b525cc79370c892d4742b501235de0a79ef6a17aff78468aec67aadcf6ccd73e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Size 946KB
Sample261024-exwt1sfx31
SHA256 b525cc79370c892d4742b501235de0a79ef6a17aff78468aec67aadcf6ccd73e
MD5 944c69fb95d80ccb5773ca78de6684cc
SHA1 010681874846a596a5a7d70586aa86494f5b686f
SHA512 ac8b2b9d40d6cf4a8422d93be059eb81950c8f2b86808a6cf1480e989de8456fa9c3cd42404c06a7801723a38ef4502e7ec56a40ebf25473655a1e619cd55b00
SSDEEP 24576:Y8wAB0ZMwpe5VXXC8Ac2YV3swxhZPegenZPwC7:pwxRpeDWh4sCdegmZz
TLSH
T1CF25F151F79500FAE17B82788A428516E632BC154760A6DF73A03F9A3F33AD45E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe

Executes dropped EXE 21 IoCs

pid	Process
5020	alg.exe
1420	DiagnosticsHub.StandardCollector.Service.exe
1768	elevation_service.exe
5112	elevation_service.exe
2580	maintenanceservice.exe
1460	OSE.EXE
4984	msdtc.exe
3560	PerceptionSimulationService.exe
3232	perfhost.exe
5692	locator.exe
5740	SensorDataService.exe
5196	snmptrap.exe
6076	spectrum.exe
4088	ssh-agent.exe
4232	TieringEngineService.exe
5548	AgentService.exe
2756	vds.exe
3800	vssvc.exe
3452	wbengine.exe
4536	WmiApSrv.exe
4064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16dede7e288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006586b61f6f63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e4b791e6f63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ceb7df1e6f63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051fa971e6f63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1420	DiagnosticsHub.StandardCollector.Service.exe
1420	DiagnosticsHub.StandardCollector.Service.exe
1420	DiagnosticsHub.StandardCollector.Service.exe
1420	DiagnosticsHub.StandardCollector.Service.exe
1420	DiagnosticsHub.StandardCollector.Service.exe
1420	DiagnosticsHub.StandardCollector.Service.exe
1420	DiagnosticsHub.StandardCollector.Service.exe
1768	elevation_service.exe
1768	elevation_service.exe
1768	elevation_service.exe
1768	elevation_service.exe
1768	elevation_service.exe
1768	elevation_service.exe
1768	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4656	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Token: SeDebugPrivilege	3804	firefox.exe
Token: SeDebugPrivilege	3804	firefox.exe
Token: SeDebugPrivilege	1420	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1768	elevation_service.exe
Token: SeRestorePrivilege	4232	TieringEngineService.exe
Token: SeManageVolumePrivilege	4232	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5548	AgentService.exe
Token: SeBackupPrivilege	3800	vssvc.exe
Token: SeRestorePrivilege	3800	vssvc.exe
Token: SeAuditPrivilege	3800	vssvc.exe
Token: SeBackupPrivilege	3452	wbengine.exe
Token: SeRestorePrivilege	3452	wbengine.exe
Token: SeSecurityPrivilege	3452	wbengine.exe
Token: 33	4064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeDebugPrivilege	1768	elevation_service.exe
Token: SeDebugPrivilege	3804	firefox.exe
Token: SeDebugPrivilege	3804	firefox.exe
Token: SeDebugPrivilege	3804	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3804	firefox.exe
3804	firefox.exe
3804	firefox.exe
3804	firefox.exe
3804	firefox.exe
3804	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3804	firefox.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1624	4656	2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe	86
PID 1624 wrote to memory of 3804	1624	firefox.exe	89
PID 1624 wrote to memory of 3804	1624	firefox.exe	89
PID 3804 wrote to memory of 4744	3804	firefox.exe	90
PID 3804 wrote to memory of 4744	3804	firefox.exe	90
PID 3804 wrote to memory of 4744	3804	firefox.exe	90
PID 3804 wrote to memory of 4664	3804	firefox.exe	95
PID 3804 wrote to memory of 4664	3804	firefox.exe	95
PID 3804 wrote to memory of 4664	3804	firefox.exe	95
PID 3804 wrote to memory of 4664	3804	firefox.exe	95
PID 3804 wrote to memory of 2568	3804	firefox.exe	96
PID 3804 wrote to memory of 2568	3804	firefox.exe	96
PID 3804 wrote to memory of 2568	3804	firefox.exe	96
PID 3804 wrote to memory of 2568	3804	firefox.exe	96
PID 3804 wrote to memory of 1592	3804	firefox.exe	97
PID 3804 wrote to memory of 1592	3804	firefox.exe	97
PID 3804 wrote to memory of 1592	3804	firefox.exe	97
PID 3804 wrote to memory of 408	3804	firefox.exe	98
PID 3804 wrote to memory of 408	3804	firefox.exe	98
PID 3804 wrote to memory of 408	3804	firefox.exe	98
PID 3804 wrote to memory of 408	3804	firefox.exe	98
PID 3804 wrote to memory of 5160	3804	firefox.exe	99
PID 3804 wrote to memory of 5160	3804	firefox.exe	99
PID 3804 wrote to memory of 5160	3804	firefox.exe	99
PID 3804 wrote to memory of 5160	3804	firefox.exe	99
PID 3804 wrote to memory of 5276	3804	firefox.exe	100
PID 3804 wrote to memory of 5276	3804	firefox.exe	100
PID 3804 wrote to memory of 5276	3804	firefox.exe	100
PID 3804 wrote to memory of 5276	3804	firefox.exe	100
PID 3804 wrote to memory of 5284	3804	firefox.exe	101
PID 3804 wrote to memory of 5284	3804	firefox.exe	101
PID 3804 wrote to memory of 5284	3804	firefox.exe	101
PID 3804 wrote to memory of 5284	3804	firefox.exe	101
PID 3804 wrote to memory of 5300	3804	firefox.exe	102
PID 3804 wrote to memory of 5300	3804	firefox.exe	102
PID 3804 wrote to memory of 5300	3804	firefox.exe	102
PID 3804 wrote to memory of 5300	3804	firefox.exe	102
PID 4064 wrote to memory of 4556	4064	SearchIndexer.exe	129
PID 4064 wrote to memory of 3276	4064	SearchIndexer.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_944c69fb95d80ccb5773ca78de6684cc_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27099 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {19d592d2-bb23-44e1-b5cf-b5cfec804a61} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4744
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {5462e976-6866-4ec2-8691-213b1ffecf28} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27276 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {f386156e-648c-4de6-af18-156483fd7eef} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3988 -prefsLen 27276 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {5577933a-5e68-4a21-8339-67e14f3310c6} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34775 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4336 -initialChannelId {5ddeeaed-70a9-4fdf-a287-77a0d0ed08ff} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4812 -prefsLen 35012 -prefMapHandle 4792 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {987ee208-d79e-4b1c-a5ff-4123e43d3f32} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5160
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4960 -prefsLen 32900 -prefMapHandle 4964 -prefMapSize 270279 -jsInitHandle 4968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {b249ad95-937c-482d-bc34-ee94e6ceb1a7} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4984 -prefsLen 32900 -prefMapHandle 4988 -prefMapSize 270279 -jsInitHandle 4992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5020 -initialChannelId {8671c2d6-544f-4524-96a5-dae2c2c47835} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4792 -initialChannelId {c959c5cf-d16b-4665-affd-e3e084327f58} -parentPid 3804 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3804" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5300

