f14dfd6e382e1fc056d037423238e9cb474b7e94d71fe84a7fac41baca36e832

Analysis

user interaction
yes
max time kernel
606s
max time network
755s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emuferal-installer-win64.exe
Size 178.8MB
Sample261029-x856yaet91
SHA256 f14dfd6e382e1fc056d037423238e9cb474b7e94d71fe84a7fac41baca36e832
MD5 0b7b50a3299e438d1552e4273da2ee4f
SHA1 48b33e6e8d84b1bb12b1d30d7821df0fd32b5fcb
SHA512 dcaa86fe91ac8f3131ed7542b2c3b58cc9ad9ab64b53a02684e3a1bed9e0cfffc236d87aed2892b6f696f05d2affa0e7cd4e57d74307170c77acf30ae3dc841e
SSDEEP 3145728:FtdEx3U3YnOhNbRIaLrDsZh127tBtafcWrJ8ruoEDVW22UNI1nzCT4X:FM3eYn+hS4AZSBDrXmTynuT0
TLSH
T1179833B98A1D00A3CF8EC6B1B85FC64750DB45FA2053249F5BD14A12F75B78A2FB4A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1696	javaw.exe
3108	javaw.exe
3316	javaw.exe

Loads dropped DLL 45 IoCs

pid	Process
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3108	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5732	wscript.exe
1392	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
544	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	javaw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	javaw.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emuferal-installer-win64.exe

