c762e366717cb812d856699d76405568e80808d55a9eb81120731df7c6f51af3

Analysis

max time kernel
133s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 966KB
Sample261024-2tkc5sew6n
SHA256 c762e366717cb812d856699d76405568e80808d55a9eb81120731df7c6f51af3
MD5 0529a6f0e551164b4160d12f912a7efc
SHA1 ecc0f4e4eb5039a2acba79efa95f4731232396b8
SHA512 9016d2ffa61510ef3310a531d5f45c95cade4897cbbb4b1ae06edafacee7eeea12ca13b199ad83840fa05022b6bf1e6fedeeaa88072982985d8008e77e5297c3
SSDEEP 24576:A8wABsZ8wpefL1eQCuUgHh9oYt3aSNJSxPHlGaUp:hw1xpezQQQgHhyYdaqSxNV
TLSH
T111250152F3A500F9E16BC1788A478516EA72BC16476076DB37A02E9A3F23BD05F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
3208	alg.exe
5748	elevation_service.exe
1164	elevation_service.exe
3196	maintenanceservice.exe
2484	OSE.EXE
5344	GameInputSvc.exe
1860	GameInputSvc.exe
1920	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\342e82cd9600bb.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25	GameInputSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25\Blob = 0f00000001000000200000007a9bc7ffecf427111c5a2e5bf589ffff1ee95fef12b3cc42764d7c907a3f6959530000000100000081000000307f3020060a6086480186f92f00060930123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c03021060b6086480186f92f00060e0130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b000000010000003e0000004900640065006e0054007200750073007400200043006f006d006d00650072006300690061006c00200052006f006f0074002000430041002000310000006200000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae140000000100000014000000ed4419c0d3f0068beea47bbe42e72654c88e36761d000000010000001000000066908ed134572466070299553e6e2b99030000000100000014000000df717eaa4ad94ec9558499602d48de5fbcf03a252000000001000000640500003082056030820348a00302010202100a0142800000014523c844b500000002300d06092a864886f70d01010b0500304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f742043412031301e170d3134303131363138313232335a170d3334303131363138313232335a304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100a75019de3f993dd43346f16f516182b2a94f8f67895d84d953dd0c28d9d7f0ffae95437299f9b55d7c8ac142e1315074d1810d7ccd9b21ab43e2acad5e866ef3098a1f5a32bda2eb94f9e85c0aecff98d2af71b3b4539f4e87ef92bcbdec4f3230884b175e57c453c2f602978dd9622bbf241f628ddfc3b8294b49783c93608822fc99da36c8c2a2d42c540067356e73bf0258f0a4dde5b0a2267acae036a51916f5fdb7efae3f40f56d5a04fdce34ca24dc74231b5d3313125dc40125f630dd025d9fe0d547bdb4eb1ba1bb4949d89f5b02f38ae42490e4624f4fc1af8b0e7417a8d172886a7a0149ccb44679c617b1da981e0759fa75218565dd9056cefbaba5609dc49df952b08bbd87f98f2b230a23763bf733e1c900f369f94ba2e04ebc7e93398407f744707efe075ae5b1acd118ccf235e5494908ca56c93dfb0f187d8b3bc113c24d8fc94f0e37e91fa10e6adf622ecb350651792cc82538f4fa4ba7895c9cd2e30d39864a747cd55987c23f4e0c5c52f43df75282f1eaa3acfd49341a28f341883a13eee8deff991d5fbacbe81ef2b95060c031d373e5efbea0ed330b74be2020c4676cf008037a55807f464e96a7f41e3ee1f6d809e133642b63d7325e9ff9c07b0f786f97bc939af99c1290787a808715d772749c557478b1bae16e7004ba4fa0ba68c37bff31f0733d3d942ab10b410ea0fe4d88656b7933b4d70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ed4419c0d3f0068beea47bbe42e72654c88e3676300d06092a864886f70d01010b050003820201000dae9032f6a64b7c447619611e2728cd5e54ef25bce30890f929d7ae6808e1940058ef2e2e7e53528cb65c07ea88ba998b5094d78280df61090093ad0d14e6cec1f2379478b05f9cb3a273b88f059338cd8d3eb0b8fbc0cfb1f2ec2d2d1bccecaa9ab3aa60821b2d3bc3843d578a961e9c75b8d330cd60088390d38e54f14d66c05d740340a3ee857ec21f779c06e8c1a7185d5295edc9dd259e6dfaa9eda33a34d0597bdaed50f335bfedeb144d31c760f4daf1879ce248e2c6c537fb0610fa755966314729da769a1ce982aeef9ab951f788239a6995623ce5558036d75402fff1b95dced4236fd845844a5b65ef890cdd14a720cb18a525b40df901f0a2d2f400c8748ea12a488e65db13c4e225177debbe875b17205451934a53030bec5dca33ed62fd45c72f5bdc58a08039e6fad7fe1314a6ed3d944a4274d4c3775973cd8f46be5538effae89132ea97580422de38c3ccbc6dc9333a6a0a693fa0c8ea728f8c638623bd6d3c969e95e0494caaa2b92a1b9c368178edc3e846e2265944751ed9758951cd10849d6160cb5df997224d8e98e6e37ff65bbbaecdca4a816b5e0bf351e1742be97e27a7d999494ef8a580db250f1c63628ac933676b3c1083c6addea8cd168e8df00737719ff2abfc41f5c18bec00375d09e54e80effab15c3806a51b4ae1dc382d3cdcab1f901ad54a9ceed1706ccceef457f818ba846e87	GameInputSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF717EAA4AD94EC9558499602D48DE5FBCF03A25\Blob = 1900000001000000100000002e43cb5682e3a1756f80fc53cfbff825030000000100000014000000df717eaa4ad94ec9558499602d48de5fbcf03a251d000000010000001000000066908ed134572466070299553e6e2b99140000000100000014000000ed4419c0d3f0068beea47bbe42e72654c88e36766200000001000000200000005d56499be4d2e08bcfcad08a3e38723d50503bde706948e42f55603019e528ae0b000000010000003e0000004900640065006e0054007200750073007400200043006f006d006d00650072006300690061006c00200052006f006f00740020004300410020003100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b06010505070308530000000100000081000000307f3020060a6086480186f92f00060930123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c03021060b6086480186f92f00060e0130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000200000007a9bc7ffecf427111c5a2e5bf589ffff1ee95fef12b3cc42764d7c907a3f69592000000001000000640500003082056030820348a00302010202100a0142800000014523c844b500000002300d06092a864886f70d01010b0500304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f742043412031301e170d3134303131363138313232335a170d3334303131363138313232335a304a310b300906035504061302555331123010060355040a13094964656e5472757374312730250603550403131e4964656e547275737420436f6d6d65726369616c20526f6f74204341203130820222300d06092a864886f70d01010105000382020f003082020a0282020100a75019de3f993dd43346f16f516182b2a94f8f67895d84d953dd0c28d9d7f0ffae95437299f9b55d7c8ac142e1315074d1810d7ccd9b21ab43e2acad5e866ef3098a1f5a32bda2eb94f9e85c0aecff98d2af71b3b4539f4e87ef92bcbdec4f3230884b175e57c453c2f602978dd9622bbf241f628ddfc3b8294b49783c93608822fc99da36c8c2a2d42c540067356e73bf0258f0a4dde5b0a2267acae036a51916f5fdb7efae3f40f56d5a04fdce34ca24dc74231b5d3313125dc40125f630dd025d9fe0d547bdb4eb1ba1bb4949d89f5b02f38ae42490e4624f4fc1af8b0e7417a8d172886a7a0149ccb44679c617b1da981e0759fa75218565dd9056cefbaba5609dc49df952b08bbd87f98f2b230a23763bf733e1c900f369f94ba2e04ebc