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5020

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2580

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1460

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3560

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3232

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5740

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5196

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4564

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3800

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4556
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 175850f529490695562633c105ba46b4a04cef90b6866340c56f1ef5192b9107
MD5 c62e327ef7d0bcda400b66f47dce31d2
SHA1 b4d3c19b3016190d11bc5f07b14f5d43b6454fc2
SHA512 266a681a1b15a8ba6c2f9401a35680cee8ce228b9b995495d0c2d4af82114b86b68783d1c9de604deee3d01deb9d075ac4e28a78c05f678f4b6e77b0609d6d8e
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmWh4sCdegmZz:S3q6HjB/WIURZz
TLSH
T11FD58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d1b06cc713051b64f2396588682e70abc33fd14637346def3281e609eb068de8
MD5 31e5a14d797168c157e17ad6ae1aeb0c
SHA1 d53489a20066c186339e3a3eed0b9a584bbfe649
SHA512 d92c2aa8d9aad31fe0763e67c284a07d7ef15836b4c6ffadfbd65291dc9427b88cc3bae69288afe20750baf0476fb08741db7e25e1c78faa7ed13848b2555f46
SSDEEP 24576:eXYfDtczAZVXXC8Ac2YV3swxhZPegenZPwC7:9tcoWh4sCdegmZz
TLSH
T1C9050228A79508F9ED7B827CCCA1C515E633BC544360EB9B03E09A261F376D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 31b4b9d672f8fe0c3ef899ac7c1482c3fbab910cb9c2fb0e31ea2b89e41c6b86
MD5 15aec40fd939d67181b10f910d7ebcdf
SHA1 0d9f0181350eaeac0dce4e51febe22908daaf807
SHA512 67bced5ff8840670d2bf6496a28670d8e8b78d13aa14aa72300fd83e2fd855d70cd93dd2ad55206ae68a5c9f19fc6c6b6f159d3605b88ba7c9ae650a1374f919
SSDEEP 24576:D0Le5ji0hmxirMAVXXC8Ac2YV3swxhZPegenZPwC7:DPji0AchWh4sCdegmZz
TLSH
T1CF35AE26F6748335D073C0B9C5D2A68EED71348257308ACB4286D77C7E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fd7784a08e1c72657cfb770b8e1bf3a680aae96fcf4c0ea494c2da57e18104ba
MD5 7b3269967ea51470de80ce9b1ed02405
SHA1 3137b0661220797e8c56ed12cd8ea19d77b3f59e
SHA512 46a809da66c1d24020fb11623687504a1dfb6b322253bb668a4e25a2563ca997683da4ddd40e263761b7b81534cdaec8f0081149774a71f67fc9a4c82eb22d90
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuWVXXC8Ac2YV3swxhZPegenZPwC7:T/ezSC6vUzPvxHjy1Wh4sCdegmZz
TLSH
T1C6756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 149fa2fbf55f460ec2c771a8d0606f62933b71ba33d3d37eb18092a77e5fe826
MD5 e10101bf2bc42dffe99479c0b03743b8
SHA1 8bba7b6960970fd8dc334e784fc8de7c61f35879
SHA512 ea7fba1bb5826185bc4c694a9f91d5ce823c65724610f90935c8eff321483dca6bea9df06c68213e3cdea6711a87729de2b9deea8f8dcb02592948b73d1a716e
SSDEEP 24576:cVbqPb88hv/l+6VVXXC8Ac2YV3swxhZPegenZPwC7:cVO88hXl+iWh4sCdegmZz
TLSH
T101559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 c3bf025f2703891a03154114c7155cf795deb65fb031148ec738c031f1451f33
MD5 81ff785af5b0f72f03304e8b4d3a132b
SHA1 9df6ac3860d0747ba32bb1f92afee38de24f3a6b
SHA512 561ec083d7c4858cdaeb687a46b4f630beba3fab095c26a7c82de86e6e08482c02b5b100bb00ec66483a3281e8044696fefc47506ad2ecd5a49745cce56b0103
SSDEEP 12288:pR8VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:pR8VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1CBC423A2CE069467F7BF0674DDE4E7DDE2289F549084CD2992817F1A7C3C899A432533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 86038095d790afca5a2aaf91d56431c84f33c0a0a9f2fea9e6c41406889670d6
MD5 5e0439ffaac9e3e7512ac1d5e49c7d99
SHA1 6986177ceb3675da29a86d9ea1d0aae1e221674a
SHA512 1887592e4cc0533c550e1f1b7fa3e9c52bf9d300e78a5aadda4445f397e17c20c318196f36b78f69a595c02b6263e91674e066b218516870d168939fcbd48730
SSDEEP 12288:BeBNUbTVO86UNVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:BJIUNVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1CF05CF3BEE28FCE2C27E4DB85A918340E77278304B61A3CBD165830E9E275E55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 674720bf51154d277ab4edd7443d6e4bb6c1ab2a9bcc685c4e7893bcd28d2bc7
MD5 923bfa559e59d8a6f1740bcccc9fe9b6
SHA1 6d50990d89b04993ffbfb53d215675f7c674999d
SHA512 88ffdb7bc73f6777c638fc10fe1e20af3f29589deab55d936e8cb92101feeb39c22f542ad2209d6f77747835b53015dcca353a1e9b857b1e997861e7390a36bc
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:eQvGAdlCEL8c/yRNw5CIWIURZz
TLSH
T16E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9e2429bf273eda812c335b424fea8603b4ddb31ed3de3d90cb7072b3351d5abf
MD5 5a4e881124e13420258d3e4a586ac5b9
SHA1 24583170555c22433be533f01091b4fe070f8bc4
SHA512 73cf741e8aa8ab0fbd277c5ee6a86702fee9fc2258769016eb8dd5c924abe1c188c29168e397aada53829b7e6ae9b4c4de543823cb1d726fb6783d7c0d9591e5
SSDEEP 24576:3dewsAjLVXXC8Ac2YV3swxhZPegenZPwC7:NljRWh4sCdegmZz
TLSH
T17815E031FE75E036D3BF0DB61B65C716542CAE204B911AC3E3E89E9E59341D22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 566b558b4b639c8a1adc9c94eba232414a7f86e8d1d034be329441b4efc5ee3d
MD5 7b0cc5edcf5a4adb660e15675080ac4b
SHA1 59db338e35365f40303e3247764991039a20ddef
SHA512 2b4007cdbae658e2e346a6311fc43b678cddb517b3dfee605b4fc9ce86e137b96146cded53681689650fab2e2aeb99637ffe65700316a6f83adf742f29d5c7ef
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHAp:JUEtQevvqc2W1cpV2EI32k
TLSH
T19D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fb02a656c4713f8c44910632d3051d211d3bf1c3da196716033ab3a2f5918b18
MD5 7035557a4463e5c8e9e9a711961eab2a
SHA1 bdf860b50d086b2fdf6488b84fb05b35cf70a11e
SHA512 19a1dd82851a82510aeebcd15c51b5df2cdfb0c2179c189e329c54129ae90af4f27102fba493476a6d684aeb08a92b306cb6383a887546fb31464a06c1cc00a2
