hxxps://www[.]intercambiosvirtuales[.]org/software/advanced-renamer-v4-23-commercial-multilenguaje-espanol-utilidad-de-cambio-de-nombre-de-archivos-por-lotes

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
900s
max time network
891s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.intercambiosvirtuales.org/software/advanced-renamer-v4-23-commercial-multilenguaje-espanol-utilidad-de-cambio-de-nombre-de-archivos-por-lotes
Sample260925-xaydfagh27

Score

7^/10

discovery installer persistence phishing ransomware

Malware Config

Signatures

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	86	[email protected]	5024	firefox.exe	3

Executes dropped EXE 3 IoCs

pid	Process
2884	advanced_renamer_setup_4_23.exe
2888	advanced_renamer_setup_4_23.tmp
3400	cr-keygen.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x000700000001d31f-7242.dat	ConfuserEx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cr-keygen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cr-keygen.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	advanced_renamer_setup_4_23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	advanced_renamer_setup_4_23.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cr-keygen.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x000d00000001c7e8-2251.dat	innosetup
behavioral1/memory/2884-2253-0x00000000002A0000-0x000000000037D000-memory.dmp	innosetup
behavioral1/memory/2884-2262-0x00000000002A0000-0x000000000037D000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\ARV423CMIKX64.rar:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
6244	NOTEPAD.EXE
1056	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeRestorePrivilege	2432	7zG.exe
Token: 35	2432	7zG.exe
Token: SeSecurityPrivilege	2432	7zG.exe
Token: SeSecurityPrivilege	2432	7zG.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeRestorePrivilege	5940	7zG.exe
Token: 35	5940	7zG.exe
Token: SeSecurityPrivilege	5940	7zG.exe
Token: SeSecurityPrivilege	5940	7zG.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
2432	7zG.exe
5940	7zG.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5024	firefox.exe
5024	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 5024	1480	firefox.exe	89
PID 1480 wrote to memory of 5024	1480	firefox.exe	89
PID 5024 wrote to memory of 1364	5024	firefox.exe	90
PID 5024 wrote to memory of 1364	5024	firefox.exe	90
PID 5024 wrote to memory of 1364	5024	firefox.exe	90
PID 5024 wrote to memory of 1712	5024	firefox.exe	91
PID 5024 wrote to memory of 1712	5024	firefox.exe	91
PID 5024 wrote to memory of 1712	5024	firefox.exe	91
PID 5024 wrote to memory of 1712	5024	firefox.exe	91
PID 5024 wrote to memory of 5972	5024	firefox.exe	92
PID 5024 wrote to memory of 5972	5024	firefox.exe	92
PID 5024 wrote to memory of 5972	5024	firefox.exe	92
PID 5024 wrote to memory of 5972	5024	firefox.exe	92
PID 5024 wrote to memory of 4984	5024	firefox.exe	93
PID 5024 wrote to memory of 4984	5024	firefox.exe	93
PID 5024 wrote to memory of 4984	5024	firefox.exe	93
PID 5024 wrote to memory of 5824	5024	firefox.exe	94
PID 5024 wrote to memory of 5824	5024	firefox.exe	94
PID 5024 wrote to memory of 5824	5024	firefox.exe	94
PID 5024 wrote to memory of 5824	5024	firefox.exe	94
PID 5024 wrote to memory of 1924	5024	firefox.exe	95
PID 5024 wrote to memory of 1924	5024	firefox.exe	95
PID 5024 wrote to memory of 1924	5024	firefox.exe	95
PID 5024 wrote to memory of 1924	5024	firefox.exe	95
PID 5024 wrote to memory of 5188	5024	firefox.exe	96
PID 5024 wrote to memory of 5188	5024	firefox.exe	96
PID 5024 wrote to memory of 5188	5024	firefox.exe	96
PID 5024 wrote to memory of 5188	5024	firefox.exe	96
PID 5024 wrote to memory of 4424	5024	firefox.exe	97
PID 5024 wrote to memory of 4424	5024	firefox.exe	97
PID 5024 wrote to memory of 4424	5024	firefox.exe	97
PID 5024 wrote to memory of 4424	5024	firefox.exe	97
PID 5024 wrote to memory of 4656	5024	firefox.exe	98
PID 5024 wrote to memory of 4656	5024	firefox.exe	98
PID 5024 wrote to memory of 4656	5024	firefox.exe	98
PID 5024 wrote to memory of 4656	5024	firefox.exe	98
PID 5024 wrote to memory of 2588	5024	firefox.exe	99
PID 5024 wrote to memory of 2588	5024	firefox.exe	99
PID 5024 wrote to memory of 2588	5024	firefox.exe	99
PID 5024 wrote to memory of 2588	5024	firefox.exe	99
PID 5024 wrote to memory of 2228	5024	firefox.exe	100
PID 5024 wrote to memory of 2228	5024	firefox.exe	100
PID 5024 wrote to memory of 2228	5024	firefox.exe	100
PID 5024 wrote to memory of 2228	5024	firefox.exe	100
PID 5024 wrote to memory of 4516	5024	firefox.exe	101
PID 5024 wrote to memory of 4516	5024	firefox.exe	101
PID 5024 wrote to memory of 4516	5024	firefox.exe	101
PID 5024 wrote to memory of 4516	5024	firefox.exe	101
PID 5024 wrote to memory of 3276	5024	firefox.exe	102
PID 5024 wrote to memory of 3276	5024	firefox.exe	102
PID 5024 wrote to memory of 3276	5024	firefox.exe	102
PID 5024 wrote to memory of 3276	5024	firefox.exe	102
PID 5024 wrote to memory of 864	5024	firefox.exe	104
PID 5024 wrote to memory of 864	5024	firefox.exe	104
PID 5024 wrote to memory of 864	5024	firefox.exe	104
PID 5024 wrote to memory of 864	5024	firefox.exe	104
PID 5024 wrote to memory of 2480	5024	firefox.exe	105
PID 5024 wrote to memory of 2480	5024	firefox.exe	105
PID 5024 wrote to memory of 2480	5024	firefox.exe	105
PID 5024 wrote to memory of 2480	5024	firefox.exe	105
PID 5024 wrote to memory of 1308	5024	firefox.exe	106
PID 5024 wrote to memory of 1308	5024	firefox.exe	106
PID 5024 wrote to memory of 1308	5024	firefox.exe	106
PID 5024 wrote to memory of 1308	5024	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.intercambiosvirtuales.org/software/advanced-renamer-v4-23-commercial-multilenguaje-espanol-utilidad-de-cambio-de-nombre-de-archivos-por-lotes"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.intercambiosvirtuales.org/software/advanced-renamer-v4-23-commercial-multilenguaje-espanol-utilidad-de-cambio-de-nombre-de-archivos-por-lotes
  2⤵
  - A potential corporate email address has been identified in the URL