7e93398407f744707efe075ae5b1acd118ccf235e5494908ca56c93dfb0f187d8b3bc113c24d8fc94f0e37e91fa10e6adf622ecb350651792cc82538f4fa4ba7895c9cd2e30d39864a747cd55987c23f4e0c5c52f43df75282f1eaa3acfd49341a28f341883a13eee8deff991d5fbacbe81ef2b95060c031d373e5efbea0ed330b74be2020c4676cf008037a55807f464e96a7f41e3ee1f6d809e133642b63d7325e9ff9c07b0f786f97bc939af99c1290787a808715d772749c557478b1bae16e7004ba4fa0ba68c37bff31f0733d3d942ab10b410ea0fe4d88656b7933b4d70203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ed4419c0d3f0068beea47bbe42e72654c88e3676300d06092a864886f70d01010b050003820201000dae9032f6a64b7c447619611e2728cd5e54ef25bce30890f929d7ae6808e1940058ef2e2e7e53528cb65c07ea88ba998b5094d78280df61090093ad0d14e6cec1f2379478b05f9cb3a273b88f059338cd8d3eb0b8fbc0cfb1f2ec2d2d1bccecaa9ab3aa60821b2d3bc3843d578a961e9c75b8d330cd60088390d38e54f14d66c05d740340a3ee857ec21f779c06e8c1a7185d5295edc9dd259e6dfaa9eda33a34d0597bdaed50f335bfedeb144d31c760f4daf1879ce248e2c6c537fb0610fa755966314729da769a1ce982aeef9ab951f788239a6995623ce5558036d75402fff1b95dced4236fd845844a5b65ef890cdd14a720cb18a525b40df901f0a2d2f400c8748ea12a488e65db13c4e225177debbe875b17205451934a53030bec5dca33ed62fd45c72f5bdc58a08039e6fad7fe1314a6ed3d944a4274d4c3775973cd8f46be5538effae89132ea97580422de38c3ccbc6dc9333a6a0a693fa0c8ea728f8c638623bd6d3c969e95e0494caaa2b92a1b9c368178edc3e846e2265944751ed9758951cd10849d6160cb5df997224d8e98e6e37ff65bbbaecdca4a816b5e0bf351e1742be97e27a7d999494ef8a580db250f1c63628ac933676b3c1083c6addea8cd168e8df00737719ff2abfc41f5c18bec00375d09e54e80effab15c3806a51b4ae1dc382d3cdcab1f901ad54a9ceed1706ccceef457f818ba846e87	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1860	GameInputSvc.exe
1860	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1044	2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	3756	firefox.exe
Token: SeDebugPrivilege	3756	firefox.exe
Token: SeDebugPrivilege	3208	alg.exe
Token: SeDebugPrivilege	3208	alg.exe
Token: SeDebugPrivilege	3756	firefox.exe
Token: SeDebugPrivilege	3756	firefox.exe
Token: SeDebugPrivilege	3756	firefox.exe
Token: SeTcbPrivilege	5344	GameInputSvc.exe
Token: SeTakeOwnershipPrivilege	5748	elevation_service.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3756	firefox.exe
3756	firefox.exe
3756	firefox.exe
3756	firefox.exe
3756	firefox.exe
3756	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3756	firefox.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4260	1044	2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe	90
PID 4260 wrote to memory of 3756	4260	firefox.exe	91
PID 4260 wrote to memory of 3756	4260	firefox.exe	91
PID 3756 wrote to memory of 5312	3756	firefox.exe	92
PID 3756 wrote to memory of 5312	3756	firefox.exe	92
PID 3756 wrote to memory of 5312	3756	firefox.exe	92
PID 3756 wrote to memory of 3536	3756	firefox.exe	93
PID 3756 wrote to memory of 3536	3756	firefox.exe	93
PID 3756 wrote to memory of 3536	3756	firefox.exe	93
PID 3756 wrote to memory of 3536	3756	firefox.exe	93
PID 3756 wrote to memory of 5796	3756	firefox.exe	94
PID 3756 wrote to memory of 5796	3756	firefox.exe	94
PID 3756 wrote to memory of 5796	3756	firefox.exe	94
PID 3756 wrote to memory of 5796	3756	firefox.exe	94
PID 3756 wrote to memory of 2028	3756	firefox.exe	95
PID 3756 wrote to memory of 2028	3756	firefox.exe	95
PID 3756 wrote to memory of 2028	3756	firefox.exe	95
PID 3756 wrote to memory of 1616	3756	firefox.exe	96
PID 3756 wrote to memory of 1616	3756	firefox.exe	96
PID 3756 wrote to memory of 1616	3756	firefox.exe	96
PID 3756 wrote to memory of 1616	3756	firefox.exe	96
PID 3756 wrote to memory of 3248	3756	firefox.exe	97
PID 3756 wrote to memory of 3248	3756	firefox.exe	97
PID 3756 wrote to memory of 3248	3756	firefox.exe	97
PID 3756 wrote to memory of 3248	3756	firefox.exe	97
PID 3756 wrote to memory of 4612	3756	firefox.exe	98
PID 3756 wrote to memory of 4612	3756	firefox.exe	98
PID 3756 wrote to memory of 4612	3756	firefox.exe	98
PID 3756 wrote to memory of 4612	3756	firefox.exe	98
PID 3756 wrote to memory of 1808	3756	firefox.exe	99
PID 3756 wrote to memory of 1808	3756	firefox.exe	99
PID 3756 wrote to memory of 1808	3756	firefox.exe	99
PID 3756 wrote to memory of 1808	3756	firefox.exe	99
PID 3756 wrote to memory of 1340	3756	firefox.exe	100
PID 3756 wrote to memory of 1340	3756	firefox.exe	100
PID 3756 wrote to memory of 1340	3756	firefox.exe	100
PID 3756 wrote to memory of 1340	3756	firefox.exe	100
PID 5344 wrote to memory of 1860	5344	GameInputSvc.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0529a6f0e551164b4160d12f912a7efc_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {424fd461-0a47-4929-acab-4fcdbd607a9d} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27133 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {722fede7-4fc3-48ad-b592-8c11b3042bb0} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3912 -prefsLen 27323 -prefMapHandle 3916 -prefMapSize 270279 -jsInitHandle 3920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3928 -initialChannelId {b6d1b2d3-4350-4bb5-9ce3-b04f87582a11} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27323 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {687ff575-49c9-486e-99cf-631c588574ca} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3148 -prefsLen 34822 -prefMapHandle 2928 -prefMapSize 270279 -jsInitHandle 2916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {07a13837-54e2-451f-be86-902c4b3458db} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1616
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5140 -prefsLen 35010 -prefMapHandle 5144 -prefMapSize 270279 -ipcHandle 5152 -initialChannelId {9c20865b-a421-4c4f-8952-d05e0be083ad} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3124 -initialChannelId {ec991adf-acd2-461d-9552-f2faeebbb20e} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32952 -prefMapHandle 5668 -prefMapSize 270279 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {2bb0721a-b463-4b15-ad62-e5daebe5196c} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 32952 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {1c1543e2-f310-4a3b-83b1-d1e7655d38be} -parentPid 3756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1340