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/zxWh4sCdegmZz:hoq2VjnmMWIURZz
TLSH
T1D3D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4557b4a1ca1498a8c8d85e3cf69133495354d9bb584e80faa3953db5319b8aba
MD5 ccdd0113859fa771d31bf85c10fddecc
SHA1 4c5d6ae07e7202761227b537b84e0723cb8975be
SHA512 9327e1d920038fc787335a1eac59b20e5cdc2d1af04eb91629e4e348781db0a69b84d40e05b820aeb817c994bf415828f40d753f2ee030f4393012cdce67bdac
SSDEEP 24576:7AhGLJIFoiwtA5l7S53KVXXC8Ac2YV3swxhZPegenZPwC7:7AMyFoiq58Wh4sCdegmZz
TLSH
T10235AD81EBF955D4F5B3AAB899B69170EA76BCA55E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 33986476f8eba2229349488e02fea393f9d9b682714c31cff130aabe221bfe0f
MD5 bf1015cec7706550c23e04362acd4bc9
SHA1 848a9000dacf63460a7aa71dc304f6b29450e257
SHA512 e6fd624b11337e291ca8adb0fecfe0a9d2552fd2b066f1a5b68b5d2e1b6e44851d4fdda9271a85771dfe223df9f9c0cb49b40e0d0586e4665379c1998fff3776
SSDEEP 24576:DwuoOW/VXXC8Ac2YV3swxhZPegenZPwC7:DwDOAWh4sCdegmZz
TLSH
T1D905F14666A50CF9E9774238C997C136F7B2BC012A24DB1F5360C75B6F37261BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 054dea9f324f572009852b4a3ae6370babe1a980960515e8aa84350bf2733cf2
MD5 c47da5b9ddf5fe7ba37d2fbdaeed4512
SHA1 d0f167b228848f880426eb7ec51827613d584dd9
SHA512 0626d68444fee1a1c1cac309916833617a7d77f5e5f2fa5d8dc43c286cec6aea1b97482ae8dae961342f814300b34c3fbaeb018aeb1c2a9d2b47c8aae48e1982
SSDEEP 12288:eBZ1IybVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:YZuYVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T171E41296279460FAF2BB4278CDE09789E371BC51637487CF42515B6A2E3A8C52C36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 90682e4fee33427e4d1761eb937d93fe9c8a2c6afd6e40792ea9844514bc2d0a
MD5 621b7d54fda239dd1aef7e7cb616fcbc
SHA1 df05e11c263c5248f155331d62941f4fd83d63d1
SHA512 17625c093f854d3cf3848fbd7cf59353fcfa8f0574b6238e4f33059d8bbb67f5982f719af852c7bcb9282d4e5da25f2ae3c8ced71dfcb7ddeb9e05591c25f22d
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:HQRQyi36YOcPQLvw2gAf+PN3LWIURZz
TLSH
T1B1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d3a8a70004e126c143a26aa2483fb1d83899d8c4e79dc102f913f79ded575dcb
MD5 4437f822726c94ee4768b97f79421700
SHA1 0f7b15517c6556d5ed1855b42cdfeaf88ba325b0
SHA512 829a57de4f66a4f5324454a3ab5ed12656bb90f0c3acad74ceb00f6844141d3c4f80a2f64fdeea27d206dfb3be76801a09d84eda65c6f113940b91787a923f3b
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:WQRQyi36YOcPQLvw2gAf+PN3LWIURZz
TLSH
T1AC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f2feb4804d1a91586558b08a3eaa1c045c56bb90e57baffada9caa6ec68cde43
MD5 c785abf3e879b1f739445148d0c3a906
SHA1 7b9fe1239298e8c58f305c33a65370baba72ab33
SHA512 397aaa41f2720071b1d021da9864fa202fc32e156138bf57427a25cb8d2e5bf278365b3f8008676b38bd167df640f5700a85f8a8e0e4053fd9dcd0488b3278b1
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0IVXXC8Ac2YV3swM:i68Qg55nhheWu7PNU3/hWh4sCdegmZz
TLSH
T1FDB54933B2F600A9C45DE1769F4A872196D17C758FE0E7DB8501720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 219ac90dd1efb0c1ebf59f1cd2d6bdfa81154f476523e703dd79b476b08f750f
MD5 6403858b2a6345442784b2a88c57b22b
SHA1 b5fab8b7b0cb22c1f8c2a10df4cb8b8c1c19d809
SHA512 9c1246810ac027065342dcd3fb2fb589dbc0504dedcd69d6a4e85f0bd28085dff9272e0b1e629355c8d294a388a564e327f76c1713b5ab1075e4014ca471bc3f
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99U:ly5112gYy5azzVvL69nLKnhZ6WIURZz
TLSH
T17B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8771dad606c1b69d789055df41e7ecde84f4769f07407d680b207739051eec14
MD5 ddbf62376146f8a413eb1a20c96032c5
SHA1 8e90836c9b7f5048579e05eff66928ad0d43044b
SHA512 5ce30de8f11db9aace260f268f488dcb923e3cd0d2a202a35ea34db91567350526c3254b930b2aaa9ab0415bf92fdf5df537dea8eae87d8bff00636ca28fac7b
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzWh4sCdegmZz:Ju6JmVxd2dzWIURZz
TLSH
T125D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 00887b9b41a8024bad2e13ed1c8f32fa7f7e39fef59d200e4c0b6f39f67f89e7
MD5 61dc82046a449cc7bd1eff969e8375c4
SHA1 a09d71323c8cf47ca6e40b4cfc6d3b62d0ef35dc
SHA512 f82e09bba916dc7ef8f016303e2dec90bb135b33f8ab8fa9ce3652a9190f4735ed397f77a7bb66cfe66b231e6f7b8123d0fd126c554b6e212fe9db12a7cadd13
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4x3Wh4sCdegmZz:fmifPbRMWIURZz
TLSH
T13FB5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee8f2429fe10b9fd4eee35a0c112ed95d0f468529c7517a5187cffc2f31e51b9
MD5 c2470fb8205bb34c3c20073b4fb5e2a0
SHA1 4fb7781722f64cd89084333b581209c51c7566bf
SHA512 e1272bba100f1e9da9b99a4b98dbcff7f41e00f08bbec549ed0c8a41db46bb60f6b9db738eed111994b4eeb785cbb96a865138d4399aa57ac934ca670e45f39f
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqWWh4sCdegmZz:G5dKTi61WWIURZz
TLSH
T1A0C5BE03F2E940E8E0BED674CB659236EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fa5c4f14572f6451f28cfd7c5cae1458471d4962738e51f218c2d59c9294071a
MD5 54a8c5952e57a49370bc63f5af436b0b
SHA1 a8b30606361fb909073b0a15e5f87b5db133eacb
SHA512 84bf69343f187033cb4a1ca55ce77f638082aa2bb113beb261001c0afc91856cddad99bac2c2027c24a940ebabb995da1d1afbca2cdc01f2fa0fc031594f6a28
SSDEEP 49152:uhtSn8EApI0figngiDn0AP5wjWh4sCdegmZz:vX2iyphgWIURZz
TLSH
T1D295BF13F2D900E8D06ED174C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0d67ab09e8c520e9d9356b3e70c33c46ce3e3d84504d50a10c63ed76f05072d1
MD5 3d27e860a01e23b55d30c47783bd334b
SHA1 5470ddddf17159a9b5829726d7e8bec1a20b624d
SHA512 8e578418ee3a5186701d5337a69e61e60e202e1ab0b8f9589074acdc4514d802972626235e7112e562822448938033ab9c354565ff90e5f843adb2ea2de36bcc