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27097 -prefMapHandle 1940 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {84f677c7-c550-46f9-b41f-00634b300423} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {abb6a4c2-1ce0-4d38-a38a-340067f3eb8e} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 25164 -prefMapHandle 3956 -prefMapSize 270279 -jsInitHandle 3960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {6b31cede-6350-4f42-b02e-a8c51addddd0} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4108 -prefsLen 27274 -prefMapHandle 4112 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {026df450-3a7a-4a2b-b0f5-985848067c1f} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2672 -prefsLen 34773 -prefMapHandle 2676 -prefMapSize 270279 -jsInitHandle 2732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4452 -initialChannelId {0226c0c7-60ed-4907-a342-c1acd4c8afbc} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5104 -prefsLen 35010 -prefMapHandle 4388 -prefMapSize 270279 -ipcHandle 4740 -initialChannelId {f38b1852-83e5-419e-aa15-4aa4952f6a84} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32952 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {8e7b5087-78c6-4623-b8f8-770488ba8a60} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5740 -prefsLen 32952 -prefMapHandle 5744 -prefMapSize 270279 -jsInitHandle 5748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {2d866397-cec3-447a-ba7b-6e6c249d93df} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6080 -prefsLen 32952 -prefMapHandle 6084 -prefMapSize 270279 -jsInitHandle 6088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6096 -initialChannelId {7339af49-1f04-40d8-a05f-0030ffcd0c84} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2740 -prefsLen 35062 -prefMapHandle 2752 -prefMapSize 270279 -jsInitHandle 2756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6272 -initialChannelId {3272123a-4440-4af4-9784-2aab076ae4ea} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6756 -prefsLen 33193 -prefMapHandle 4392 -prefMapSize 270279 -jsInitHandle 6688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6844 -initialChannelId {dfcb9c88-586e-415a-a77a-0f0eb99168fb} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7068 -prefsLen 33193 -prefMapHandle 7072 -prefMapSize 270279 -jsInitHandle 7048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7096 -initialChannelId {880a37c5-3e7b-464d-b192-26e2697dffed} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 33483 -prefMapHandle 5864 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3392 -initialChannelId {f33e0ba9-f786-47dd-8fd4-0eabb8e95224} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    PID:3276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4832 -prefsLen 37425 -prefMapHandle 5768 -prefMapSize 270279 -jsInitHandle 6652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6084 -initialChannelId {9b92800a-423c-4361-b8af-8a957ed0d75e} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7664 -prefsLen 37467 -prefMapHandle 7024 -prefMapSize 270279 -jsInitHandle 6984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7560 -initialChannelId {d05b841c-a033-41f2-a0c4-ddf9d23d169f} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7396 -prefsLen 37467 -prefMapHandle 7588 -prefMapSize 270279 -jsInitHandle 7804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7000 -initialChannelId {c96afac2-cbd5-4a7d-a32d-7e2975395031} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    PID:1308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5836 -prefsLen 37467 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5764 -initialChannelId {7020c9e2-80c5-4f12-9570-d07de8c5d8bc} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:1904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6840 -prefsLen 37467 -prefMapHandle 6988 -prefMapSize 270279 -jsInitHandle 6612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5276 -initialChannelId {b0f69b71-c230-4cd2-a139-1094f650b764} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 37467 -prefMapHandle 3980 -prefMapSize 270279 -jsInitHandle 3248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5756 -initialChannelId {3c0d5aff-9b4c-4086-8284-bb57f971fd5f} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7916 -prefsLen 37467 -prefMapHandle 7896 -prefMapSize 270279 -jsInitHandle 7020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5840 -initialChannelId {48f59ab9-d8ec-4013-9790-0099f905e827} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 37467 -prefMapHandle 7684 -prefMapSize 270279 -jsInitHandle 7464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6312 -initialChannelId {e0f46fb9-8dc7-4771-a78c-9ad03534ac07} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:6280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8436 -prefsLen 37467 -prefMapHandle 8440 -prefMapSize 270279 -jsInitHandle 8444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8452 -initialChannelId {abe06b85-7259-44bb-bc16-58d8ab41240a} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:6288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8772 -prefsLen 37467 -prefMapHandle 8444 -prefMapSize 270279 -jsInitHandle 7100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8788 -initialChannelId {3ca132d2-569f-48bf-9864-750e6ee4e4ce} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6432 -prefsLen 40776 -prefMapHandle 8908 -prefMapSize 270279 -ipcHandle 8444 -initialChannelId {049f7bf9-bb73-4a3c-b0b7-50a104f37852} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 utility
    3⤵
    - Checks processor information in registry
    PID:6972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 8632 -prefsLen 40776 -prefMapHandle 8768 -prefMapSize 270279 -ipcHandle 8764 -initialChannelId {7b3606e4-51e3-4c2b-bb7d-0e8e6b654785} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 utility
    3⤵
    - Checks processor information in registry
