438F9B9FC802A2826
MD5 SHA1 SHA512 TLSH

Submit Download

a7e64eb8-3925-45a8-891c-a5a371426a69

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\a7e64eb8-3925-45a8-891c-a5a371426a69
Size 883B
SHA256 df33d81b34e776a0d751c6e51edd2ed5820ccad3619ba398795ce01a1661948d
MD5 608f4d0b18d28aaf3a7929049de843d2
SHA1 66f7b15e2f93d93582c7aff3091aa58f44e6ad3b
SHA512 971d83f5fc12c141c10d51dd6c81514dcf8ca6ef8271dd2ddf7798f241ec02e7c9ca4b37c3e3c3cab233d53c6b9044f5b561620eef39c56ae7a0ca4a8581c681
TLSH
T1761100829A34B972CC7C8247C69137528BE47533C0CA40143EA569280D6E62E936A70B
MD5 SHA1 SHA512 TLSH

Submit Download

ba88bf9d-b383-4e88-8dcc-a2b143f937b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ba88bf9d-b383-4e88-8dcc-a2b143f937b0
Size 886B
SHA256 4eb420e8ee262485ea6263f57bbf851fc6fde1278cbd48fcc25d6d4697450576
MD5 f2534d02ffc34785bf3fc273249c5f14
SHA1 cb79ff7867ad6cb23b4c83681857792dacac5883
SHA512 21f58dc159edabaf8c13f63ece59192297d9b40af55176a53d993341c3818646db2acdac23856d3e7d8fb8d56a15cfdb971ac4c7d0a44331e2e517be3244d5bf
TLSH
T11F1104D19934B8B2CC6C9247D6D07B924BA47533C0CA45107E546A1C0DAD51EE7AE707
MD5 SHA1 SHA512 TLSH