Checks processor information in registry 2 TTPs 39 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000030000000100000000000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4 = 14001f400e3174f8b7b6dc47bc84b9e6b38f59030000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{43FED747-B357-468E-AE70-EE0CB0F46508}\LogicalViewMode = "2"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{43FED747-B357-468E-AE70-EE0CB0F46508}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{4CC006E0-E3F9-45A9-A319-C1D2B96D6A00}\Mode = "8"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f0005398e082303024b98265d99428e115f0000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\emuferal-online\ = "URL : EmuFeral Online emuferal-online"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\emuferal-online	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\emuferal-online\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0400000003000000020000000100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{43FED747-B357-468E-AE70-EE0CB0F46508}\GroupByKey:PID = "2"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{43FED747-B357-468E-AE70-EE0CB0F46508}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{4CC006E0-E3F9-45A9-A319-C1D2B96D6A00}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{43FED747-B357-468E-AE70-EE0CB0F46508}\IconSize = "48"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{4CC006E0-E3F9-45A9-A319-C1D2B96D6A00}\IconSize = "32"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{43FED747-B357-468E-AE70-EE0CB0F46508}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000060000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000f4eec83032a8e241ab32e3c3ca28fd2907000000a0000000f4eec83032a8e241ab32e3c3ca28fd2911000000a0000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{4CC006E0-E3F9-45A9-A319-C1D2B96D6A00}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3992	firefox.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	firefox.exe
Token: SeDebugPrivilege	4004	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe
Token: SeDebugPrivilege	3992	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
1696	javaw.exe
3108	javaw.exe
3108	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
3316	javaw.exe
4004	firefox.exe
3992	firefox.exe
3992	firefox.exe
3992	firefox.exe
3992	firefox.exe
3992	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 1696	5240	emuferal-installer-win64.exe	89
PID 1696 wrote to memory of 5160	1696	javaw.exe	91
PID 1696 wrote to memory of 4520	1696	javaw.exe	93
PID 1696 wrote to memory of 1468	1696	javaw.exe	95
PID 1696 wrote to memory of 6104	1696	javaw.exe	97
PID 1696 wrote to memory of 6000	1696	javaw.exe	99
PID 1696 wrote to memory of 5132	1696	javaw.exe	101
PID 1696 wrote to memory of 5732	1696	javaw.exe	103
PID 1696 wrote to memory of 1392	1696	javaw.exe	104
PID 1696 wrote to memory of 4624	1696	javaw.exe	105
PID 1696 wrote to memory of 4844	1696	javaw.exe	107
PID 1696 wrote to memory of 5280	1696	javaw.exe	109
PID 1696 wrote to memory of 544	1696	javaw.exe	111
PID 544 wrote to memory of 3108	544	cmd.exe	113
PID 3108 wrote to memory of 3316	3108	javaw.exe	115
PID 4032 wrote to memory of 4004	4032	firefox.exe	119
PID 4032 wrote to memory of 4004	4032	firefox.exe	119
PID 4004 wrote to memory of 2228	4004	firefox.exe	120
PID 4004 wrote to memory of 2228	4004	firefox.exe	120
PID 4004 wrote to memory of 2228	4004	firefox.exe	120
PID 4004 wrote to memory of 4092	4004	firefox.exe	121
PID 4004 wrote to memory of 4092	4004	firefox.exe	121
PID 4004 wrote to memory of 4092	4004	firefox.exe	121
PID 4004 wrote to memory of 4092	4004	firefox.exe	121
PID 4004 wrote to memory of 5388	4004	firefox.exe	122
PID 4004 wrote to memory of 5388	4004	firefox.exe	122
PID 4004 wrote to memory of 5388	4004	firefox.exe	122
PID 4004 wrote to memory of 5388	4004	firefox.exe	122
PID 4004 wrote to memory of 5252	4004	firefox.exe	123
PID 4004 wrote to memory of 5252	4004	firefox.exe	123
PID 4004 wrote to memory of 5252	4004	firefox.exe	123
PID 4004 wrote to memory of 4216	4004	firefox.exe	124
PID 4004 wrote to memory of 4216	4004	firefox.exe	124
PID 4004 wrote to memory of 4216	4004	firefox.exe	124
PID 4004 wrote to memory of 4216	4004	firefox.exe	124
PID 4004 wrote to memory of 4652	4004	firefox.exe	125
PID 4004 wrote to memory of 4652	4004	firefox.exe	125
PID 4004 wrote to memory of 4652	4004	firefox.exe	125
PID 4004 wrote to memory of 4652	4004	firefox.exe	125
PID 4004 wrote to memory of 5428	4004	firefox.exe	126
PID 4004 wrote to memory of 5428	4004	firefox.exe	126
PID 4004 wrote to memory of 5428	4004	firefox.exe	126
PID 4004 wrote to memory of 5428	4004	firefox.exe	126
PID 4004 wrote to memory of 4576	4004	firefox.exe	127
PID 4004 wrote to memory of 4576	4004	firefox.exe	127
PID 4004 wrote to memory of 4576	4004	firefox.exe	127
PID 4004 wrote to memory of 4576	4004	firefox.exe	127
PID 4004 wrote to memory of 484	4004	firefox.exe	128
PID 4004 wrote to memory of 484	4004	firefox.exe	128
PID 4004 wrote to memory of 484	4004	firefox.exe	128
PID 4004 wrote to memory of 484	4004	firefox.exe	128
PID 4004 wrote to memory of 3396	4004	firefox.exe	129
PID 4004 wrote to memory of 3396	4004	firefox.exe	129
PID 4004 wrote to memory of 3396	4004	firefox.exe	129
PID 4004 wrote to memory of 3396	4004	firefox.exe	129
PID 4004 wrote to memory of 5460	4004	firefox.exe	130
PID 4004 wrote to memory of 5460	4004	firefox.exe	130
PID 4004 wrote to memory of 5460	4004	firefox.exe	130
PID 4004 wrote to memory of 5460	4004	firefox.exe	130
PID 4004 wrote to memory of 2984	4004	firefox.exe	131
PID 4004 wrote to memory of 2984	4004	firefox.exe	131
PID 4004 wrote to memory of 2984	4004	firefox.exe	131
PID 4004 wrote to memory of 2984	4004	firefox.exe	131
PID 4004 wrote to memory of 856	4004	firefox.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\emuferal-installer-win64.exe
"C:\Users\Admin\AppData\Local\Temp\emuferal-installer-win64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\javaw.exe
  "C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\javaw.exe" -cp "libs/error_prone_annotations.jar";"libs/gson.jar";"Centuria Launcher Installer.jar" org.asf.centuria.launcher.updater.LauncherUpdaterMain
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\emuferal-online /f
    3⤵
    PID:5160
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\emuferal-online /v DisplayIcon /d C:\Users\Admin\AppData\Local\emuferal-online\centuria-installer\icon.ico /f
    3⤵
    PID:4520
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\emuferal-online /v DisplayName /d "EmuFeral Online" /f
    3⤵
    PID:1468
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\emuferal-online /v NoRepair /t REG_DWORD /d 1 /f
    3⤵
    PID:6104
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\emuferal-online /v ModifyPath /d \"C:\Users\Admin\AppData\Local\emuferal-online\centuria-installer\launcher.bat\" /f
    3⤵
    PID:6000
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\emuferal-online /v UninstallString /d \"C:\Users\Admin\AppData\Local\emuferal-online\centuria-installer\launcher.bat\" /f
    3⤵
    PID:5132
- - C:\Windows\SYSTEM32\wscript.exe
    wscript C:\Users\Admin\AppData\Local\Temp\desktopcreate-6871266179947255456.vbs "C:\Users\Admin\Desktop\EmuFeral Online.lnk" C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\icon.ico C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\win\java-17\bin\javaw.exe "-cp 'libs/error_prone_annotations.jar;libs/gson.jar;Centuria Launcher Updater.jar' org.asf.centuria.launcher.updater.LauncherUpdaterMain" C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5732
- - C:\Windows\SYSTEM32\wscript.exe
    wscript C:\Users\Admin\AppData\Local\Temp\desktopcreate-10221229893936709785.vbs "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EmuFeral Online.lnk" C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\icon.ico C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\win\java-17\bin\javaw.exe "-cp 'libs/error_prone_annotations.jar;libs/gson.jar;Centuria Launcher Updater.jar' org.asf.centuria.launcher.updater.LauncherUpdaterMain" C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1392
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Classes\emuferal-online /d "URL : EmuFeral Online emuferal-online" /f
    3⤵
    - Modifies registry class
    PID:4624
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Classes\emuferal-online /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    PID:4844
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Classes\emuferal-online\shell\open\command /d "\"C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\launcher.bat\" --launch-url %u" /f
    3⤵
    - Modifies registry class
    PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\launcher.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\win\java-17\bin\javaw.exe
      win\java-17\bin\javaw -cp "Centuria Launcher Updater.jar;C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\libs\error_prone_annotations.jar;C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\libs\gson.jar" org.asf.centuria.launcher.updater.LauncherUpdaterMain
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\win\java-17\bin\javaw.exe
        