    PID:6988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6844 -prefsLen 37467 -prefMapHandle 7576 -prefMapSize 270279 -jsInitHandle 6296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7296 -initialChannelId {4a14da0f-5f45-4246-b164-5d15a42bb589} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8552 -prefsLen 37467 -prefMapHandle 6844 -prefMapSize 270279 -jsInitHandle 6296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9368 -initialChannelId {b2076c8b-a657-4aea-a3f7-0e0f8cabc659} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8476 -prefsLen 37467 -prefMapHandle 6232 -prefMapSize 270279 -jsInitHandle 4868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8300 -initialChannelId {7f34dfae-9fa9-4bd4-b384-fedffa66dfd8} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:6596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7560 -prefsLen 37467 -prefMapHandle 3424 -prefMapSize 270279 -jsInitHandle 6884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8676 -initialChannelId {0f02869e-cf61-4bf0-906e-ccd758680363} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:6924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7620 -prefsLen 37467 -prefMapHandle 7400 -prefMapSize 270279 -jsInitHandle 8476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5232 -initialChannelId {985f2bb5-31b3-4809-b28b-c28a81834aef} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:4636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8720 -prefsLen 37467 -prefMapHandle 8432 -prefMapSize 270279 -jsInitHandle 7908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8792 -initialChannelId {c68e8607-7bf7-4156-a8d2-d30912ae4a86} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8476 -prefsLen 37467 -prefMapHandle 7400 -prefMapSize 270279 -jsInitHandle 7792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8012 -initialChannelId {f9444ce6-c957-41ed-a5bc-5bb241a2a567} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    - Checks processor information in registry
    PID:5412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8532 -prefsLen 37467 -prefMapHandle 8520 -prefMapSize 270279 -jsInitHandle 8484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8664 -initialChannelId {d27eaa86-ada4-4632-880d-e6f73e7fa0c2} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    - Checks processor information in registry
    PID:6916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8456 -prefsLen 37467 -prefMapHandle 7936 -prefMapSize 270279 -jsInitHandle 8644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8424 -initialChannelId {f78532a1-7c32-4372-85b6-d5df30f195a8} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    - Checks processor information in registry
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7976 -prefsLen 37563 -prefMapHandle 7900 -prefMapSize 270279 -jsInitHandle 7892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6884 -initialChannelId {7503fb34-90f3-4b54-ac4b-7fa68cc21e08} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
    3⤵
    - Checks processor information in registry
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8696 -prefsLen 37563 -prefMapHandle 3064 -prefMapSize 270279 -jsInitHandle 10008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10012 -initialChannelId {e5cd4d07-2581-4c86-b22e-6b6c9cf385c7} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
    3⤵
    - Checks processor information in registry
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8508 -prefsLen 37563 -prefMapHandle 8756 -prefMapSize 270279 -jsInitHandle 8828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8536 -initialChannelId {b6cecb3c-efaf-426c-9c61-07e47c0caad3} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
    3⤵
    - Checks processor information in registry
    PID:6152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7752 -prefsLen 37563 -prefMapHandle 7740 -prefMapSize 270279 -jsInitHandle 6004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {c1699287-f897-4df6-8000-afcf5f1f4ed8} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
    3⤵
    - Checks processor information in registry
    PID:6936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1064 -prefsLen 37563 -prefMapHandle 6724 -prefMapSize 270279 -jsInitHandle 6944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7888 -initialChannelId {ca138b37-8d51-4d0c-8b15-09e6187e55be} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
    3⤵
    - Checks processor information in registry
    PID:5324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15156 -prefsLen 38098 -prefMapHandle 15288 -prefMapSize 270279 -jsInitHandle 15104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15248 -initialChannelId {75668595-31bc-4bbb-b189-37c01bfd82e0} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
    3⤵
    - Checks processor information in registry
    PID:7116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16080 -prefsLen 38098 -prefMapHandle 16088 -prefMapSize 270279 -jsInitHandle 16104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16132 -initialChannelId {dbfd8ae8-4463-417f-add5-ac38d3eff485} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
    3⤵
    - Checks processor information in registry
    PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16400 -prefsLen 38098 -prefMapHandle 16436 -prefMapSize 270279 -jsInitHandle 15068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16080 -initialChannelId {2608ccd9-511e-4b82-a210-2db91cf954b5} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
    3⤵
    - Checks processor information in registry
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7152 -prefsLen 38098 -prefMapHandle 8828 -prefMapSize 270279 -jsInitHandle 8360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9424 -initialChannelId {9cb599ea-8afd-403a-a01e-a5c69e1dd357} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
    3⤵
    - Checks processor information in registry
    PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15036 -prefsLen 38098 -prefMapHandle 16000 -prefMapSize 270279 -jsInitHandle 6912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10460 -initialChannelId {409b3602-367c-438a-a170-14e8b0bd033e} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
    3⤵
    - Checks processor information in registry
    PID:2992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2608