Submit Download

d097cd0f-c01a-42f2-b5ca-5a2bacc33015

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\d097cd0f-c01a-42f2-b5ca-5a2bacc33015
Size 235B
SHA256 f1c32731147baec2128f8da1904ab89642fad0051761796ddac7945cd76960d4
MD5 41c078c0c04779c27c1bc3719500ea8c
SHA1 2d5a2c3101b4e2bcccf6f035d8e2495cb6f6a937
SHA512 a86d3865b1a4425de3144f8dbd29560112d45d624312e5b8a19548b223e31c62c83567886b6a92171eed535bcecee9a44264e0d3e883b07baf4b2c83bf1e0657
TLSH
T13CD0979158AC231D88228F47B0A02AC230498C3324B898209BA046B899B8DCA0152A16
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 98a9d457fc0b2c4ae43d3ef13721ff78b6d1edb4d31c606a692960eb3fa242a6
MD5 3e0100646bc4ea748ce80ec8d1417391
SHA1 f3f621a6f40ac70be74198737c649a9b2921fb24
SHA512 c111b5805642a5016322361f8921bc8300c2fcbb2fa99406b8f821e08975275da256139498d9ad35b8c796dc367f1bacff132b0c5cd69aeba61b0ccbc174039b
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4HDI4hT:ujI4VRfOXN4e60434L474f4c4J
TLSH
T14D72421545048EB8294EA78AAA367E01C37D473B60845C78F4DD8FC842FB5BD06BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\places.sqlite
Size 4.1MB
SHA256 51079139e662ed5f722b7266c58dddeec75756729b13f14416852bb3e5f47f61
MD5 0706d02a7459f440800ab08c71b41c9d
SHA1 18a5102ed59ac8e533674e17f972d409bb289edb
SHA512 15166b12d60252fde39d5d28d1e7f1afc35a04f15004a99f53eba382e25ad967c132ceb005d144d0047d34daaf924b8dcbacb11ea74cccc94a85e9ed440fa363
SSDEEP 192:M8rJQaXoMXp0VW9FxWcMthC/BjqDvFqeCh2m:M8r54w0VW3xWcMthC/B
TLSH
T17C16930F7A241195C4EEA231E9F22B28183F7016CAB6775339A0162D4DD0B23B85DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 12KB
SHA256 a047ee9f8ffb67ecddaf86aa42d2d7623c3e403417f98fb0012782203fdd1233
MD5 44af37d17608b8ce6e721ea34656cc59
SHA1 284848e8da18b92bb7123f042d3c7b2a1579939c
SHA512 6553548fc01d1e8cc2e491ddbed6dac6c62f86ca073bedcd24c43121ef97f9294fe4621234d4dd59e5f497e4c408630ea3eb2ffad4b9a82a4606c64f3b3b595e
SSDEEP 192:GoCRdfb4bFSSoXLRCpxEOBw88Z/qJKH2y:gdRCptwtbl
TLSH
T16742CC3C50448BBF64B2327DBC2549B15AA14637B6BFBCD305B89492055CF2841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 8KB
SHA256 d46d1e4b04dc7c260120e88539cb7dbf6efacd5c9ce52ddd091c10343495cd23
MD5 59731fa522101a350b07beaac4d865d0
SHA1 dc779c96bb289aa6c1bbcc8c1e1800f8faa3493d
SHA512 30cab65a76465b67629ad5de89acdb93db69d91ae72b2bfa71499d56f3d6c020c9424f9dae08771226376ae2930cd65a4544112dc069692846efe2a9c0ce5cc9
SSDEEP 96:xHcFTUuqGqdfb4bObzSbSSlDdv9jFnERWRBBO+ypxnIBw88s3fd8L4cnrzKK:6ARdfb4bFSSo8RCpxIBw88Wo5
TLSH
T144020F7C5404CBBF64B6376CAC2489715AB2063BB6BF68C710B954C5055CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 12KB
SHA256 dfa16eb1d9cd0792d881296b2bf5ba3707dbee6cee9fb441573521d7532a1f33
MD5 a78fcd6d52f8451e64052ab2758b242f
SHA1 fd3785b21a1150dfd43f5b2edd1fae12ab4ef856
SHA512 aa4eb9dbd0bc89328df8be9c2aa7c9cba4ff2e3a1c2f7f825b954509c77c06d43fa31d3c2a8c7a38fbe2bbf978461026cf1ba920d58c0f222c3c28eaa5382a42
SSDEEP 192:6oCRdfb4bFSSoXLRCpx0OBw886tMJKH6y:EdRCpdwu1R
TLSH
T13042CC3C50448BBF64F2327DBC2549B05AA1463776BFBCD305B89582455CF2841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 dd9bf19d4638504e5268dcce4c1e0ab960ea3401205b0c9f92814edd02bbb95b
MD5 8458c2dab179cebd271bda19837bd1c4
SHA1 86d4cd63234031d5b77f361902c9e2b7fb971c28
SHA512 5f179725eb79d5533da28415193d2b4ca1ccfb59880edd4fa44c4aead27a609c0c36302a25521783dbff2153d2c50082d570011ce70c6faf7e314e5145dc503f
SSDEEP 96:xHcUTUuqGqdf24bObzSbSSlDdv9jFnERH9O+y1Bw88n8L4cnrzBHK:65Rdf24bFSSo9A1Bw88+w
TLSH
T144E13F7894088F7F64B6776CAC6888716AB2413BB7BF68C750B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 eabdede1872f44b720385ea96cfa35abb498c12f31378074c910260b0195aa94
MD5 b7a636433df9bd8e249be4e7ac30a850
SHA1 e63507da82e1b82bdaa7fd98be7183a0705d8801
SHA512 80adef1adfdf7d9bd971779c888028fe5073b265fe167b61ca31a5bf93ef5b06bf0eb3f9b21a3ccfb82ae99f5427a15b1a1ef1c1848361c018a45b16f71d5982
SSDEEP 96:xHcUTUuqGqdf2oE1zSTSSlDdv9j9wnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEOSSvZ9A1Bw88+w
TLSH
T174E13F7894088FBF74B6766CAC6888716AB2413BB7BF68C750B954C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 6479623f77c33018c776e44c488695dc2d21f4d4774a6ece7220a5ae512e5bb5
MD5 67644252cd85e9c69b99f59be2985bd9
SHA1 ada2bacc9a3baa17e6ec8b982e9e9503280bb9eb
SHA512 23dc6a36a8358e7eebcdee07524e20257116acb7cdd947782e2c351d0bd4e2a49e8ac3c33e20fce78ff46d739049bcfc13334362b7044fa5db645589fb279696
SSDEEP 96:xHcUTUuqGqdf24b1zSbSSlDdv9jFnERH9O+y1Bw88n8L4cnrzBHK:65Rdf24bqSSo9A1Bw88+w