        C:\Users\Admin\AppData\Local\emuferal-online\centuria-launcher\win\java-17\bin\javaw.exe -cp "libs/commons-compress.jar;libs/gson.jar;libs/httpclient5.jar;libs/httpcore5.jar;libs/httpcore5-h2.jar;libs/joml.jar;libs/slf4j-api.jar;libs/xz.jar;FeralTweaks Launcher.jar" org.asf.centuria.launcher.feraltweaks.LauncherMain "EmuFeral Online" https://launcher.emuferal.openferal.net/servers/emuferal-online/stable
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:3316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {b35579b1-69f6-4a5b-9856-dbd1c9731030} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2392 -prefsLen 27133 -prefMapHandle 2396 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {ef412bdb-dd14-4823-b158-28ab0cf4510c} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27274 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {cc851ea2-2da3-49ad-b744-5947c2f1ef60} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27274 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 4052 -initialChannelId {e9e03286-6874-4bc7-8c82-093c65866cf5} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4552 -prefsLen 34773 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4568 -initialChannelId {2d022e28-67b2-402f-b7e9-a23b78631b95} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5180 -prefsLen 35010 -prefMapHandle 5184 -prefMapSize 270279 -ipcHandle 5144 -initialChannelId {319bdcb9-d9a4-443a-a6ab-4374e6aff20c} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3316 -prefsLen 32952 -prefMapHandle 5032 -prefMapSize 270279 -jsInitHandle 3108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5072 -initialChannelId {da83704b-cd8c-4354-a193-5a10558b6d2f} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {082aa944-44fd-4092-8ca2-f5deb670ad87} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 32952 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {3aa2750d-5205-41ac-9659-f7fc17a2bc09} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6500 -prefsLen 33071 -prefMapHandle 6504 -prefMapSize 270279 -jsInitHandle 6508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6516 -initialChannelId {79f867ee-1282-46f1-be47-776ca069761b} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2768 -prefsLen 33486 -prefMapHandle 4796 -prefMapSize 270279 -jsInitHandle 4756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4744 -initialChannelId {c69aee6a-a07b-4adf-b77f-7434837db2b1} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6336 -prefsLen 36139 -prefMapHandle 6440 -prefMapSize 270279 -jsInitHandle 6416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6332 -initialChannelId {f6cb3e32-1488-47c0-943d-298e46cb8661} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6348 -prefsLen 36885 -prefMapHandle 4972 -prefMapSize 270279 -jsInitHandle 6284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6676 -initialChannelId {d02c549c-1034-45e3-8240-535916b45df2} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 6976 -prefsLen 40022 -prefMapHandle 7060 -prefMapSize 270279 -ipcHandle 7068 -initialChannelId {f412e701-ef3c-4e69-92d1-7fd3a09daaa4} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7096 -prefsLen 36885 -prefMapHandle 7100 -prefMapSize 270279 -jsInitHandle 7104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7112 -initialChannelId {58c9bc53-cd51-4d92-a87b-639c326ef938} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6952 -prefsLen 36885 -prefMapHandle 6956 -prefMapSize 270279 -jsInitHandle 6960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6544 -initialChannelId {c2f1a5ac-31f5-4b2b-a051-e1b160f7c9c4} -parentPid 4004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:2352