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12104:88:7zEvent15781
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2432

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Advanced.Renamer.v4.23.Commercial.Multilingual.Incl.Keygen-x64\Instrucciones.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:6244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6956

C:\Users\Admin\Downloads\Advanced.Renamer.v4.23.Commercial.Multilingual.Incl.Keygen-x64\advanced_renamer_setup_4_23.exe
"C:\Users\Admin\Downloads\Advanced.Renamer.v4.23.Commercial.Multilingual.Incl.Keygen-x64\advanced_renamer_setup_4_23.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884
- C:\Users\Admin\AppData\Local\Temp\is-OUIAN.tmp\advanced_renamer_setup_4_23.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OUIAN.tmp\advanced_renamer_setup_4_23.tmp" /SL5="$701AA,11709080,844800,C:\Users\Admin\Downloads\Advanced.Renamer.v4.23.Commercial.Multilingual.Incl.Keygen-x64\advanced_renamer_setup_4_23.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2888

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Advanced.Renamer.v4.23.Commercial.Multilingual.Incl.Keygen-x64\Instrucciones.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:1056

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Advanced.Renamer.v4.23.Commercial.Multilingual.Incl.Keygen-x64\" -an -ai#7zMap1124:222:7zEvent19595
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5940

C:\Users\Admin\Downloads\Advanced.Renamer.v4.23.Commercial.Multilingual.Incl.Keygen-x64\CORE\cr-keygen.exe
"C:\Users\Admin\Downloads\Advanced.Renamer.v4.23.Commercial.Multilingual.Incl.Keygen-x64\CORE\cr-keygen.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3400

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\activity-stream.contile.json
Size 4KB
SHA256 4306596e87a4a0d218d9569d8efd5ecc4be6902a9ce447dc3f9d6c8bc62caaf9
MD5 4c1b9686aee52b1a004d27ffafd122ff
SHA1 9ea43f9aea9f353c96e1eee80f8ef2b7ede17e19
SHA512 eb351802744b991cd20f780a6c16c97c1c2102d8b4448433bc39f71d70c448ab66eb43a616fccae18973a98e4615e8c74aeddf404bf57cfb9d078c6c5b027b1f
SSDEEP 96:aCmaSBxx9wNwVgWJyxImnMpyErZAPQolz:EBx4CJyCmeinF
TLSH
T17EA1D86B917848031734B7F5295F1B88F22771391AE04DFCF2066C2593ACBB961AB8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00F1F00581E0C22164B63FD3CDAEFA8FF58A82B7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\00F1F00581E0C22164B63FD3CDAEFA8FF58A82B7
Size 316KB
SHA256 0a104bf90cb1101bbf96624649ba34b2335b6110c1ecb6a82221818da31ddd6e
MD5 684c0d68634183cc4d6296d90eb55c45
SHA1 c513ac375fa267e32bc5a1835b474cdb38b529bb
SHA512 501198ddcfe3b605c079c979c40d45237c9cbc3920886f44c1706741f4a2dcce1300b224a70b36a03617e06d57bdc412dea023a055f126fb63df31cc2a4627f2
SSDEEP 6144:112T1S9e0QYSHoQPz1//EoKdAUk4wIVbEgIfjZHii50g4ywi4xajNwT7vb8p26Sv:121S0sSV/E/AUk4wIVbEgIfj9jvwHajg
TLSH
T1AA64C616EE421A57C82103B441AB67363A70E0856BA1F33F7ACF74A1FC693791D746B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