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1164

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3196

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2484

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1860

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:6024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2804

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:4152

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:3448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:2380

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3768

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2120

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:900

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4928

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:3028

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:5212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 36b4f16531e93ffe33ee3ec8f0d9ce80b271cb438dc578da8b2d8cf018a87f35
MD5 5009decaa1bf3b294c85e9fabde32e5c
SHA1 c96849eb5849330f1703db668ca217e5aeabf177
SHA512 ad230718c87868a15a383a62be0eb7822249c169d24a4d93dab041d3bb7f2ed4794ebbf408b744f62309be949c4c486f363827987234660c51194b22ccc29ce0
SSDEEP 49152:gb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnzQQQgHhyYdaqSxNV:K3q6gjBcfQmhyYdaqSx
TLSH
T1C1D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 6eaff10c0ebe28fc65a81c2f4322f66d41b956aed0c0327bd8af3ec6e7cf743d
MD5 a7708a990864d5944a139780212a3dd5
SHA1 06bbc1a3783cae1fff2df78e0d1a26bb2265ad94
SHA512 8b5b4d23daede1bc4bd3dde1a19dd53488912f60f4c13c845cfd9b3ad8bd9921b7af491856931ba441789201b0ae705bdf6bc41a367343f335bc3d77a5868551
SSDEEP 24576:4XYKytczA9L1eQCuUgHh9oYt3aSNJSxPHlGaUp:htcIQQQgHhyYdaqSxNV
TLSH
T19A050129B3E004F8EDAB817DC9A28515DB73785143A0E79B03F499661F233D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 700880d33b0d9d4c096fa52139d0935cc21d2fe77ac4ce726898ddc65868f8a2
MD5 0edec5a6cb6c949ab91d288b5d9a00fd
SHA1 c173828a1e384bd9b278ee78d2b75aa821c9a35e
SHA512 47e65edf7d42e3aa11543c935a207a366a7065ef20741d8599a7440b1dee2a8f54ed3b6bd321d16d6578539efd7e0fc92c08e6b301961c60366459ddac04edb9
SSDEEP 24576:60Qen+z0hWxOrMyL1eQCuUgHh9oYt3aSNJSxPHlGaUp:64+z04oLQQQgHhyYdaqSxNV
TLSH
T144359D26F6748335D073C0B9C5D2A69AEE72308257308ACB1286D77C6F677E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0640c672636fd417317cb9d15f71f24575d0cd16f4ba9edd97806ddd9c80f0f7
MD5 360b0463b5242e3794257ba2c47835e5
SHA1 d1e16ba4427c21230119a592e7dbd006b2328cb3
SHA512 68d994c0d17cc02a63a382a575dde1ce40fedc8915ec372d7a06509f80b148065697dd2716b6b600805076dc40624dc39d7280daf9b04578f2aae2921185954c
SSDEEP 49152:h/ezSC6vUzPvuHjy7QQQgHhyYdaqSxNV:hezSC6v2XuH6fQmhyYdaqSx
TLSH
T110756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E58636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bbc7d4d24df8092466bb8042d3ac906506f5e079229e5e07634d2e193f8910ce
MD5 eab46eb9c2fccc1541f4e945f3fbb911
SHA1 d652cb5f066f91c13226b194824e7f13d9a8285f
SHA512 d9610b08c00d94026376cdf42d386312cda38e2e591dcb6392b49c956d0193825eaf674045b7c51b63b2e5a28199b7f84065ca4ed7950d88f6f30f37200226c6
SSDEEP 24576:pabzPMLvgv/l+dIL1eQCuUgHh9oYt3aSNJSxPHlGaUp:pakLvgXl+GQQQgHhyYdaqSxNV
TLSH
T14F559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 c391aa6b5ca0cd5dad221894cbde40ef8b5fde1202424f640e9e1475025a26f9
MD5 99c20e134b11331cca6ce31e524112f6
SHA1 b929c200a39f76d97775e491c6aa7e24b0a56535
SHA512 7890a631bf80c50e903cb1093471196ab07ad9971b83bb6f6991e4bdefe394600d11aa2ef6fb9c290346b078d16f673b1361317706d5ed1c6d0efbce36777931
SSDEEP 12288:Qf3L1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:Qf3L1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T124D42393C3109034E6DD69F2865FA9758FB16C31A2C527F337B27ECA9E52240D7A1392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 41759b775cc28bfc05930e96b3c60e024af338da2f0d2bfd0e2dec200cdacab0
MD5 897223473d1654b92d52ff17d7fa700f
SHA1 661ab0742758e2a50887b2f36c561fdd3ac424e4
SHA512 ca02ca1796424ac124b0a0f4533608bc406dc658ced2c4ae9cec06aefda7609c9173a54219a3ee3f51efa0ea72a2350fa2de11c5aa295686ccd1326a81d89014
SSDEEP 24576:SJIUhL1eQCuUgHh9oYt3aSNJSxPHlGaUp:SJIUtQQQgHhyYdaqSxNV
TLSH
T1DB15DF7BEE28FCE2C27E9DB94A918600D77278304B52A3CBE175820EDE135E05E75D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 f0127c6d52de608009fe7b1c337e114e01ec649826f7013f373f480d517addc5
MD5 3fb117d249b9269cbda12e9714ae7bc0
SHA1 acc9fd383395ac1234b875a88e8af3dfbac43c0d
SHA512 668a2d6ec46b68d6e569ebf9e856e2598f042d88a322cbdde255aef8e4ec42eaf13f403db159092ea095eb85c34fe5ee424dec7ba95a9d995375cdfa1fb64dc9
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J+NRV3TH:XQvGAdlCEL8c/DRNS5C6fQmhyYdaqSx
TLSH
T119367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 17aacbc8feb3da68d7d8700c08e140b484be6c20335072db4fa97e898bfac361
MD5 47ba834716fefe09003cc371a2f09a98
SHA1 458523ee4215384beae6857c43b3bc0afb4f2b06
SHA512 9e5d62667a296f09b0a6aab96f46b4b9b3fe4789f52a376ac4685757582c510e80439ec34b6bfeea03b1735c9efb758f19424efbc81d4c45c1c5b92eb2bfa176
SSDEEP 24576:pmewsAjML1eQCuUgHh9oYt3aSNJSxPHlGaUp:8lj8QQQgHhyYdaqSxNV
TLSH
T1B415E031FA70E036C2BF0DB61B26D716587D79204B912AC3F3E89E8E59202D12776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9a47827dbf14c0052564b7945911f560c6678e22fbe1aa63e468ae3a0a09d6b9
MD5 44e0d87ead64dcaf713b70a0c2857395
SHA1 f2e168ecae524e9b255e7466af32a7f79e1c3f73
SHA512 b9abc4f8357d279bd210acde242640b3071afd57805b587270c0344cd03b09d0f09180ecbbe5c7eb6630926fb41927ffafc15c3433c70342a05c1dc8118ed481
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHsha:FUEtQevvqc2W1cpV2X132o
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 97685e32779e6903b85e4b084f7e773690a9406dea44adecdc9b251db4a1acad
MD5 cfa8fd7508efde7465205c976df78739
SHA1 5098862ae1859c8e05c2c9996155bc2fe997d053
SHA512 da889707354fe88cb35c8380c323a74ce531d4f45e113d403543cc712fdcf094546273cd1da917a0079f7053982becdae73947e49e10c965b23490280a6dad04
SSDEEP 49152:H8bRquA/m2yL5zMfFiV+XenmE3/ztQQQgHhyYdaqSxNV:+oq1VjnmefQmhyYdaqSx
TLSH
T1E8D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF5266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7b47bdaf0ccb3af035573f89a8fae0817e5d45b9d6eaa4e441feecc7279cdda5
MD5 7a644b9a5ea1079fb6d2e3df7cb18fa7
SHA1 d39c772dbbf2c581a236abedf81cc3e16a646b20
SHA512 5913f1cc42cd9f5ee4532a7fc282ebb397da472aef7005abf6a54f2f1e2567bec731c9766e3702b769fbe33e033ed19217889e4cc79671c1c7df56933d511a32
SSDEEP 24576:BAhGLvOFoiwtA5l7S531L1eQCuUgHh9oYt3aSNJSxPHlGaUp:BAM6Foiq5hQQQgHhyYdaqSxNV
TLSH
T19545AE81E7F555D4F5F3AAB899B69170EA76BCA65E31D20F2260D10F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 6a3526ac2733439d5991d2f8f4881f3192409a32fc5034873d64d5ff833d251d
MD5 8d3729b3b0ab6fc52b3d17500bed0900
SHA1 b97c89ed25fc235033b6d74068dbb3a1f9f2f3cb
SHA512 f9c8ce14ee5b113c264b17165e4f5208aea61d2060e6e5c6d3fc01fd4829572195faa16695273dc5de8f1820659ba9e66b14bcc762cd2ceb5df0192a5e8cdca6
SSDEEP 24576:Owu+OWLL1eQCuUgHh9oYt3aSNJSxPHlGaUp:OwlOQQQQgHhyYdaqSxNV
TLSH
T1B905014673A00CF8E9A79579C657C136EBF2BC122625D72F17B0C65B6F23350AE29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 a51ff5383298f2e629e7ef943a8e712c02b7c34360f074497c492a964b61c71e
MD5 c7c8ad6edb81da4d0b484cbfcfd15651
SHA1 290c512b716006010c0637ff4b8face4c7db99ce
SHA512 d32068bc6b39e2227cca987524402bb5cf2a5cf90fb1e151c9b57beac9cc32fb8a931b84cf325c84a4072729b969c377cfbf34e810e8e6aeb1c241d39cc78434
SSDEEP 12288:MWv1I5eL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:dvu0L1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T1B6E4129623A060F8E1DB91B9C9EA9615CBB17832637653DF33B1069A5F237C05F35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5dd3bc77357a5b49944406e9e9e8bfb533f9386a2f751d9ce899bd5237b04ff7