SSDEEP 12288:uUVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:uUVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T13BC423A5CD07846BF37F46B4CDE093DCE6289F54A084CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 3a40656fe7c33d723640ad01fd59d3268827a5a0e9950a2aacb36272ea87ee0c
MD5 82e24591b81bb1f661566aa6defea8f8
SHA1 7f923a7f0711de5af109b165aa71b7fce38e0841
SHA512 542c0fb0b386eea9c7df5a3a5b3dabd7536e1972ef42aed65da3aa56a3b82832631f5b0c86e7325155fbebf7ff78198c9ff521aaea8743f83a68775a5ad09b23
SSDEEP 12288:SHVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:SHVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B6C423A5CD07846BF37E46B4CDE0D3DCE6289F54A084CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 ba3a87c8edebf5e36f4241d13bbd2e95d826c44d46ebea8a1d93fef5f0f449d5
MD5 c3d1424252c0da1aca70388cacf3c4fc
SHA1 aca1f4896fdc5ba256679bc0a60ff3b9a432fbb6
SHA512 8289f533030805334de1e80f5042608ceb7ae128bebbfd28bb44b97460f1a7f139ad3afe1cdb26fd4e0f26c57d2b6067bdd14e82a95483bad41fea554c481862
SSDEEP 12288:WFVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:WFVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T16EC423A5CD07846BF37E46B4CDE093DCE6289F54A084CD6AE2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6c7183bddc19d0cfbdb9e246045004da1f646712df34c02b95814125bc4d7139
MD5 339ab0467f458d17e9e42f1124eb4f57
SHA1 45056b8087c4a8849d0fa09165b6b14f8c214d6b
SHA512 2e5ead7f19f832f430b52be819a2fb55924e74cc673d3c95f299164d2fe97c0f2d0847e6bec8818a358649344c81d3fcd565c58f466273870da59785ac9dc999
SSDEEP 12288:mVqVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:DVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T13DD423619E1A40E7F57B8674CDE0D3D8E378BF94A264CA6F93412E1A2C784987431B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 85bc19761273cbc6fb29da82dbb5c5bc6273e890621703ea0e9b4d5d87cf068d
MD5 76759f06831c238110c146d76499ebc0
SHA1 a61ca57ca99aa2a44e0e577f954b91d527f061cc
SHA512 26ac7e42226a32ba412ca73e4e6bfc297cf1c92f7376c0359cc4f61c52b79a0624ae034e485931825398c6983ccb36b033a400fabd948df06d8d1f8cbb22d2a1
SSDEEP 12288:qSVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:qSVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1AEC423A5CD07846BF27E46B4CDE093DCE6289F54A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 043f62bf341904441127d3456886a100cff18c6294b41e521bd3bf83e12bfb79
MD5 55db9ac53d175118ca7ac358d7b3a3ae
SHA1 37b498115f435cfa2093504d08580c95a49f182d
SHA512 80c17189960c694d28c85202d374beba21da156448169dbda27e938df1c46f07aee58c2c85eab487b9f3acdf60aa949a49945b718700384644fa4362ced7acb7
SSDEEP 12288:WDVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:WDVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D0C423A5CD07846BF37F46B4CDE093DCE2289F54A094CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 31bb149030cc3ee9ca2517dcd2a9d3bde904579d4ef8279103f4d5edc2da7bf1
MD5 431d0e31ed31e1b7e079c9f4589a23c3
SHA1 6dbd4bef41a7312865203a026c6294c6eded7166
SHA512 a9413901a79d31cc52d92a1652f168328428fdc4bf604104e2f638ac08371dbe40cfc6b3aa2ec8c1a36f9624bb21843cbaca7c973aba9e45066751071b7b4440
SSDEEP 12288:+vVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:+vVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T167C423A5CD07846BF37F06B4CEE093DCD2289F94A094CD6AE2826A1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6723062e600f4b15e17ea833c9b1046d791a62c4bae6d46217661670e99ae1c0
MD5 83e714b4401b2da5cfcda42af2f0e730
SHA1 51d083f4f9d633e2f3e1f373108f6acc8a325308
SHA512 7817efe986084228b324248b589979245a4e808f18c542993c709d0e1cb4f921fcc41cfbc6f9de09d9b0e80368a86b0d5a0a36d1599e94195a735b4d739de16b
SSDEEP 24576:OZMSzFVSOnVXXC8Ac2YV3swxhZPegenZPwC7:OZMSzfpWh4sCdegmZz
TLSH
T1030502A5B35018F9ED77823DCD658A45D2B2BC590760CA1F03E4362B6F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 533bc6b0cb08cc05fb058f19f73795c7042b557b629fcf485bab1de34b246aae
MD5 af33c62c668853c9b56f8c7bfd6b0f63
SHA1 27fb68553d2361bfff260a98a0983ff4ab1a3c38
SHA512 a5190a45297965d8988a0cda2c078ba8f8b890060678918efdd4f255382b2ec1e29860ff7940a6a15e5f3dfc6a2a7f6beb76f7a767a19d17a40548dcd5dabd57
SSDEEP 12288:aoVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:aoVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T105C423A5CD07846BF37E06B4CEE093DCD6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 86bedf07c315fbbc75ea68bdf83b1e0cdd3dd69f6e52dbf5cc76ac42c8a0c2b8
MD5 d46ffd37f4f6091f3f061e628c237f24
SHA1 b29410f8893f8768d8f431fa6de38d89a56a1054
SHA512 5a557dbbcca89833ba031e50e4f50a2b8dc2d0c1e705712ecf7c19c8ee218218151de687a902df10d534895eb862e3f135ce0dbdefb12be8103dc3c6f2c7f62d
SSDEEP 12288:VMVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:VMVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1EDC423A5CD06846BF37F06B4CEE093DCD6289F54A094C96AE2827E1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 abccff8f329c56e70e69aeea782d210b64e3da5e5b83cc5cdd3eb75d05cbcc12
MD5 df6456cb7b0812660e30d88c9c2d3861
SHA1 cd84d577970383aaffc3e27dffbd7db4aa4c5b50
SHA512 49ebcd25aa8b1af6e618f81dd071eec0aa5772d602d9745be44ffdc1ac13f5bf654fafa250d34575cb9ec364fd283102ea9dc65db79b7ae66455f3ffce87eeb4
SSDEEP 12288:oyPz5L8bVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:pzybVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T18AF40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8a59ff73881a9ae74ec80e5998c57aa59192620f052cf43692ea5b7ddd965b6b
MD5 cc9beb9f99dc045726bbe8ec2d76d1c5
SHA1 3830fcaa9514b3eb951f5efd39128259543546c2
SHA512 fe0039fcaa9a8764abb7b62e6c52ccf422a672ea23eaf6804922778436665ec8331a35879c3cca39eb8ba970039245d153276d58573a9068c71e4fa117cc3d60