TLSH
T16FE13F7894088F7F64B6776CAC6888716AB2413BB7BF68C750B954C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 7KB
SHA256 35a20e916231540395b964034db60ebede3e5acc18e09a4718d072be484569dd
MD5 5e525e4997b3bafc8698901fb2db3ed7
SHA1 7fe38aff454eaff932eda9ec8c88d0f6f6f12a38
SHA512 7e9da0756df3fdad33b2912088b284461297dcafd152551b1baa563d1f3f2783f8a8828459b6791b3c631c40ac5a41a54264b4d325691b086004728839989115
SSDEEP 96:xHcFTUuqGqdf24bObzSbSSlDdv9jFnERH9O+y1Bw88a8L4cnrzKK:6ARdf24bFSSo9A1Bw88x5
TLSH
T175F10E785408CB7F64B6776CAC2849315AB2013BB7BF68C710B954C5051CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 7f69212532c0fc5e3c927ee9626ff9f2fefe0aa8b9b0a99dd94d82a80f80430a
MD5 f5787adf37a365383aefcaf69dd66d3d
SHA1 99a916c72c422dcd05cea2b694787c645146be01
SHA512 209dee3ea43c96f096bbf03b3d0b8eb1bea2bcc3b0d1a125057997d6d385137d9de9dc5f76f3c452f4a802a2e499b9dd7afaa609abab3b311040e6fd43c150b7
TLSH
T1A6513C961CEF6FECEA24841CE1856BBFC62A301B40BC0450A1AFD246C19E08E365E979
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 9c08bb8468b2442dfb98eeecdac6b03a7d84abea267559e02e85527ff635241e
MD5 62060f79deebac2886623d78ff651be2
SHA1 7b9829e7c824e8c9874d469ada403768ae28dee0
SHA512 52161785f6502c7882a1fa97f19abcff6e2f7bab36407da0ca3ab674ff1a6a4189e9282a8a75dd3aa5b66e27de3beeb3c3b711793113e18e1ca98d402db142c8
TLSH
T17621D6D698A72FF8FF34401EC8C48BBF8DA63034413808A0A65ECB87965C41E33AB125
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 1a5ca7389b05ff7662b417a6cc8f937a8a58a1196ef06a7c94ddcffdd329497d
MD5 6ef970acb2b34069f6f567f037ec71b4
SHA1 d71896b2d8d896611a88b700e887c6d794fe024d
SHA512 8d62d03e387c272e18abd2a4cfe62f986b58e2e514669fc587d5bb6aac50eed9a22c36246b5837344d0b5459f140ab303a51bd4c2af4ccea45434f6e9573e8a0
TLSH
T1A3513C965CDF6FECEA34845CE18567BFC629301B40BC1440A1BFD246C19E08E362E879
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 3a721dcb84cbcdcea19db6fa5604a5123030352cd4477d7a9cb2e1dbfb42ad44
MD5 b60963cc7a2d3428180de780057803d1
SHA1 e1f3a190010a706fe9b2ac304e54cb0aba91fd60
SHA512 36878ee47e5a05709b0c32777df9c6c94a78b8f89ae4cc29e67bad63ff786123b77e3dff67c94233dcbaf7932aad4dcf98859a4346ae87aca2f94da5a54ae81d
SSDEEP 49152:JDmgsuOa5lUT2lkfJR5eaKvgmRBbFOYKgVw:ZmBuOa56T2eleaKvgm/V
TLSH
T1EE462AE860D1A253F3814073B64953EB21FFD00D5037DE4847A85AE9A478CDB9E17BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 9.3MB
SHA256 48d3835d2d8b04f4d0f4de25570b401c24023e7b481544237a4a68f3488164eb
MD5 b2f5b7f5e4d4f44f3b09214228a42ec9
SHA1 68f0716e3f40e179e4232fdb1a1b750941fc2cd4
SHA512 7b7b44c400ea5b54901a7d6559effe848857cb1187cd2b52233e859210e7a78cde442e29b6ac5f22273b62ba1c00bf60e0a5c72899a03adc9e7de5ab86efb69e
SSDEEP 6144:PYqTxd9asKNbpwzXAOu6z1pFyPpKJjty81aX2TmohYR81BPIcwPWJG1v4qXtwOPx:cNLu8m+1mW
TLSH
T164A6503136ED2140EBF3AE6DBCB49A248E3D7D1B5C26C94D01161A4D0961FA1DC73FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{81da9376-c1fc-4cec-aa5b-fe82a8c23cdd}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{81da9376-c1fc-4cec-aa5b-fe82a8c23cdd}_OnDiskSnapshotProp
Size 6KB
SHA256 58e1a623c0531e0db9ee31bb213cee8af19001977bae024cb6e14cb8195387b9
MD5 ae36719ba364a401dcaf55e3ab87099b
SHA1 a547f7b9ad3c32deb7bd9fa3dcd0d99d57cc5298
SHA512 8d49e023b0e7a070ae118d9c1f54d99af9c9b74ff709abff4850087f0cc125d97c713232100ae27d2d123e07a481e4566ac2db8b1a5a683e3a34cc61c048d101
SSDEEP 96:FBTaKVVvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:7Tbb++ZVmN
TLSH
T15FD198184AE54311E2B3AB7228F14557A877B811EF33CB8E0198238E2670A10F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-1041-0x0000000002E80000-0x0000000002EB6000-memory.dmp

Download

memory/1356-1035-0x0000000002E80000-0x0000000002E8D000-memory.dmp

Download

memory/1356-1073-0x0000000000EE0000-0x0000000000F16000-memory.dmp

Download

memory/1356-995-0x0000000002E80000-0x0000000002E9D000-memory.dmp

Download

memory/2036-1028-0x00000000034C0000-0x00000000034EE000-memory.dmp

Download

memory/2036-1016-0x00000000033B0000-0x00000000033DC000-memory.dmp

Download

memory/2036-1011-0x00000000031B0000-0x0000000003216000-memory.dmp

Download

memory/2036-1024-0x0000000003410000-0x0000000003496000-memory.dmp

Download

memory/2224-1052-0x0000023295950000-0x0000023296411000-memory.dmp

Download

memory/2224-2275-0x0000023295950000-0x0000023296411000-memory.dmp

Download

memory/3928-1101-0x0000000003020000-0x000000000303D000-memory.dmp

Download