MD5 90d5de6c06e8d89247d0863841554512
SHA1 caa3fc001747b9b064e3d0f25f049420046f6124
SHA512 631fcf1bdf1919004e87af6a8d3904ba23a9d207310cb5f0a739ec53ecd421f59f6a36f08f9c74551548e64654b3cca9016b6321e6a79fc1a4dc9d55d53d098a
SSDEEP 98304:qQRQyi36YOcP8Lvw2gAf+PN3gfQmhyYdaqSx:BQyiKa+X+PNQha
TLSH
T1D9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a389fd1db77f342d2751da98bad4699484da8e1781f0245620e6f8a91a036c16
MD5 c6e7884e4338b09b4c98031791e921dc
SHA1 05baf28071211ce20475b85f7c22dcb8680cf93d
SHA512 9b501503670d8d55beb5db3a1653a65e60761f0abe12847c065928ebe62b83441f9585c436620f14cd0fd9ea2294c6694ad77999be09f49f4634b476cffbfcac
SSDEEP 98304:qQRQyi36YOcP8Lvw2gAf+PN3ofQmhyYdaqSx:BQyiKa+X+PNYha
TLSH
T1D8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f4eccc20a3d54ccafc12d797b5574fa4be430513aa15a8b57a776dfda082cb9c
MD5 be7a0c3d044db53f4ac06f5c039829c0
SHA1 610ae2e2cf2a475d6c1063263eb713dd20038655
SHA512 9cfb1f0633c85480ea729d08fed840aca71b88b214138196cd46c7292eda874b8963a0853e31678d37c90698bc6601c115bc6dc905efecde097f5bafd03e39c0
SSDEEP 49152:B68Qg55nhMeWu7PNU3/5QQQgHhyYdaqSxNV:/thbRc/5fQmhyYdaqSx
TLSH
T1FBB54933B2F200A9C44DE1769F4A973196E17C718FE1E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3311b91a9caa7ac7ef6350e598633eb5833f063244198007a86e63aa6aa4926f
MD5 19633925f01669dccf84f045d44e7a28
SHA1 da5ff59fbba4251b02819910a219ad4efaedac25
SHA512 4f13a6a458d45edba9d2fe10787160a1a13554b05d05706759a5d3a93fe4bca7cf3089d49a8244e6d74fc398194d27b166d7c7c1b5ac54c1164db0ef1fd6b033
SSDEEP 98304:ly5112gYy5azzVv569nLKnhZgfQmhyYdaqSx:ILIHAWhuha
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a8fb6cf7f5e0c138270edf3fe3e6019626350b04e4b6fe5777f0d4dbcd546828
MD5 e8320168cb3a1f1859057f38eadd27d7
SHA1 45bd9479bbcc67bd8e12a50a540a258f7005b743
SHA512 c0a4415c525ae1456715de0ab80b49579c6ea19960dad624dd070e38a6c869f10f0b39ef25da64064fcce96565d4a8c96eb54010e63ff0306196e63db8656374
SSDEEP 49152:rB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl9QQQgHhyYdaqSxNV:9u6JmTxd2d9fQmhyYdaqSx
TLSH
T184D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 db369152604ae598d385e7eb0f4f8c9afff122c355e3604744466376b5a04460
MD5 2065d06ead8995ed55f1dc0be30506e3
SHA1 6c2ff47f97983a27842d25713a4235d018ff5728
SHA512 3006f7d77c396a5e9bac309214d86f631a3dd33e1539540c8f0d478101a4e73a97bc519f5b09db6dd7199b8a54385bd8d160216c80ee0c1decb65be27332de6a
SSDEEP 49152:g1hpsNoJpF1A6UU44CwH7R4xsQQQgHhyYdaqSxNV:gmifPbRhfQmhyYdaqSx
TLSH
T117B5BE13F29900E8D05DD178875A9632EA72BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d14a694269e9b1e7ba634b7a7b61db1d76cfcefd2ed2f08a1fe1e755349a9fa4
MD5 0815565f522eac18a400622ba57b77de
SHA1 d576a35c9e22839dd0180aa22ddf06c17dac4dd3
SHA512 c214e22843f5fbbd9d3a175ccebe1063eb6910c3f35284f04c68945dae4d97a64bebf095d7acc6cd1dbf385c90829e75b4baf31db6f39fccdd1b33d16d2f421e
SSDEEP 49152:ESuZQIY0Be2K6RVtOnks6NMHqYQQQgHhyYdaqSxNV:W5dKoi61YfQmhyYdaqSx
TLSH
T1DEC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f5ceb7007e80088b6ffca9a6a0b71442f3789b3b627f9091c5ee014d36ae74ad
MD5 872c72f32b3dba9b1b987576f9c08cd8
SHA1 cf0c2a517c0a9cf70f29a0f495041c13a6dd4f99
SHA512 d06416d6fd52a77f36c062047858a131c2eb1b7d253b62c30910f5b6bfa189998af7d89d29a696c15b75b4ac67434617428617f099e4c6f76439449e995cc8b4
SSDEEP 49152:38YSn8EApI0figTgiDn0AP5wAQQQgHhyYdaqSxNV:IX2iyphxfQmhyYdaqSx
TLSH
T178A5BE13F2D900E8D05ED179C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 c106dc03a13100344b5da201361f7f6643eaa38093955e082484d8b189b6b436
MD5 ee9ac420d0d29d0e8e48c47aad401ea6
SHA1 d89f882dc147410f88f7ef36e5b38182c87c0d1b
SHA512 2d722950ed39251ecb2f4c3ec305ad9f8de255d972a296ec5b3fc34c9bb00ce6a2b6e62f7a66aec14a1f29785b88086b383812b660f8a713e2cceeebe20d026e
SSDEEP 12288:48L1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:48L1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T147D42393D2528078E1CDA9F2864FA5A98FB06833B3C623F737E7198A9F423445791395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 bb1b0b84c8e3ddaa2a4d3d487c9c75805957fbd8edca677edac5a4873e193ccb
MD5 965c959dbb7e06b93fb431f26d4be723
SHA1 b8605136a27614c2653b9d6538401ef0ebf15900
SHA512 4f2c2d6c733f91fa2d5b37aaf1137e2ede6dfc59a6bede1f0f587df89d5d2440c2d5ab17be72cbb3bf8df60b2bf7293849f6076fd1a83b44ba40f771888633d8
SSDEEP 12288:ukL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:ukL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T125D423A3D2518078E1CCA9F2864FA5A98FB06833B3C623F737F7598AAF423445751395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 128e47aa9a2f180fad5bdba0b7b61726f39093a571a1e0fa1f88add276d88059
MD5 607371061d47de2606bc5fef63615fcd
SHA1 cb7a01283ad2954d0cff817a527a19c3ca7f7d23
SHA512 c5c6ebc11a32cbfec5c2da8f522250ce1054440ddd39b6d470063e68788d6d8c6d44f9b5155f591481df0f98d84b0ba358445e2ed3b29f98d158706ce5756ba5
SSDEEP 12288:AGIL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:A5L1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T153D42397D2528078E1CCA9F2864FA5A98FB06833F2C623F737F3598A9F423445791395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 ea612211d7b8d32697f72db1d959dae78bec425f69a3d671e561200ee5fbbc44
MD5 1a27f95458027bdac996fafce0d8a0e6
SHA1 bb2683a55d12ef529d42df2cde3fa764421312ca
SHA512 d2bfaafe5a20d0cf80e4ab28d8c66473099f0ea9b12de76653c2556962a80b377ea7bb949b72181a2438db7883263c715f8b052307392d88f53fc3095844ab99
SSDEEP 12288:2lNJL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:QL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T16FD42393A36180B4E4D9E5F6C65BA565CFB17C32F36223FF37A2098A5F523406B60391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 d424c6d026bfc6f92fc10818412b7a479dc03e251373703473e7ab02f33d1908
MD5 d60b0572b6ecc85fe03a2044d2750a2e
SHA1 9a79370161506ab174ee84b140d382876838e687
SHA512 e1847cbb3ccfb69209390f0304c331aad76f9c34879eebb334df8f716bcd415868a3d8686dccfefe26bfe4094aa2d7ad9cdd0ec8e76631c678f0a2b915915e3b
SSDEEP 12288:vwL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:vwL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T10FD42396D252C078E1CCA9F2864FA5A98FB06833F2C623F737E7198A9F423445791395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 1d0e8f7622c06dbb3ae7e542a2cc5eeba5c96b6c619bd01fa80d04c69b1fce86
MD5 b5d611d503460a4afb01013d3e093b36
SHA1 036c07fb34f2e2236b0ff6f23866ffa22c40c4fe
SHA512 a0dcd9f0d979958ebf1d4d6aaf7e5f163c5a883666587336ab9d591e8917621713f274a4c2feb6021fff77f52a96ba6bdde4c8075d6b5a0fbb3a0b0e422c5f67
SSDEEP 12288:8TL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:8TL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T19BD423D7D2518038E1CDA9F2864FA5698FB06833F3C623F737A3598A9F4234457913A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 94dc62b3d3a1db101220bfb5ea6b906aeaa622e6f023602837dfe7f32aedcc92
MD5 f6e0d94f37375cea062768b1a645fa85
SHA1 ee41da6ed5e9bcbadfcb7bc0329cfd15ec6a8d03
SHA512 4ae60bcc9d01819790eca114431b7ba0576d1c748394a7bcf6208879d73bc49a4ff8a4b156205dd916467e4fb3e21d666f0f2908d0459967c36376bffd2e2c21
SSDEEP 12288:XXL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:XXL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T157D423A3D2528038E1CDA9F2864FA578CFB06833F2C623F737B7598AAF422545751395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 6d002441ff3122cc4a97fb8f87ce32696b366e87926620f24fea66d434cf9433
MD5 8c675d0edb79d5bfac4a423e9cdacbc3
SHA1 5a60cb6428159699794b98ff11b703cb5d3765d6
SHA512 73ebaea94e78420928994185bdd83a580fabf8d798e5974226cfe650d7801d1e41731e025f80e3f5f626d5c146d5dbf69da93feb09f2db4e6b1da4bc1f5df678