SSDEEP 12288:soVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:soVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1FBC423A5CD07846BF37E06B4CDE093DCD6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 472af965f86bd1a8faa9d560710a22a07ef0319d2b63d0d54fd12429d7854e8b
MD5 55438259de433298aeb79e5b6b483eb7
SHA1 afb9f76781b8c8b7fb7a80196aaa907e0fb1b6d6
SHA512 eba19f770847d9eeff25a9c17db32494956ad68ea99a9eba7414d39f352981aa566c7a1ecf108bf8cfc34faf8dc2eb440ec347f655af44c048d800038005e3d2
SSDEEP 12288:voVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:voVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T178C423A5CD07846BF37E06B4CDE093DCE6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 fce17a67fd30762b3f05d5424b29829136710d9de01c6138512fde346eacc251
MD5 1be4531aa28a15853cf2de941012620b
SHA1 46ec9b117a6d14f776936827596be5ddac162a37
SHA512 0b8e96d7cd4e094a9da201268c12528e578f91ef26bedd01e72fee58fbde5dd811a65775ab0533160b7c43b75c7432ae78815a8367c662183cdf77748670310a
SSDEEP 12288:ByPz5L8bVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:QzybVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T105F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 6fb8bd9708afd9dac65d33a8e3138f61618ef8876582f5360d61462d52fcc808
MD5 7618ca1bbe400018fa735f045de2a5bd
SHA1 5d005930edeac601d9382a08b28bdd26fa390f19
SHA512 b66b16692c3b15e2189c20cc86cc0f667e2fa3840f13aec42066ffd6d4caea397f4536f8510815367555eb7e23a5878e03e412504388ac2fbb24e4fcaa543815
SSDEEP 24576:RTHaLl3z0zD1VXXC8Ac2YV3swxhZPegenZPwC7:RT6LljYWh4sCdegmZz
TLSH
T1D10502A5B35018F9ED77823ECD658A46D2B27C590760CA1F03E4362B5F372A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 0eb533e4045fefb7c6864c16a271017dd0e2c9710cf4ba78d97bb42b4363f19f
MD5 3f53affa168113142b31c3571611e261
SHA1 910e93a305be254ab59bc5d876fdc6be54801518
SHA512 226999362cd7fd31173a9a3faea07a5d91d2bded9a5b6f382ef4446c29cc7e4199f0d0702e1ba843901ad6c94d57db240344e87d866bb3dcf5367ee83a495779
SSDEEP 24576:Z37d9CHKy7GZxVXXC8Ac2YV3swxhZPegenZPwC7:p7d9CHKyapWh4sCdegmZz
TLSH
T1CC25CE90F3E414E9F1B78A35CD769611DA767C991B60CE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 767231197a0eecaafc002102c844150d6651cdc96da7bc6970c2cd74416b11a3
MD5 e9339de44e972fc619d2af2523eadb5d
SHA1 2887394de7d771e8fd64fd0e6aff31d563a38b1b
SHA512 e9af076523802a6fa17f3c49822d8e2d15861bc6054c74adc4f79f56dd2da082c40fa8f7a129f29b2d08f1a79565855ccd92ac09da86381b7fc114621df0ac63
SSDEEP 12288:UlVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:UlVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T130C423A5CD0B846BF37E06B4CDE093DCE6289F54A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7cf9c1d38587cb03daadcc28b1286d28780e9107e14700a89c0352ed51397c42
MD5 d73cf02b4217a23785326ab8512767d1
SHA1 671b2e3b136f4d1cfd1ec0f52ada45f442f486e9
SHA512 94fd0d0aea916bc05f4e4267ab59f37878479ed0eefed8739e1417cbfe2469aa20477889b668ccaf30505259b622212af945397557be0e08b903b3ee1ca4b74e
SSDEEP 12288:f7VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:f7VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1BBC423A5CD06847BF27E06B4CDE0D3DCE6289F54A094CD6AA2827E1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 fcd78e08c7bc2f2d51e309fd2efabca34c61d1e05aec025a510a2c72f0f8c49a
MD5 7d22e1406733f470151ce9a3736cc1a1
SHA1 08d0c001a2b59c95877a1b1ac26deb85e9178cfc
SHA512 69eee6d3d596f8922a207e793754eaa86aef73c01b5dad96fd7fc59b7a981445cd8b0b2be92fa9db1fe0f5b428ca8b3e4f984813d3b1d12574192a1f476efedf
SSDEEP 12288:4eVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:4eVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1D2C423A5CD07846BF37E46B4CEE093DCE6289F54A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 08c9fc72d4ac868597a3b6bb679f675b6420ce83d87e8d3badf437520e521c57
MD5 585d12f833cb244fc2b6ceabced3c395
SHA1 dc87f57d6290caf8bd77ab555269a78a340a0f7e
SHA512 10118f9da45bf1ce6759deeee124497761edcb3720a265dea7fc271751c601ca07ba5219620ea9d6dd47a66aff766fc1e0f752efef63141580185569acfcfc92
SSDEEP 12288:joVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:joVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T177C423A5CD07846BF37E06B4CDE093DCD6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0f559eb204201ac8aa213252b2a69d548cff7ffcc15c5653afb4eecb6579def2
MD5 50cc981c69e199030b438fa88ef9feaa
SHA1 ec1bde2c4c0faa9d61a2c57389cc0ee69d9de721
SHA512 960f67c433fe47e48f8530f33057a0a51322da09512276be91e66d5569ad1424ec8bd48e17a814d36130ec5441e341f47ea3bcdf5da166cad40e8d9e21498ab2
SSDEEP 12288:JNsfYVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:OYVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T17FE4F05AC25801E9D17E5278CB918684F3377D6493E0D7CB52C0FA3E2F395946CEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\activity-stream.contile.json
Size 4KB
SHA256 36d9e779195f16251478af6ecb8ee49635d3536055c66bab82f53e08e6db0758
MD5 f42245b3c85f99e97b1954a95a8703db
SHA1 fcb4e2e880431ef2a8c4fc908fa1764cfdcbc3d3
SHA512 76cd774c43cb2843b2f7a038befa6f5592f68779b965bf10006dad095d3b63c3ecacd78fe486568d99c6ca5b7fc43e83997382f3cdf363b5ab83d146896d601c
SSDEEP 96:TbkMMBJIomy37A8/T+mRMzon4KYiBex6DpZlz:PMXPzADmRMUTGwpZF
TLSH
T16791966F997484121B71B6F16C8B379CF117B006E9F1CE68B5AA9C6085AC7BEC0C95C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 07d34ba487ad6da1e6853bb536b30c5858ad8bf4389a8a044cb083d4901b2434
MD5 7fa2e4e9715ade038f65aeb9731b5337
SHA1 6cfaa8aa2f1064973a4430de11ffadee4d25da41
SHA512 0662e56202d269961eb95f0636a1b961fceeb0b8ca3801ebb6568a532768cf6921f272c987d860868a6aa45689ecf2bd54ce0392e5dcca6324fdce96e3f324e3
SSDEEP 768:byUDyQsDbgPvtJZHlDi+8s51JUa1+iEn+nmEg7SOOrQeulCa9pdMa:mUDHfZukbz8Hn+nmZ5ePaTn
TLSH
T1FB73F9A3A6E8B1FB0F9137C72C0F796B62E10585E34506C9ECEDCA2C81DD654123E5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11972