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3848

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
PID:5496

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:6160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
PID:6532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.contile.json
Size 4KB
SHA256 8ff59a36749ad99ff12dde1b51f549918187def8551383d5449eb65d56bc6d65
MD5 1041521ac720ba2f43daddbad39f6022
SHA1 40736bf72d7e1b2513190407de8ec748ea4452ba
SHA512 e2a1ff5ebbf218ff33901ce330e8a444e88f243a0606830cbce725d393817120da6a0d09ed8559725135bde7e63d237ea665b39c540c301b2c5e96ebcbcb8b2e
SSDEEP 96:TkskuM3GJ2HomuuFlVOzT+mRC32+n0ayFjVOj9cqou2Nolz:bMaRql/mRIDAjwuq3nF
TLSH
T17691D7AFC43898521B70ABD67C5B2258F10BB001E8E4DE9C716A5C60876C7BFC0DAA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 5c287c2d09a74cfa969feed7fac8093b79b08417e61b4ccbb2fe9c274cb94bb3
MD5 971eaa86e8d6d0127f4dafef84c1ea1a
SHA1 7ddbcab7bb9fc5d3e0da1f5a54d9f7a5a02fe69a
SHA512 d9297bc18b834ac401d560a321c7e01f33a384b1e87eb5e397d937946dc9dea95c6f0e0d838d5cc9196804cf4b88230cf6d901d20d83076c9424948cf7a2cff1
SSDEEP 768:LyLLm3MzDAq51nr7FGlJ8TvvUENixjJmG7+vX1j81OIXapOOrS7:2PmWAiZFGlJWUENkRyGOSaq
TLSH
T1507319B396E9B2BB2B9137D72C0F795B63D20195E34506CCFCE9CA1C81CD654523E2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24376