SSDEEP 24576:BZMUzFgSfXL1eQCuUgHh9oYt3aSNJSxPHlGaUp:BZMUzacQQQgHhyYdaqSxNV
TLSH
T169150195B35018F8ECA7817EC9169916D6B27C2607A0C71F23F4366B5F333601D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 ef641940d58bb771904ee117eee8bd6b08971f97250054f6cc216129a4699e4e
MD5 3db615d4b3129855f5f7689ae21ec85a
SHA1 ccbb9234423a7173c78444b1b17023aec593fec7
SHA512 cb46c19dcb3a2ff65505db90ad042da8e873c7a16adcd2937462566c22c23730fde95f3761986a741f13d587b68e9a1eb6403e7d023b4bceff4275a19f218a46
SSDEEP 12288:C3kL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:CUL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T170D423D7D2518078E1CCA9F2864FA5A88FB06833F2C623F737B7198AAF423445751395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 df197b1283f12c7e38398397b6782a52361ecd82c03f6860d1b35527ca05e980
MD5 b94431e402e49eb4a2ba1b082c1bb3c0
SHA1 ca286c9a6d059f1e9daf429d9ca00cbcef70ab72
SHA512 da3e0926626cb97f7258bd581eb39b8c8410d5ff4bbdf5957fe009a7915e9e6c3f1a4276d2a0aa5b785862325dcc7174bef826f00c7a30eeaf7dd8746d345c5c
SSDEEP 12288:MqkL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:M7L1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T16CD42397D2518078E5CDA9F2864FA5B88FB06833F38623F737B7198AAF4234417513A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 f27c47142f674512d263b1c08299702bca55595deadfd11dd1c4f71b2915540a
MD5 22ae24e4b424fa79b21c93be02c2362a
SHA1 429ef122aca4c4086aca3e5d40fdd8c111ca69ad
SHA512 28e4ae042cc670c257a8cca72dea375922339282c84a166aa85d50a666fc1a2c7ddfb9b7d0dde1b522fe79a6bad7d2699b36df8d0184f9a49380c04d675be2ab
SSDEEP 12288:o8PfsLXZL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:TfyZL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T110F4125773A130F8D1AA9275C9561A15EBB1783253649BBF23B007BB2F133909F3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 e39148dbf28d079e14ec887ce299a279c38b6b4a26cd64d4e719b4cd7415aa19
MD5 dacde312842edf477ca566c2566ba399
SHA1 e26d2b0305d063aa1cb34e819d17e2a7b2783ce9
SHA512 6f74b1189fafbef1a7afc685325495b81e3dbdb25fabc92211ebae244b479cb4b5fe4c13f205d1cc72293c219981b4a51532b5d0e8b3424bb6d0f0b28d263552
SSDEEP 12288:uSL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:uSL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T10FD42397D2118078E1CDA9F2864FA5A98FB06833F2C623F737F7198AAF423405751395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 9b66dfb8547d7ca56d8feeb42bc2f8f8bc19f8a6a7cdfa40397c8a54be36d3d1
MD5 6035a8f84ab33e42a4409c127bd7f326
SHA1 76f01b475b68d4eba1fcd4db894e2517bbd776fe
SHA512 a3046d58ade3631df4739111e856bfec5c3b6580fe4e1b515e99921253595fa32eef2b7906cbcb35099ab79a96b9c300ea7758061bfb9db0e034a56c660caf66
SSDEEP 12288:S3L1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:S3L1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T188D42397D2128078E1CDA9F2864FA5A98FB06833F2C623F737F7198A9F432446751395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 5fdf97f7e90d313e9f7902feab5b54136d5219a6199f2304b018c0c6bc825444
MD5 96827c6407daefa20908694e14368034
SHA1 351134cbb2c941e29f12dc50a059048111e0d39e
SHA512 8dda8d7b6841347c8939073745ce81e45674cba84e04f961d629ef42ef71713661cd36abf01b81baddf13cd1332ef4c1feb408942202048f2a45beded9c473e6
SSDEEP 12288:x8PfsLX6L1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:ufy6L1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T19CF4125773A130F8D1AA9275C9561A15EBB1783253649BBF23B007BB2F133909F3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 e48b66f679fd7d182712e69b6ada954ddd922e73151eabe7f095d5ca57746d92
MD5 74cc0a60bfaaea3cc1d76a0bdad76f50
SHA1 4f955d0b181bddcec26eb62f7875d9e3bbd89cd2
SHA512 a136eb3e7b14bc07e3d064ba0ff1d5a510f2155f93664e1c7fb450ddf5b12c31b5213adf65a6ec35033851a26a03b5df4b5e00d9a4f16b50360f63fe13a45862
SSDEEP 24576:cTRaL43z0zaPKL1eQCuUgHh9oYt3aSNJSxPHlGaUp:cTML4j+QQQgHhyYdaqSxNV
TLSH
T19A1502A5B35058F8ECA7817EC9568916C6B27C2607A0C72F13F4365B5F333601D2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 f8fc576bbaa44b738d0d69734c62e570f81522b53f997d62c68bd81f1650270d
MD5 54fc08a5b5cb3986d73089dd41d99504
SHA1 9fb9280730149db3931265ccdb79e7ff8d2a30fa
SHA512 a5c380841964cdff987218ff33e502e7c7f65c18015ab7b4cba44ead7b04a1546e29a92dd81afba0e027e0f71c10f33783ed7ec7e737f71156dcef9e892109b8
SSDEEP 24576:w3sdRCHuy7eq4L1eQCuUgHh9oYt3aSNJSxPHlGaUp:6sdRCHuyaDQQQgHhyYdaqSxNV
TLSH
T16235DF90F3E410E8F0B79A75C9765511CAB67C6A1B61DE8F13A4265A1F337D08E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 0caeb4b1ca134ab13dcefa112402c9776a96ee93b277104f1611316e1f2c6d0f
MD5 703e2f78af468605030f24d55fc9f2f9
SHA1 526b27894330a62381f602f7462d804a686b0f2c
SHA512 80627967aa51f205fce0574b8656dc3ef0d9caac3533c1972bc51593fbb893cc72ba84fc17f79162659621e47fd9f958f4c3821f150a0e7478250b38d2aa40f7
SSDEEP 12288:q5L1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:q5L1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T109D42393D2128078E1CCA9F2864FA5A98FB06833F2C627F737F7598A9F423445761395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 728a2a60ccae4c58a6cfbbb6090be980ec214b8a0c5468ff0963d77806d5c9d7
MD5 012c54656ace98650cf17bddc4e0b84a
SHA1 7e7a4e6231750b0550c6d62a550076c462171572
SHA512 81f4c93479c6f37b622ef087951eeb4498515c275de8ac190164cb2d6e7aff9af02a1c0c87ae1ff7c1961867c28500889526f7f9c7941ad54afb88f4def8db8e
SSDEEP 12288:gdL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:gdL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T11FD423A3D2218078E1CDA9F2864FA5658FB06C32F2C627F737F3598A9F4634057A1395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 1170a4733a084e400c4e0dcd8d68f6c35ab45d776a2f8538fb1ee650f2e5888b
MD5 269e048c7aeb9121c15373ace8256122
SHA1 55d026543b355ecfb65ad8de31516c9a09b3ae4b
SHA512 dcfd2240081a4ea47a2072a8a64b86276bccc3b13e33b00f385309eb74bc518ae974f7f04cfe7f1b53479843f7e7e90a1fcb34bec39f692db73aa07da76f7526
SSDEEP 12288:HeL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:HeL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T150D42393D2118078E1CCA9F6864FA5B98FB06833F2C627F737E7198AAF432445751395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 f532664b1390fb468f0c66f59ee964da148c0b03d0708c5409d13d4d3fe57dc4
MD5 6d521a41b93c848c0b032552a6e6daf6
SHA1 e1f6a26871aece04a73d2558ff7f9595200ce8b6
SHA512 ba51375588c157eb488eb8aa8efd315c0a00ba9b8a3b1d69d7b41d70c59a42607a1a79a6e6f2d79b0277f12d722ab0d9197a336387ef0380913e968906fd73fe
SSDEEP 12288:+XsffL1jKQCuUg0G6wWs847cYt3ktxFSPlOm2FT2XLmioPtFzDeE9QaUpy:FfL1eQCuUgHh9oYt3aSNJSxPHlGaUp
TLSH
T192F4015AD25040E8D0AE61B5C74A5A40FB737C2193E1A3DB23D1F97E1F762809EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\activity-stream.contile.json
Size 4KB
SHA256 1a1ee44494c3cb17b5b6925263aa691c8110552a9a7a28cd99e887ae222cbb22
MD5 b06d00427fc467976f81e84ca1306533
SHA1 bacddddb0217ede2d64e5d807d2feebf56c847b3
SHA512 d8a542ee9da26fd3fe0d31c71c9c0e0967ba1b0e1ffd54cf9bb4ce4f20e36a030ec6e690e6a7df27df9c033112b47d9468b44d6a383ebff50a603fffceea924c
SSDEEP 96:THkoqM1Adomu3oBen8T+mRzmonDRM4LoWOtw7e:KMGC+A9mRzpDTje
TLSH
T13DA1A65F843484561B30D2E16C2F279CF107B005A9F08AB8B199EEA1557C7AFD1DFD88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 11ccb21eeb38764161bd9d65af10a0ede92a39fd55a4146e01a93dc9906b6a9c
MD5 07b3d2de86c97c8486ac3c344ccea69b
SHA1 3372b6068e7dcbe820540f3969d8b55052be4686
SHA512 84794ca11776eadcd0a79ace0f0df20b304da36d258f8b5b4ba2f995b037654fca152f93c8f08fc2bfaa081a2d8ae2abd30a58e03024ac69a5990cc8947b5de4
SSDEEP 768:SyeLjYYGUCZaEvZsoiv515G7o3OOrivdIUT+GkaF7vXF4TOu:peI6CZlZso2XG7ocdD6GkakOu
TLSH
T1FB730BB3A6E8B2BB0B9037C72C0FB99766D25145E38505CDFCEDCA1C81DD654423A6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10311