027537E81473CF44E121A5C2C944EA84C3FCA5B7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\027537E81473CF44E121A5C2C944EA84C3FCA5B7
Size 149KB
SHA256 debb802dbb8cd7a436e60d48cbc0fa7634941e32c3abeb29b861466042203bcf
MD5 73d16332d349b5d9e3c52c02d2428faf
SHA1 1e35ac0d340e39015394294ee9d89f1bb27ca991
SHA512 2da44b5c62195884121f1da9a8fe38cfbe3a3f49c9bf4a4e0baa07bab9baf78c0d5f3b148d15042e08177cc7393a5740db35a486d0c7f7475b255502d3d851fd
SSDEEP 1536:3DZLnsHiFRx7zYyS1WOv8fpZDTNDlji6/C/86Y4gPEFJWaJR9Pi908dFSxLCzII2:3Jn0vWOsTNDlji6/w6owa8CuP4bDdkO
TLSH
T145E3EA15ED261A21C46501B640AB533A3635D09AABD2F33B3FCF3196BC79A381D52E7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1FBA8B5E04FDA84763634EF56F9D2CCC0B6F625F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\1FBA8B5E04FDA84763634EF56F9D2CCC0B6F625F
Size 228KB
SHA256 1d055ac78bd3f40b6d5cf4167b35cd74699473db8e47674468645cd1e310a98e
MD5 110b54df902eda93828d636d6ac8a680
SHA1 e29299672f8c8e4f9c58014eb86dce6e2e7ff351
SHA512 ecd5bada6d66d2484d221a6fb1778105d40607e80fa405fedbdfc185562b1dddbff030ee497700f66eb1e5eee2589e2056dac2651dc7585c9546c6e6f3deba0b
SSDEEP 6144:8Y0s6mDECwrs2qpXUpdSayQ/Tre4Cq6NMnm8m0ICSCT:8rsfECwOQdSzQ7r6NM8uSCT
TLSH
T1183423732F78BE516B59F23AC82FAD700FF7A015D52281498326FC9404C9D97A76F289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3337CCFC9A905338A7B7BC0730E7E3E3DB03BEDB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\3337CCFC9A905338A7B7BC0730E7E3E3DB03BEDB
Size 401KB
SHA256 a62155a68845d538b348529eacbd3a76698eaf0afccb6d5eea82242907cea06e
MD5 a57976cada7672ae433f275e7dd5797e
SHA1 c547b727e4c1735fd3829efe0b6afa78cf0a0962
SHA512 3dc5905ce6c73bcf718405336e8a8d8db089e5a7d26f2210b721836aa7b736e66b975004edc3e4d6eb4c779b36e4b3340df6e04dcbc44bfa961854c463ca336a
SSDEEP 6144:V4OFpEG9a98Hrfu2Mo8iKQ69odew2jygPQ4nZxQmDoAx:VSGnXTuu+yg44ZdZ
TLSH
T11894F956FE862A53C93503F140A723323A74D486ABD6F3272ECF7161BC5A3791C529AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

351E4401485635246D350FDF56953449D8AB371F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\351E4401485635246D350FDF56953449D8AB371F
Size 49KB
SHA256 18ed512a1d9e58d400bdaaf22432c51573998b0213ef2979869f2ebb9c0404e5
MD5 28668524cca6c68b22418ec7720b6d43
SHA1 c25ae86ccb0e98a0310f9fd68c8f083686651644
SHA512 6d6480be01bae4c54c0bc5e92ab85c4d68ea40ccc1519d63036caf2fca75cfe41108a587490d606e8462594aa7fb05599d8f0df5ed8ca886851e452af5710e9a
SSDEEP 768:3htRW3gKRDQCp6IefFxejfA9CZx/2Blx632BlxDy8R8o/VMWxZlp4kexZAp4kE:3pKRDQCMIeNATA9CZxeUGZyURxTexIE
TLSH
T16E338D3A0A08600AE47E8174B4E7771DF239D047EBC3ABE9AA553A7498CA3742D52D4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B591CD7EBB51E66098CF364FF601DA79F79DCB6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\3B591CD7EBB51E66098CF364FF601DA79F79DCB6
Size 102KB
SHA256 449e0a5433af90ae29b37e93bd324e56ec1d7eed4c07cc34239cb4a9e9d7f2e1
MD5 9305d252681715ebdb463a291ac9cc10
SHA1 1372baf725a789964dc08b7f63adc63594ff7fc4
SHA512 f14ca00d3114efe79eacfdc084c6cef47bf89d3f265d89780d282c9c6fc59f6fc0639ed96db9f02ed3866c8500c1a0840907b0ad05f59880a40c6ffdae371aa6
SSDEEP 3072:MO96mdXQhOft5/7qYOBwUyutgp2iX+a24+J:fN5/7HyYmgpbuav+J
TLSH
T1B7A3F722EE122A22C03906F241AB67362620D1429BD7F7771FCFB915F86D7751CA1E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42D8C3527DD8411953520137FDABD4950254FABC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\42D8C3527DD8411953520137FDABD4950254FABC
Size 56KB
SHA256 ce0812227b9754d1d4a803edbed50be1077d41d86bc21d97b92ca2d06dd669b3
MD5 0521c7b97039825815bdc6b9dd4fa427
SHA1 7a3ecebc0f1edfefd7556fcbf8b36007186469d3
SHA512 501e05993ae352f979fc90e40c4eed93122217cc7d58ceefc875549e4391245e2ca96c0f3c9818f0fadd159582cfd29ad32f2a6e134bc9943f9902e17a33de75
SSDEEP 768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsH:LsEcy7fXRGqqHmr7qv32UC7UetOGLkoA
TLSH
T18B43F13ACF8B45B3C737267AEAD9C2457E692577DAB9CAD47831010819843F0B5AD80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6122EEDDF64387E812E1A41B256E36FD2EB77988