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\cache2\doomed\11972
Size 256KB
SHA256 06b75901aa6fb16c34b8082f5fdf2bcee3cea92d0ba6bf00edfd63b45eaf9c9b
MD5 266e7308d4b98bac4d76d6a60767bdfc
SHA1 c9dfc634fe8674d8ff3090afa61d78a276eb06be
SHA512 64e7bbcf6432a080f74482c3d985634517dd4cca90426ec6a8614e294a27c8cecc2ce8e432b0872c9dbb2120ab33569dc6dcec6b56caf3d54dcf64c07b676c99
SSDEEP 1536:mYCYPsD7yy5SPr70nvkcIp7qw6Sr7aAlia5W4NgUO22YcuxySc34zK8Ct92ZFZWI:Cs08c1w7ax4NgUO22Eyz3z2Zj37
TLSH
T1E04408F7D69C70FB075296DC2C1E72CF62AF413ADB5208DAF868C148C3C9AA51076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21218

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\cache2\doomed\21218
Size 52B
SHA256 bedae81a0bd6f95f21aa052603de715e942653619350e6cd2ba50117f5976547
MD5 737ce1021757160b099f000248a8505e
SHA1 27ede0bd74e75e093e97d2db34a289f217930198
SHA512 c3a865d0e2bc0b9541f7d40f07575617bae1da3c6bec69408f451260e6e1499d96d25e6dfa6f93067ab65d126cded30ae76c1b5d438860e79114b51478fd4e35
TLSH
T1F2900404475FCD40D514C5731C10D4FC04117F04C5C41F5774D5177704114D30010140
MD5 SHA1 SHA512 TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 08e4d1e6c0ab4d85bb6d1c6fcde5bb539d154e0da97ccbdc7dda228f9eacd69f
MD5 010543832a92a5dc8697cbd2b7751225
SHA1 97dc7e81ddd45ba33f561a8a97fb47955bf02415
SHA512 a42255661161cbde96301bad85eacfe217642f5488a1b729bdc514ba6b049a7dffb6be3e6816ff0a59e27a10c88426f47e21e79ef2f95d8ca4cb78c58994c8df
SSDEEP 384:HGNQiO024YNWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAhsP:mDZYNWTToXJWTTogB7S/AmVAf+hRMj
TLSH
T11A729F7D8F013CBD1B57D0E9C8B583598D18B7A7DFB6C06D11883D09C988A1A71F945E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 01954e5b29fa35f7108725e546f41a84e773b11c1978aa9b0d98ec96938abfa6
MD5 884d2c89931cf9774a7cd190b15c6649
SHA1 fe89a1b1fabde5e712959e1d7bd3388199e7902d
SHA512 c1d1cc8348ce3e2a6ca656143291567633ea25d840a31e7a356a4d4a45104c68db388b316be748fa9269e8ab8dccd97c694e2599000210ef93b7db77d45b80e6
SSDEEP 1536:XTrliLffb/Jr9d3MZ/FiAll88l7Scjch7oUsRiUxO6EuF9npQFfkYR0fsv8KZe9j:X3lI9d3ellBzXO6tFdpQpRmSz6DS0j
TLSH
T13DB39EF6DFA2CD2D64FFD42DAB82843EF9262404B3A3300DC963635561C6B786779648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 8e1c416bab2c55a906b436ee28ca2a1ec69aa7eee15b39862ca6dcd4eb47966c
MD5 819458698b4f6e59f3cd7d839f500ad8
SHA1 af511bd41ed1e05aa49b1e104ebda238e84f1be2
SHA512 5ad20f245826377d784fbef183fbf7e288f1d33f7d1eddfbfa68170e4b9e9110d8928760e45b07aedb6f82f43c437ef131fb9402020cf023f49b0c89f328e8fb
SSDEEP 1536:jTrliLffb/Jr9d32rqrcgfx/cjcp7oUsRiUxO6EuF9npQFfkYR0fsv8KZe9xPsqk:j3lI9d3J1SXO6tFdpQpRmSz6DS0I
TLSH
T154B39EF6DFA2CD3D64FFD42DAB82843EF9262404B393200DC963631562C6B786779649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z5JBS0CQ5JTLV5LSTJP3.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z5JBS0CQ5JTLV5LSTJP3.temp
Size 5KB
SHA256 3e941ed6db4aec74edb39e61e910724083d042f0e6834dd44c3b583f446fda26
MD5 08e9f6024f7c76f4b278c41e9e214497
SHA1 9a9263e64ec425ddfda2d659fdb8e88445a69e48
SHA512 284451f82326d33fb53f071605fd61478f02b760edf396310ad4fd256adcf29e0874e2e4cd413b8394328183a3f0b3b454000a4fab2f693532e81b717f0ca92a
SSDEEP 48:wetnd+gJ5UgdwKYzEAeynd+gJ/6BdwKQEAeQnd+gJ/adwKSE8:w6zAz/yAJ/E8
TLSH
T183B1DB020BF70996F4F386327A317B029273FD055A6F465FC18162968A72360D5ADFE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\addonStartup.json.lz4
Size 4KB
SHA256 df9aaef2183185e1048ab1ce251a6e7464c28bf60f97bee7f25e574ac5e6718d
MD5 331cd65b17fb2589d4403ab045660ad4
SHA1 d4038cc66898d5f118421a4dd65b12d66687da57
SHA512 7a89d593c505f31f3a9057a91a8bf5617bba7fd75f10d1a2131c43a90d090b49a72ff4c7f129bb684e3b85ac48b51cb19fd924f945ee82f0417119ecd79a04a8
SSDEEP 96:NQR0k4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NQy52xxhD8rGvm6ApwnHUuhN
TLSH
T1AFA17EA6D541EF61FE32C0435CD97FB2E699AB7410A9C4D0F16AB1154D64AB35704380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 994d1782b4d0e9033cef2ee342479643cc533799562385c17a8234164befbf78
MD5 0fd21ec8c3c0282aa514fb230458cad5
SHA1 5f0f4a99904862c8201467b3bd8e9b6415b90d3e
SHA512 ac7225f767e560ff755371be9cca64c7b2ba08d02207c581d56213267bf95a338fd8a787f97ef6f691388db2402ee4c09c37930916215e805a5a54c05b2c2bba
SSDEEP 192:v1d66JozGzgCl6mc0d/zSL7SlOv5zboPajidShyjGvS3M:9d66JozGzgC1jZwbboS+d2yjW
TLSH
T19EE10F54EA28867FD418037BCDA21B404F35385AE84E3F19359DA51C2C5B2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0ed7ab873051f7d97034828296d5f04b54e17ed054c9e3498db134ab0cd26048
MD5 d1d3eb6ea20c3a1151e5cee4cfa982cc
SHA1 2c88e085fa8d14d52721ba2160bb9fd6b57cc042
SHA512 2aa72aec97433b2090add1ed95000fb88c7b4542e4d6bd29995280022630ef29050053280b4594e9b13c1ab97015c472f97bee0061af9ca8f0b75e6cebf7a15f
SSDEEP 192:a1d66JozGzgCl6mc0dCzSL7SlOv5zboPfZjidShyjGvS3MN:Ed66JozGzgC1jkwbbo3Z+d2yjWV
TLSH
T178E1FF64EA28867FD408037BCDA21F400F35385AA84E3F19359DA51C2D5B2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 588696e8003aa17de6ce249a3db05e6f3be2eb6c23db9472f9c6528ef2550504
MD5 1e4fe9554bb538745b73fec689cef05e
SHA1 77bbfc09ae0a7caa7ca29921151684b8be37e131
SHA512 81461700cda703c2a116fbbd409874c0c82da17072dcc3ee7ff6c93a9b807a21b705643d8320830ba66aa501d1af5bfe07452e5d280d5a0deb09ccde5d8375f2
SSDEEP 192:v1d66JozGzgCl6mc0dVzSL7SlOv5zbouMjidShyjGvS3M:9d66JozGzgC1jbwbbouM+d2yjW
TLSH
T135E1F064E628863FD409533BCDA21F404F35385AA84E3F19359DA51C2C5B2EE778D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 24f5fdf9fa3aaf3a08298be61cd143514be43a7d6240e71e4b3ade6f0cb716d7
MD5 57e969d6c063c2acedc2d749abbb60d0
SHA1 fbba45627f4dbbef0c48774336d747e71ff8e4c1
SHA512 85c2445aea9eb4b28180af7435edb7ed38948815d2f47acc6cf33d27fed96eafbcae49ba6a9124fc97deba013950173e8c987ce6b9a9ae2929da432281ba7b46
TLSH
T1F0217C4C3EB94D6AD9C7F69D7480058E93558A0B04871D430F03DFCDCE81AD932AA43D
MD5 SHA1 SHA512 TLSH