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\24376
Size 257KB
SHA256 718630dae5fe466b244ba260916ebf6a7415f4da3e99555d61d6b3ed2391319f
MD5 daa7ff20ab65a4e27ce33505c742a263
SHA1 bf433a44c407774024efc660b4cf2d1adb49f772
SHA512 f075472823e97cfea569d91d790791d91b7c5952b07fb9b09b02d339969097890d03ecd914fada4e89cb96fbef8c6c8b840d2e2484a32fa181fb7d1797c9b6a5
SSDEEP 1536:sYCYPsfSyUwn3LiqRpMSPrF0lvkcIfUsNj2A4EUQvkBGamDRwUuqJT0EK8Ct92ZI:2SOt0ecEbV4EUQcBM1T0h2Zj3U
TLSH
T1F444F7F396AC30FB175287DC6C5D72CF62AF4239DB5208DAFC688148C389E65107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26750

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\26750
Size 52B
SHA256 a913080512b5cd4fb0150d05890a0db4f5342c6a14fa062e4af91ebebbf6c9ef
MD5 514d0cb784a30ee487687e12c1c20f1f
SHA1 ccf5ae229dd0aefe9393619f5cd00eb10f839292
SHA512 6648b7d3bf802041772908807e3af8a06c47fef3b4fa17467785c4ce7faf8ba395b10e88be09fb5aa46733762e281d30993c98c40ba32baf2083111107a76ad5
TLSH
T10A90021442519944E59480310810F2B54A243D154891161238D10B5914152E2100C128
MD5 SHA1 SHA512 TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 ac3d1a25ee1df3940516cc581989f885b7b071a1822f4c6e6e5f73bdd94bef7b
MD5 28f10e2c8f8733e5899fac66ae4de166
SHA1 cbcd64c05a43027ea74c28ba8bff8d57ef8355dd
SHA512 a34b5dc53e16019c659168c9e96f2bf42167252880046ad62e5d080bf5beaef5a81fa438b5df5c4649fc9f2883ca7cc80b09a4f428513af1a59492c367cf4098
SSDEEP 384:HXwIiO024YzWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA5a51D:36ZYzWTToXJWTTogB7S/AmVAf+hRMgeV
TLSH
T1E1727D7D9F423CAD165780E8C8B983558D1CB6ABDFB5C02D259C3E0DCA88A1670F985F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08B2F11DC2B96DD8A3BD8DA58CE657A4F145B477