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\cache2\doomed\10311
Size 258KB
SHA256 9c7b0fdeb25eae76e212e31497ca037ee0b4c53ae5df4595f326e4db4ff09e51
MD5 0f97342246189e7e489b03afd6536e7b
SHA1 26968c8fcc78f0d6256a1c78681c92c39d5a6a33
SHA512 cb42424a64eca039d6e1a98b56664ec98cf7b4392cb5e0e5d3618ef49348a015036185bb2e065db78371e7bdf9726c2903e1a8b13d34fb4144d1ba181164f883
SSDEEP 3072:PUVzNBZRGc+OSrFsorlmWQKsg7IEIfX2Zj3J:sEcbCsorwE5
TLSH
T19E4407F3D6AC70FB075296DC6C0E72CF62AF4139DB5208DAFC68C148D2C9A65107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22551

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\cache2\doomed\22551
Size 52B
SHA256 9f27feb84ac67bd335f25179a9d737a53b83145e7d48415f6599097dc9feb544
MD5 d8870df98014c50cb73ff28439af7705
SHA1 5d5431ffceab631fa7020d33f001272c09e18c8f
SHA512 849888ab8e5f51ead8601f976363be389f17b99276a1062c25857fd9da2da2aa68c42bde3d70f8f53501c2bcc015c50f32748fae04c34d215fc2701aff889af6
TLSH
T1959004C5C371C500D154F1755CC0C0F45C707D01DDD417533DD747D145110D3C051410
MD5 SHA1 SHA512 TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 2de69c44757cc59417653f16227d56293caf5edb3557978096c6d8dd243ae023
MD5 8820be698bdcccde9cbc218736313891
SHA1 ad290492e8bc226b939e5793fa9f32548c15ac64
SHA512 2f201619a901a2acda8ac1fa85cd9c378fbfd841cd0b1bacd90541f9f56994b7d150e9ff7470812fea4dfdbfa2d78cc498a63ed543434207a8c78334591962b5
SSDEEP 384:HGNQiO024YjWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAN:mDZYjWTToXJWTTogB7S/AmVAf+hRMs
TLSH
T183728E7D8F013CBC2B5790E9C8B583548D18B7ABDFB6C06D25983D09C988A1AB1F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 cb7812929c22151376f5279ba26710eddc82682d74e87bd6860329ce89c575cc
MD5 e85f4b28a34e6ae65d5bbf36aecce76d
SHA1 93767aa4032e8bdd62c5e7f1c8f1b83c3bda6782
SHA512 9dfae81af985cda698e0a83d313066cf631a2c29c9ce1855fd4b2df8fbb69bdd76e4c0287c6394cc664c7313425f59e445b0c90e770f23a893c9f939d98a4138
SSDEEP 3072:X3lreBNfQtCEXS1R5RrNB0t5r/SjuE6yUGbQoM4b:F+dCSlRrn0tx/mkMXMo
TLSH
T174B3BFF6DFA2CD6C65FFD41DA7C2893EF9623404B3A32019C863661461C6FB86379648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 c3caa6bd5398003f0bfeb6ac6bdd6f212c2204f390b7477390ee9328bcfd57ee
MD5 82a1d46079d4a106613fb06f66bf4541
SHA1 7304fd897ad0c94493cde874c7ef00ea28eea3f7
SHA512 affb92c184f6b74f61fac7a520f8a7a9fb30fd07b0f5cbb764eda5d89bbd100fd2e2d78abf8ca14fdf8f0eb51eeb5685c9deb2f33e42efe6622f70f981093137
SSDEEP 3072:j3lreBNfQtCQgi3jrABDt5r/SjuE6yUGbQoM4a:p+dQgUjr4Dtx/mkMXMF
TLSH
T101B3AEF6DFA28D7D65FFC01DA7C2893EF9222404B3A72009C863671561C6FB86379648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D6VZFC4YZLEB4K6WGZZJ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D6VZFC4YZLEB4K6WGZZJ.temp
Size 5KB
SHA256 15a4acddcc96245888f3d0e8d0678990960a8f976393531e52e8bc7a274ccda5
MD5 37682f3972da4137ee6a6fb4e6f7a285
SHA1 5b4de14a689c9bb4633f8201e04591644cad0ebc
SHA512 b4b4566048aa236a5417f74eb7117dda2457928bb1889e6eea7d0864ef959389b273737c02e5a794815baed3d5b5a39cd6f3efdf4eddf798f5faecb4e5b44617
SSDEEP 48:kehJkdgJ5Ugdwnz8hhJkdgJ/6BdwB8zhJkdgJ/adwD0:BZ/A/g
TLSH
T163B1CB020BF70E86F8F396323E317716A773FD06571B029E82866245093276465AEFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\addonStartup.json.lz4
Size 4KB
SHA256 e4ff43386398bb0d313bc7d95adcef8049c68226157b410d0791cf849d6ce102
MD5 a76942a11083baabbd175c63e12a6b03
SHA1 5287eb2eb3e4cd0cf1cfa80bc23d69294e30d3cb
SHA512 984d4aac6a364ea7713264e6643a7986bb45ac133d3faf766740fe051683875f623161a1fc50a328fcbd7893e16a0a0559d59cbd20bda91a7af9186454445433
SSDEEP 96:Ny04sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRwK:Na52xxhD8rGvm6ApwnHU+f
TLSH
T1BFA18E76D141EFB1FE32D04248E83FB2F996AB381469C4D0F1AEB1250C30A731705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 83447cab2fec1e3b155873c5265d28331e3d83a63bf5d2bbc9bf13e6579ab5a6
MD5 2b0fe5b6ca20563189c57b7b556b3eef
SHA1 991e63a5e32b28c5a8d6075a0a0002b705941e7d
SHA512 a67be4c64371dc2c36731f09190391621669936635f19ce1bea5dd4fbf10bf5b28ba42f073215bce8d2c7c1d2db72989b9272eef316cf3fd26152e045c0114cb
SSDEEP 192:wOv5zboSZ0ayj78Hi1d66JoztdzgCl6mc0d:7boSZ0ayjDd66Joz/zgC1j
TLSH
T1F9E11164E629863FC404027BCCA61F440F36389B984E7F19369C641C2D577EE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0dd453fb18e98a731102b7fca3fd1258b7f510ad841cef8f950ea7c9ed3be55a
MD5 b8daa97c867999bf11f1cbe700821d7b
SHA1 d285a6fc89a8696b4f37acc36f707c6c3d586939
SHA512 5003cb7042907328266e79e14c8023ef85603d519dd3373b42b0e1978d6ed8980959663bb8a485a7f17c1083c0cfcaef5f1be63a58c7298535873beff03e035a
SSDEEP 192:MOv5zbo7nZ0ayj78Hi1d66JoztdzgCl6mc0dz:vbojZ0ayjDd66Joz/zgC1jd
TLSH
T1FFE11164E628863FC404027BDCA61F440F35389A984E7F1935DC641C2D577EE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7e00bee1ba94b67d0b9634ce8652997e5a55fcc20f70955b39d14feb2800d1f2
MD5 7770e32075ba1bb5698215790df2beb5
SHA1 33969647834356c1f96f1d13a97e48f5af68d026
SHA512 76829b3e63d8423a70f89595467d1f471d14df90f0a67a19a0bd9b6eb26c32c2f7becd2c6484f5b57230c15c0833b61d4b47596824b9111dd71f2a546b3c583a
SSDEEP 192:li1d66JoztdzgCl6mc0dQOv5zbo7r0ayj78k:md66Joz/zgC1j1bo/0ayjn
TLSH
T1FFE11164E628863FC404027BDCA61B444F39389A984E7F1936DC605C2D577EE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\events\events
Size 1KB
SHA256 dc30f9092eccf8c5ed7b940ec0bcecaa5da28d951d205bbda90d1bd87b5f45f7
MD5 8006692d6f9c199c609567a4cb1e6464
SHA1 61f568021a3d7a8e8134e63f4045eb811cca3b71
SHA512 0ac13828487d4717122467d59d68902e78ad1d412b9d39247df64b89dfbda274d9d507e1b121cb1cc999fcb889d00863f50d82cd50b0b6ed16450271a8bb3467
TLSH
T126217C4C3DF88D2A9CC7F69CB5A1018E57558A4B04875C430E13DFCDDD95ADE32AA638
MD5 SHA1 SHA512 TLSH