Submit Download

28bbde5a-303e-4293-9844-4c32304a550e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\28bbde5a-303e-4293-9844-4c32304a550e
Size 886B
SHA256 aeb06c7e3dac73f6c932edd7f597fee66bd7c79601178a85182e9a82d0ca2515
MD5 df7ef32d9f8b6961fa4b68d7be97aab3
SHA1 294f61de8d40e6520676ded25b942aae4204ffbd
SHA512 230aa1d778b9547743dca4a0e3b1451b37b6b6524ee99478a79c3fcde532397fd9b41c6ea01b730451d7f3b6a814ff78669c73c1a089b13b3e021a09cafd3fc3
TLSH
T12E1104418774B9B2DC69D39BC5A277414FE0642390CA0A083D65DB2C0CBE41E679A307
MD5 SHA1 SHA512 TLSH

Submit Download

3059d56f-0690-4dfb-9b72-750fb01bec19

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\3059d56f-0690-4dfb-9b72-750fb01bec19
Size 16KB
SHA256 2dc0269b053944d62caf04894eed7d00b1fd2a5be3706fe97c7aa7ce4eebd5ac
MD5 4ee86c2b2c5aa6becf8e43c78cb23e08
SHA1 4951518b06a350091c1cc01f1f64b0baed520fd8
SHA512 10d458f0bf697cc4136f069b3e0c291a97fbd49e85998e879f8114da867863ffe8eedfd3bcfb757a5f86de9cb9582badf3ad5c38543ebd240323a7f2544b28f2
SSDEEP 192:j8j0/B3l73c2NAlpLseJ26ao0OJed6Ag1UdVBos0SiC2H1znVRXIKM1hUIr64Vhq:j84/B3hzVWs0SivH1DVRlMUWRHq
TLSH
T19C72DA566820557A8691E3ACD4F8BFC3E6F528CF4C014FCAD7E47D0829DA06E112B94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d9395ef-93f1-4cd3-8c8f-c83fae52bbb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\4d9395ef-93f1-4cd3-8c8f-c83fae52bbb6
Size 235B
SHA256 6c45db5964f747e2299ce6efa422b8c098a493d69a7e9353f357a89b6a3020cf
MD5 143c05ff431c6589018fab656afa8bcd
SHA1 b90fbd591db5a6e02d00ead72517c67effce017e
SHA512 15fad18d6789e2c271e8895cf4c4490d93fb1b110e40ecd8b321d80881b5a3e0c60f0b6376217f21bffc3c4434593ac26c0e2da4378a736adcfc714191866162
TLSH
T10AD023C1248CA7BE08000F03F0E1B8E730884C3328709814E6D14078DAFCDC941D3C1B
MD5 SHA1 SHA512 TLSH