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\6122EEDDF64387E812E1A41B256E36FD2EB77988
Size 439KB
SHA256 2badbf065280e172bcabf5ac7a303fb53a5966d32fe8dfde23844872f22a9271
MD5 45e79e370ff5a1fabdb0e55fc22fa96f
SHA1 af6f3ae296656b5d1dcc10abadb667fd831087b1
SHA512 db318533758e502d485ee762c674c72ea92a9131076e3517d7c25e9331d6ba370e2cedff90910553556930424644760256691d265f12084493e82d1ee39ec9c8
SSDEEP 6144:wkl1ofbSq17hbJca98HriGaQoD/Tg4I7ewRPLqt0K3KD5lP8C5cpcCFH:NwjttGmPbie4P2tlKncpcCN
TLSH
T189A40956FE826A53C93503F140A723363A74D4866BE2F3272ECF7165BC593B90C619AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62FFD6395098C534E8F961836ED463B26D0A7171

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\62FFD6395098C534E8F961836ED463B26D0A7171
Size 125KB
SHA256 184b6a626c366291090965fb01a31e33a913ac28511e89bf8e2b2f63ec71a60d
MD5 bb852c3c79687a4f28bc65d452de9b7f
SHA1 6755d915b83c066e137148f318d1bd6d58074b5c
SHA512 3db90334aa228484c5af77ab0518fdfde4c6e81550252e61e39b00cb523dd89a019987b3378f486b5bbab411331883c49d26605f959abfbbbe0966cf141bd498
SSDEEP 3072:VBzx9uImdCeDZMuuwpiy2iP0sWa8Vv7ewrgf0VHAszZtcBbJ:VBzzmd72uu85N0s98BrgfgAszw
TLSH
T195C3127F22D3420B7AEB16709608D4EC3F0F3ADE437AA675BB50BA40CB05B7B2106559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 15KB
SHA256 e13e458b66261461d20e6e973d912e4e57cb22e5a6f36647de4de42721cdc4eb
MD5 5734e98366c604dc1143aed45c28133b
SHA1 27bb0f0921a6d757841d274d463e1798ceb89945
SHA512 15fa9df6affee4149ba04636b5409347b54f2847f35b7783823b8010a83ef8eb4b9be2d1d252bdfd4d7ccf9a95eebb4a4be374558c7ad8c3b674c597485930e7
SSDEEP 384:KyDcjgJ4IlP61hu1wdvNd9KVRaAcP+AWRMAb:bDc0J4IlP61hiwdvNmVAf+hRMM
TLSH
T1B4727D3A9B612C890723B1F65D7E1BC86D16B13B5BE449EC61093804D29CAFBA1FD4DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7163EA46CF3A4DDD4FE952F2D56A5FD2498B6788

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\7163EA46CF3A4DDD4FE952F2D56A5FD2498B6788
Size 1.1MB
SHA256 dc482bfd648f59256e007d6d59b015ddaed1e08b496297171fc27fff75a065e7
MD5 a1fb1c03a23bb2948831ef14ea0e4124
SHA1 7d09f6993f542b0b171bb8b1d022429c0612fda7
SHA512 64f26c71463fef00b2e6db3a5ef2c851aab2bd7556403d36eda0c6fd01d454f1b31ad85ea1e0bdea7402e99e5091c0caedd3a13c50d1f3f50926053414a60def
SSDEEP 12288:tlrgpvUZuauRTx7j730SDZoCYtt7G1OVC7Yi+ApMwY6NWhRaBy/u22mguGhB:tupvUZ0Tx7jCtWSCUeldBy/u22mguGhB
TLSH
T1CA352901EF441887C5394BB7A29773F1FA34944B1BD2DA2BFA187637B85A3369E81134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8342A2F1AA5FFC9DD20B6FBC977BF689A5BE1555

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\8342A2F1AA5FFC9DD20B6FBC977BF689A5BE1555
Size 441KB
SHA256 f76322c50c413092e879e8c03a6cd9f37832ae5688ab4b76c00032bb8112716f
MD5 f582e9b807666236e3623c48f7252763
SHA1 3e57342355d8fc0c5e3e055dc0f8878661ef76e2
SHA512 4f9e397910efdf729eda2053dc1010cfeb616c8345275feb94f1629afc63b0921bbd00a3d2cf900b706a1ad08ecc7a298c3483cee47457736bd065eb3bf7d85b
SSDEEP 6144:0ftgXS5qn7VXDca98HrZGa9V2/T9G4a7ewhfLitY7PI4w6B5v+V:0tQSiTqGWEhd4eYfetycV
TLSH
T1E0A4F956FE866E53C93502F140A723323674D4866BE2F3272ECF7165BC593B90C619AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8D3322EC8CEFFF578F813BCB55D5605FFADEE409