Submit Download

255a84d3-2866-43b4-b6a1-227d3779b15a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\255a84d3-2866-43b4-b6a1-227d3779b15a
Size 16KB
SHA256 466fd5619d77a7dc396e5fdc874709047759b7522754a73e735d3451f0b7fa44
MD5 6f3912c9a4af9b403f56cc321d944f9c
SHA1 fcd6d198883222049fd515607081bed69e7b4a4c
SHA512 10b4bb08e72b9216408f0b85c365783efccaa7fd740cf54b35a5516f08a4322543535e21da7e862e179ce22d5cba57b935c143c4b3de31dd26256f61548fbee2
SSDEEP 192:pC+oRKAI9EuBSz4akD+6I/J3iXcyz28U0mcJCapZi3laKezdwtT/loBTlD1gn:yRKAI9LBSkaaRpZhJdwVlobO
TLSH
T15972D956286055BA8251E36894FCBFC3E6F628CF4C418FCE9BE4BE046DDE06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f4f5901-eb06-47d6-966d-ed6aa69ef00d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\4f4f5901-eb06-47d6-966d-ed6aa69ef00d
Size 883B
SHA256 f9f2fc209b366bdb6654124920449a23b844737d9df58b1e549171cc1a9f2c75
MD5 a83cc3e91156a95590886472d0130af6
SHA1 3d3b0c74a409da027984c56f0da994c7fef0df2d
SHA512 1a2c19ee40e7565e5aad9ae9f227e5c646bfc55313b6695519f7c6ac33ad9d3727e6b6e4cc5a9c0972f126a1a1efd26e1bc9b007737f6748e741e61552be76a7
TLSH
T126110040D622B9B2DC2C924BC991370647E47523C0CA45047EF19E180DBFA1ED76B60B
MD5 SHA1 SHA512 TLSH

Submit Download

afc1c00e-7abb-43d1-87d0-a9592c8ea536

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\afc1c00e-7abb-43d1-87d0-a9592c8ea536
Size 2KB
SHA256 6c097a82b1e8d27985b82150fc6dae098e55874c636e13e57cc5800b72e0076e
MD5 e9900b0cb1637bbc3e75791fa12229c7
SHA1 69e3127a857dc9fb61778e27639507afc18e1328
SHA512 0ce97efa0c84182770b59cbcfedf18df2837e95761c71eab8cbd4d3e4c9d74a31380c260e40d43b651a658517187eb5a04a40e5277bcadb42d122fe90c546c56
TLSH
T1D941415C35B44D7ADC8AF59DD481338E53618A5300C61C83BE92EE4C8E97F9EA36A41B
MD5 SHA1 SHA512 TLSH