Submit Download

565c3dfd-789e-49e0-a0b4-61c4dff7473e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\565c3dfd-789e-49e0-a0b4-61c4dff7473e
Size 883B
SHA256 73cec98d0954acb5e0ba9c6de66dda655b880f1840aa805f5718ce2c0084bb66
MD5 da01435d67eaf9062e0bef15b7b486ba
SHA1 a55b79b4eb1711563e301a50078420ced06ea252
SHA512 1b513bb4b6329a941e3eb1afd8b7826251eccffcd6ba58c786a6ef297a3b97f8d274cf5d1a9b13a40e67e5b0869f0c01b4ddfe8360d53bb383f1055c2fea773f
TLSH
T1AE112340E771B9B3DCA9935BCA9237425BF4692390CA56083DB5CE180CBE92E579E307
MD5 SHA1 SHA512 TLSH

Submit Download

ce1ac241-096c-4144-8403-6426c91d6fce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\ce1ac241-096c-4144-8403-6426c91d6fce
Size 2KB
SHA256 282d0ba8ccb3c2390832868a55dd1eb6a362ce8bd162a9cec5e893d618872c5b
MD5 7a68968266080b9205fdb5ef43a20946
SHA1 0569f1774a6433c27fe0d289ca1bc6f2538a3c6f
SHA512 25987608f9f31767b3a6ac205d95dc9ecae755019d963de673d223218d744b56464b8f3906c2b8952267dc410bfa240a4f2608efcb11ae80454091785f999760
TLSH
T1A841545C75B85C379CDBF64CD592238D57308A4340C228C36E51DF0C8CA665D27AE51B
MD5 SHA1 SHA512 TLSH

Submit Download

f411e2a8-af4a-4a91-9f84-ba3d0e1c4d05

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\f411e2a8-af4a-4a91-9f84-ba3d0e1c4d05
Size 235B
SHA256 ffd4908eb5f63c453d343e5abe234cf5a5dec42d0aa7e106de051e21de34bbc8
MD5 0694b46317f1e955dd413fb080e5e517
SHA1 0e79884729d850e1ae824b861708928001a14a59
SHA512 61b80c0c764ab96acf6820c42d06b04c11df718d2716ae24cb8c818801d7d6f4526d51b3361c316449d9e7313025a6d21a7f063f796aeba4116c040a64f69d4d
TLSH
T145D097803498A72F0A0C8F13F0E068D272854C339074ACA09B5001B48ABAED8022181B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\extensions.json
Size 14KB
SHA256 1bd3c9439f541730fff0ee4184f8f9a962578891df325cfd0b17e6df2181e32c
MD5 5ff66298104b14333f6a36ce29bd3ddc
SHA1 91248237d7c7f479f3cdf771a7ae7f15c5b7ed58
SHA512 35b99d28ac7306a6c28b70c99152659403a4942d8229221f028f43790b930b9bb0f744924a41d45aec70e1b652562a94e9ed3d6a4a9dfafba8d180b5b34a687f
SSDEEP 384:6kI4vuUmldvr8dhWC94zn96o5L4HLL4PNL4HZL4HAL4HC:9I4WRfYXL4x62434l4x4C4i
TLSH
T1D062421545148EB8298FA79BAA367E02C37D473B60445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
Size 6KB
SHA256 8d40485b774a143dee43232db3dfae2f0519d977da301ca9192d077ddaf66545
MD5 b38da2ead4d9c81595ae14ca58753e1f
SHA1 ec6f964b9f1cee1dbe9f03d1a263f4756e47e9eb
SHA512 1387b2662e24d45916e4ee153753a9e49a8f3ff46e3cfe40360fbbe837c3244cdc971e2eff9f9f2b03da42a5e0924249cd7992b646e425bb3b6af6ad45b90a86
SSDEEP 96:xH6UTUBqGqgXf6DW1zSwZSSlSdv9j3nzRHytUyCYBw88n8L4cnpV1pS:ksRgXf6DWhZSSa9ytPBw88EpS
TLSH
T133E13D7894088B6F74B6776CAC688C316AB2413BBBBF28D750B554C4055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
Size 6KB
SHA256 6c1c19f8f26ec2e510eb55a7851a817030a8a09139ef227a2d7fa5d82e107639
MD5 36aea5596c182927bf28dcdeebadf6df
SHA1 7453cae90e9fa1c72ace48875ea5356512a6291a
SHA512 c33a11557bfab845ba2b98b05063df4a9760e432dc766d32ff71189dbc6fdc5c9490afec10b91a2b17c71411f45900d9f13f53defbda048e40addc5881c86f6d
SSDEEP 96:xH6UTUBqGqgXf6WJ1zStxSSlSdv9jcNnzRHytUyCYBw88n8L4cnpV1pS:ksRgXf6WJYxSS59ytPBw88EpS
TLSH
T1A2E13E7894488B7F74B6776CAC6888316AB2013BBBBF28D750B554C4055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
Size 6KB
SHA256 afd1b07d48d4074b654242d1d97bad00a85d279b9964b44290b2451b17aeb63d
MD5 3a957a32ae84caa6d9908b656feac086
SHA1 bc279cf1299a305a60567f5b3a9fc2a9579fad22
SHA512 52225ddea77fe52df9c273ef2192b92ff69555587c77e6190540df4dd8f6c266bf67834f50099a75350e65a05876eeda3e1a58aea80231da40cb695ef91da413
SSDEEP 96:xH6UTUBqGqgXf6DWObzSwZSSlSdv9j3nzRHytUyCYBw88n8L4cnpV1pS:ksRgXf6DWeZSSa9ytPBw88EpS
TLSH
T145E13D7894088B7F64B6776CAC688C316AB2413BBBBF28D710B554C4055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
Size 8KB
SHA256 7ff0b93a7b7e9fc5921df2f1ded34a89c6ef087ba6685d6b2a035832f127755e
MD5 65e43349560dd5f53feb53c8f5daa95c
SHA1 42f9ceda64563e8bd1a5c87c6387dbe34b37deaa
SHA512 6fcf64b804a354feac60d340e52ae5d20e53ad3b154e140143b6853215aadb2ffb06cb96eb691c6c9abdf73cb2e42f39e6862bf3c526e7131fd88cfae6516bf1
SSDEEP 96:xH6tTUBqGqgXf0DWObzSwZSSlSdv9j3nzRWRvY2tUyCQBw887Nw/8L4cnpV1pS:kxRgXf0DWeZSSa8RVt3Bw887hpS
TLSH
T126022F789404CB7F64B6767CAC688D306A72013BB6BF68D750B954C4460CF7441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 a9e4c491a8cebc20441b2e2378e9b92b619dcfb0a5de3af05a6b30a4b836d7cf
MD5 0824e05718535f8de0901d7fb225cd04
SHA1 79280a8bc7d748bfde1c25c70c1c39ef6d1b3213
SHA512 7eb68e4a3e52694d845a3aaaad3e0813c00633e0a22aebb36ccdb4c4399594f7d9e72e8b08cdab037f369fa0a38fbdbc686f73bbef68d7fd60f0fd496b77a53f
TLSH
T17221E7D6FBBE98A570909184C0CB6EE4CA889012493C7CF0D85F65051D8C89AB26DB5A
MD5 SHA1 SHA512 TLSH

Submit Download