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\8D3322EC8CEFFF578F813BCB55D5605FFADEE409
Size 397KB
SHA256 3310cbaf9ccbcdd9cd20bd1dd6e1bb2ec610c08b99fc81fc3173866ca4eed999
MD5 f73a483072f36b0d7ffb176d83f473d3
SHA1 777c8ae7d7a7955833ca81eee4b4a70324526b79
SHA512 5dd4bfcf4cc5d8bd23be36cefda280bfe0f9f41c2180d42ba2bcfc46507729f5fd7d3c37894f3999854154b2d380c2294a483ccb6ac6e389a6d768e3276ca403
SSDEEP 6144:zlhnGFTeBW+VqWkZn6pa98HreaGQ6/TRDvAod1CYiXxxsKp/JYv+I:xpGZeJlaZdsod1rif9dI
TLSH
T1F384F826FE862E53C93502F140A723323B74D4856BE6F3272ECF7165BC5A3A90D6199C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92E063C7BC25F17A7DAE5FB9B993236A5A526F16

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\92E063C7BC25F17A7DAE5FB9B993236A5A526F16
Size 37KB
SHA256 b1b9bb2c1a0e799fa2ee75c64d09482fa26508a84de94367ffce09c8e60760c2
MD5 25d46944a1bf41e53fc7cc8c6ddf8133
SHA1 a32f5de431ae578315fe74dc7f1a9ca4ddc46f9e
SHA512 1fb59aeb055d6fc59d803c3e98f3a952e7cd622d14db8ca6b22cb6af41653946b042298b2748a8aa62c757da48f29fa37317783a6cc04af0343406b8ddcd74f8
SSDEEP 768:smIF8TIYNGsDIYg6yfPNek4HBvzwNktcomHpuJocHrYdsczzIC92xDA2VC92xDA6:8F8TIYNGsDIYdyfPNek4HtTtcocwJozS
TLSH
T1140309216F872773D03291784A1F5165FB20805F9BB1B2DDBAAD60947F307B10AA9ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9B2D7704D61A575B173DDA96CBC79161F5F66C69

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\9B2D7704D61A575B173DDA96CBC79161F5F66C69
Size 292KB
SHA256 98ca56265ddfc9ac7aa197945acad57f0697e3d94bffafaf33316923950129cf
MD5 a7fc4fc2264b5649f9080cabe9791f64
SHA1 b45b6a6e5c304c02a40a0f0c9fe47bac4465124b
SHA512 44ee842c4d5508f7e84ccf75fbd74f10ce3ed7c9abfdf13e976768137fd96297b6b1c4b477d6bf461c6495e54f6d864f728ca4308ba9f7e3ec4b50221b33a1b7
SSDEEP 6144:LRpakTDb8CwwU5Au1lFK7Id1hAvPQ+oglXfhcjQhy26lFMqzLQXWCJ6y2e8svCve:LRpakTDbtUCIKkd1cQylXTU2AMqX7CJN
TLSH
T11A542330CF7C992506E213E93C8D40D125B5AAC7B853C9E56ABF306C95E787EF8A5438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 7e26c240e46cb7b2315a42d16479df9611927ddfe8ed110aa61b338c9a87addb
MD5 e5d6b535b904f201ab2a63683f897c84
SHA1 65e82d05ea93cd2dc3264532317579eb0d74e6df
SHA512 6db4c5695480906fd6d921a943dc2ceab9978255681d8b0adec5b58553f2891c95e2640d40abc74cad38c13eb4de6ab92ade7dc1756eebaf5e6e2eb5b87ab025
SSDEEP 384:HalwSiO024YyqWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAvL+qS+b:6l8ZY7WTToXJWTTogB7S/AmVAf+hRMMr
TLSH
T17A727D7D8F013CAC2657D0E8C8B943598D18B6E7DFF5C02D22983E09CA48A5A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD9C733E4DC9E499E84DF611F825A915098770C8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\CD9C733E4DC9E499E84DF611F825A915098770C8
Size 1.1MB
SHA256 52ce2b036b8736f71146f74892a047580cbdb9a94f3a5877f65b119a7eeb1295
MD5 892d4b66819e0ef70770b48adcbf20d4
SHA1 648d08784298b48046c6712688c4c5d428780fa8
SHA512 7dc8ffe62e431141508d95f4968b77aabb2b3950e3dcf7c4453ea023d97eae787b772277615c69e97f7937a6b7cac9dcfe812d93bae058987fc0c95620512179
SSDEEP 24576:ic9jOiYTZL5Mxp7RMlxOiPTUOdudpX3/Frw:79BYTZL5Mxp7RMlR
TLSH
T13B351826EE556F66C96102B140B723363734D4856BD2F32B2ECEB521BC6E77C0E521AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EBAA12F1CCA3D5174976829DE41EBD7B61266A0A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\EBAA12F1CCA3D5174976829DE41EBD7B61266A0A
Size 40KB
SHA256 7c77dafc4a5817ea2d53c107999209901f0ad7b2114f8d9ea340c5146b7e1419
MD5 f806086821664ec0047b3190b8177b98
SHA1 7a7e192b33dee738f809e33ec0f353fe89aee07f
SHA512 049cd442a10fb00211b1d0866a68135a4e3dccfa7be2dc297e39ad97515455cd190641c4318b57ce5aac6ba863037314019399f5c3a6fa0daf61404e1575cc22
SSDEEP 768:ZvonUTpbWrFBRWPOC8wctTeTkzzrhDFSMV1hZtrKqJQLHOC92xDA2VC92xDA+871:K8pyrjaOH1nnrhhSY1ptuLX24+w
TLSH
T12013F2735CE0FA5586D1B883CD569D28380076D3E4F7C7ED6D44A6A1108017EF25E9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 d2d00a96d449f100f21c9b73b55cde4d0b6ee2d40470616b907ccd2b08a3c9d0
MD5 ae6c3e4fb6373b82dd1521a9d4be5c8a
SHA1 071597f3254aef124fb58b977157f0d8235fcc8c
SHA512 401de85cc9a43884bb2c4c79275d52767351762fc672a1637450df87537307998eabe1ab8c3ba4183a675d0c62470bfbca4870cb15835e75e21bd27b3cfbefa5
SSDEEP 1536:jTrli6dow7FDN78nbfqQr+NcuS7MFhP13u3Yon1l+Qn96VVvpEX4uYNjBnYbHJ10:j3lOnbfqVyewb+t3xPbSXF6ZzwipvF
TLSH
T178A3BFF6DBA2C93DA5FFC4296BC2893EF9263400B3A73009C9532754A1C6F787675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd7e109d-98f9-4d30-9d26-39f1b61ed5bb.zip