Submit Download

e5344b41-cdec-4354-b83c-7175a4c90238

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\e5344b41-cdec-4354-b83c-7175a4c90238
Size 886B
SHA256 4ad993a515af5c8ef7032aac98f5f57ab8ff15b14ff2f36fe1b160087fd3689e
MD5 51634243c95172bcf60e9dc1e6f0c36c
SHA1 26e2294e4ce7783e04f135b4a2a8d15c935f616b
SHA512 b79e2366874f11e4bc8ac51297ad45865d91e1f1f5c2d215a87c3c96f27407b41f0f4997bd5ac424723df4861c62d3eee2ff4512b66e04ab8e793bfcb2fea58c
TLSH
T1C91100518625B5B2CC2892DB98A4374283E4713380CA49487EA19B1C0EBFA1E936B30B
MD5 SHA1 SHA512 TLSH

Submit Download

ed89565c-8f4c-42fa-b3f4-a454579f81dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\ed89565c-8f4c-42fa-b3f4-a454579f81dc
Size 235B
SHA256 d7d39cd759cb4fde88fb8ae78c8af21b879bf2291620d3303649c9c505dacfa2
MD5 ec3c1e517dccde0346311daf3e527822
SHA1 bb8707357a08facc21b63c63741841fc92e6a2e1
SHA512 2e2fd0e0c561b99a97bb400fa81421ca5488c19b44390e212894513bc98c68192703f6c74e7a5d27103a82dd840d65b1299da134ea18fcd5d252ed4cc59dfe77
TLSH
T123D097852C8827AD48140F02F0B0ADEA314A8C3764A06810CAB104B88AFEAD6416591B
MD5 SHA1 SHA512 TLSH

Submit Download

fca0f2d4-58ac-49cc-9083-fad0243b7948

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\fca0f2d4-58ac-49cc-9083-fad0243b7948
Size 235B
SHA256 1edb82c6110775f872a768d9d98903c425937f4eba16e8bc934869e03c7c98d7
MD5 5cb5a5ffb2038e38b4aa8583dfcdacf4
SHA1 5ed7dbc9350c8fccf31e988c352b008e3a4d733a
SHA512 b3efe3e59295e91a6a20d695c8c8989f474617d2571e1dfcb96841954647817074c498f952931d5053b68f817a77d6fea235065c1df8abd4d4223af10b37c162
TLSH
T182D09780248C7B5C0C000F07F0E0A8E631448C3318706810CE9145349AFFDC4426291A
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\extensions.json
Size 14KB
SHA256 6559380f55dd96196ed2b24533f2d1fb145099b86e16e4801ea85970b1ece6bc
MD5 2472da4337c469b9b2dbdf00fb8b5de5
SHA1 c7dbd467b1928ba4f8d4335c10b95592bb46d6ac
SHA512 9361ce233e96f21dc94ee9d0373926d61bef87fd71b9f3e7d0a9a4ec82a50aeda71256a69fcf1775376f2c5d776a6882da7d96cc0f2436be3454803c6ddca62d
SSDEEP 384:2kI4vaUmldvP8dhW194zP96oXvL4HjL4PcL4HPL4HPL4H7:ZI4CRfMX44x6M4v4+4z4z4b
TLSH
T1A562421545149EB8298FA78AAA367E01C37D473B70845C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 6KB
SHA256 7a0d787bb0e81dee512e62b5400edac0dcac389683282d950ec466e36c520ce8
MD5 8cb31af4896fe6893bd81b2f28139ee7
SHA1 20126cce2f4d700e8f258f6bea139c6f01cb8ebe
SHA512 23d5ddb8a414a36a76c4cd4716c0697c51f9e78fd53f8b7c18b4460b83a52c36a759e42ce09bdb42b6831a6fdc0737da44c96361768d77f11081e399024302d7
SSDEEP 96:xHNUTUrqGqbf64b1zSJGSSlpdv9jJZnJHDuFY1Bw88u8L4cnqDx4:LWRbf64blSS1TR1Bw88f
TLSH
T1BBE12E789448CB7F74B677ACAC6488316AB2013B77BF68C750BA5484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 7KB
SHA256 57f8989ed9fd6b3ff8ee188b073af8cfed9d9d80645de5fca720742fd03c9334
MD5 16121fdf293559af9bf2098500f12b6e
SHA1 456293bf96df4f17c3479de9bb3dff3c53560234
SHA512 ce7bc9cd83e25947d9a22630765b650bd18188520cd1ff6e985d0ab1e74785f3d06ef4cd3ec1ab8c63ecc6eb22e378e948a4770af9652b76ec228c66095c625e
SSDEEP 96:xHNBSJWSKvTUrqGqbf6KHObzS+KSSlpdv9jtnJHDuFY1Bw88P8L4cnqDx4:LBSJWSKxRbf6KHAKSS7R1Bw88e
TLSH
T1B8F10E785504CB7F74B677ACAC6489315AB2013B7BBF68C650BA44C4051CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 8KB
SHA256 5b7ae7121b287e34372538412c30cfd4088edcef33f4c7038e5ea9752b9b60bb
MD5 d6366a6d12ca9d2e39b147a7450103e3
SHA1 0c6119e04c8a9b82ac6fb979a61e2ee18965c91b
SHA512 ba1b5cb8d3e0085ebc930eeb39ec8340febaed646055b7fcb874d2ced5177e718a5c50ee416695bf63cac03271db8d3dd9e819c6ac33623ace283a86958b1afc
SSDEEP 96:xHNBSJWSKvTUrqGqbf0VKHObzS+KSSlpdv9jtnJWRq3uFYG1uBw88NQ8GL8L4cnl:LBSJWSKxRbf0VKHAKSSyR2G1uBw88BGS
TLSH
T16D020E385504CF7F74B6367CAC6489705A62013B7BBFACD651BA44C5094CF3841EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 6KB
SHA256 f7f854136440235cba7120e4ffc6f43ae9d3b81eb2956e8bbbc304eb47aef8d6
MD5 85e8da9c490afa45a3c0c0d9433238d0
SHA1 9e3b64d80f26b64795f2f6b1463dadf758990a7f
SHA512 a9cb7d99b98a2819583c0e5bed41f06b3b590e97a66cd138457175bac0f928cfbe5078aaf39e4f735de490518fd9d6949d5ce02e255dff4dc3b7887f784f2954
SSDEEP 96:xHNUTUrqGqbf6KHObzS+KSSlpdv9jtnJHDuFY1Bw88u8L4cnqDx4:LWRbf6KHAKSS7R1Bw88f
TLSH
T147E11E789408CB7F64B677ACAC6489316AB2013B77BF68C750BA44C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 6KB
SHA256 4d5b27e65e2cc0a6f8c9d869434c92ecb45e0b00bc88717f5c43d89e10358c19
MD5 d808109038e0ccdb13d162378080246a
SHA1 c5efeb75223916a41acf5a2f4526b93b8efc70f8
SHA512 04558f5b3fc52d9c85b01b200745d5011bf91ff4da04f2d014e71330be92cd46539b8dad71fdb9f5071fe8c4496ec6e6c7af69367e74660a67b3db3a573fb22d
SSDEEP 96:xHNUTUrqGqbf6KH1zS+KSSlpdv9jJZnJHDuFY1Bw88u8L4cnqDx4:LWRbf6KHPKSS1TR1Bw88f
TLSH
T17CE11E789408CB6F74B677ACAC6488316AB2013B77BF68C750BA54C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 5283e2a025f7703d538492a251a984cd217e5b242816376888ad4ba9a3f80801
MD5 bee5afbce66059ba5c5c8e812d0d149b
SHA1 d1215e5b117aa67b942127cb52efcc9bb7f9ddf4
SHA512 e14d1170f8599d6874304195eba050af6d9cc72c2ee4812b37c4804380b3879c9dd7add5ffe0a372788aa00a617c69d995ca58ef316520f253fa37396d6dcfe3
TLSH
T14821B789BF5B2CB363C5D14690C91FD4EBF65061426C6CB09C5B520125DC427329E344
MD5 SHA1 SHA512 TLSH

Submit Download