Path C:\Users\Admin\AppData\Local\Temp\cd7e109d-98f9-4d30-9d26-39f1b61ed5bb.zip
Size 3.8MB
SHA256 4449a0ec139e3b42a1d2670be8818b201101b6135dedaa582f00bd2bcc3128a2
MD5 03af10f775e3df5521a68163b662ecba
SHA1 1b62cb4e11f5e915c82fa244bc2b2261321bcc6b
SHA512 6c6c47454538ed142a78b807669b001ae72313b9edcd1ef8ac58e1bd990ef861b937eba13ef55e53b082b22b769143651b6b562ca3ca0bed15652c759ba386de
SSDEEP 49152:pL1MmitF7/u0Zbefl+MU+wQ9Vah5Ju690beFFQ6XaY9mYa1dnEA44miRq2ataToW:pBMmFfDa+ahnnY6XaAmYYEjloTouzb
TLSH
T11006E07FD67C160BC98F83BA85CC2FC2887C4FA68C74A75B6A7AB5715CA31E51B44840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_renamer_setup_4_23.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-OUIAN.tmp\advanced_renamer_setup_4_23.tmp
Size 3.4MB
SHA256 72d97f1b91170c1fc6258cb1f707f5fb2a8564a04814c41fec9099155ef428ec
MD5 fe3ede431bf88d8d72611eee0a8531f2
SHA1 3dd0e9055690a73448f7de0f8c6c5b4765a875f7
SHA512 44d41998d6de33c9dcb1749607d28f4c07c1eec0d840754fec4c0caa66bd374408c6fceed117e8b33f8739c08de4b796be1ee988f123fd4daf2ed3df37857400
SSDEEP 49152:PuAKxvISKIJhNRQSJ3MhjxIXhEzAWig8l1sXyKFz0ool5+UKL5333TBF:PuAK6XMXhKAWwLsXa0333T/
TLSH
T1E0F56D23F34D603EF06A1A399D379658583F7A606916CC5797FC3A8C8F361402E2A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-a08.xpi

Path C:\Users\Admin\AppData\Local\Temp\tmp-a08.xpi
Size 4.4MB
SHA256 5b74415860456370644bd80f16125e865b0e6c356bb5dfcfb84069967eaa5287
MD5 1fc6684b053587fe63536ca57bc8f0ba
SHA1 6c959574ecd18b264ac3cdac44986e6512b8c201
SHA512 533051f62dadab3fe6ff64fa6499a9b9f2ed97a904d4b6b5814c7db70e9fbfc6e6869a5bf686cc1ef9439682169080ce2dd246cd6978d2138e232730ce6d6dc6
SSDEEP 98304:QpL7rBSdycfiZe6QTUzB63CJ32Kao3OHUTRjPK/X2DLExlWdMOSQ3:evrwdycfiZe6fzBpGm3mUdSILErVw3
TLSH
T14D2633FAEF369C59C7779035A1528000D826C9405392F12EAD16B25DECC59CA4FCAEEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download