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\08B2F11DC2B96DD8A3BD8DA58CE657A4F145B477
Size 357KB
SHA256 8bbd479190bd395fb25810ab85b3f706f1504a9a18c761129f5b6d8ef9803bdf
MD5 bbc929cf0569512b41e5a47df15032ec
SHA1 8cf357d38917be8b41622bf47d9f522ebf0aa0d4
SHA512 fec1990bb490484678fb867ca62a8a41e4d5ea194e4a82b88a77a0f3b9b81902e68014d29051eb261b25560e472dca372e3a313cbd5ac80023d7d6e8d970ec10
SSDEEP 6144:wZpDEwRnuLHBNUjtt7heEW7eSh21T5TKK2lSu1raoZYlbm:wZdEwRuHsh17SmNTKKLoN
TLSH
T1E974233909C189E0404F13F6F7646E9EA699318F5E63FC0EFB15E5C791AE1E62F21209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D975EF2640B444DECA4F5AD7428A331F6A6B7DA2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\D975EF2640B444DECA4F5AD7428A331F6A6B7DA2
Size 119KB
SHA256 d934adc795861b2c786d488fe199dbc30c8ecadcea6ef2727c59f92f8565658e
MD5 0186b6cec209d2a55d1cff1c07b41559
SHA1 7c93152b09146c6eae5b2544e45cb62463159051
SHA512 87e658aaae46b8158f264aee2a99f06fde7333442d3f172104dd3955322a1fdfd01336f1ea4c9e411d7be05989a17f52cdf69f7a5bbf138a86f3886fab0b78ac
SSDEEP 3072:PRrzZ9O2gusm5h0eH8UFf7EKWt6LlQPZwRi//zrrede2z2swS:JHnZD0eH8Af7hWA2ZwRi/rMpiswS
TLSH
T166C312BB179672084749C854F276B878EF615B838B41FE89B9005588C8BDBC7C5D2DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 e5d6cc449d8a7f8f2861607f9f158836e62a156e40a7f146989c2f811aefe77e
MD5 b5e805fba96cc1f96aa9ad9d8fb84f60
SHA1 42cd8a7652a352d7f8719750d02be54e1745f5d3
SHA512 41398afd98a5937effe3871f0aaf282c1304d99b96ecaf102dcad0dd165c2a78363381d512ecb9371c2a06885d87852fa317e8d62868324cb5403c40c00c9454
SSDEEP 384:HGNQiO024YVWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAky:mDZYVWTToXJWTTogB7S/AmVAf+hRMny
TLSH
T18C728E7D8F013CBD1B1790E8C8B583598D18B6A7DFB6C06D169C3D09C988A1671FA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 bdf62d9249624f610ee04083ee7b3f74aa4182c89b9b60c68221e5150dceede7
MD5 1c98a8d483e1dbb6175ca593ffab9bb0
SHA1 a176180124a2fe42e751dcc907528e3280448997
SHA512 8580bd7ae9d6045969276ca8736d6a0c8a3b2e07ac6fb885c54d158ed7ecbc14025c6b0001fd72600c99b609297cd5d097b2e715211cdc1ecb898f5a9d7fee3a
SSDEEP 1536:jTrli0ghYUsDuDgP9nlJLMFLZtndHzhn6PaI/M7m4f2HAUcD1xmsT0+BALwOKKVT:j3lAUP9nelgPaROK5HT38R
TLSH
T103A3AFB6DBA2CD3D64FFD419AA81C53EFE262400B3A72009C963672462C6FB47675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 67f24a1da0fcbb0a17c68c919ea8e3cc74e63b658ffe6eb30643b2c1b8390c68
MD5 8d3ef5f0412bb2f9d818969c9a3ec1fe
SHA1 c830d701998d481d7cfde7133375ff72ec9137d5
SHA512 69a9fa83c891408f2a18949db6aac341cfd48dd374718d9c83777d7920b2aedc75c5dceb0d9bf527dcbec938a9cbe0e0d8b8e49b1fdcaac353889128f4c3645a
SSDEEP 1536:XTrli0ghYUsDuDgP9nl1cdhHjyLxKiQ/fN2K6GaI/M7m4f2HAUcD1xmsT0+BALwg:X3lAUP9nkTyaH4GaROK5HT38Sa
TLSH
T1D1B3AFB6DBA2CD2D68FFD42DAB81853EFD262410B3E72009C863636462C6F747675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Centuria Launcher Installer.jar

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\Centuria Launcher Installer.jar
Size 237KB
SHA256 676ae6e53acf643c04a20cf6b7edb43bd0edadf59ae0297172e3f636bc3936fa
MD5 f6ed66ecc512e270ce3ddda8adaee92c
SHA1 cd9339d406763ae3579f3f1959aa85f1aee6cffb
SHA512 a8965a590089533204b6b49a657e4124370f97b71627a1a990c069c1df102bef5e6ac5d5df7a359d043c9097c581f00e482857f78e0d8d44476654adb2dcd718
SSDEEP 6144:MjlWYYjXn3KTXQq6NpflyIop/LHPxNn5adBAH9di:MjXGHmHSf4L9L5r4qQ
TLSH
T1AF34121AD930B527F1B144BDD0CA4A63BB3D7498962CB46328D40D0CE6B9F6C5EEB06C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\installerdata\icon.ico
Size 51KB
SHA256 a248d341e0c6fe2e66866843589e2613f39a72f9b921e76266ae59c196a7aa52
MD5 4f91d13f517971ab9344eacb97e9f9e9
SHA1 60ed0d205499198fb9304fbe4de4a744f392563f
SHA512 e7c16fab1e8a8391df30d0b39efceb09091dfbb47fd6a9d0d023396fb8917cb23634ead1728fe387274939044e1a3a7c4aedb2b8bd7324893a232f98242fe2da
SSDEEP 768:h7s077MV9zIZ2pKTEP/eTm2whVYMou128J6XYdzbz5b/4blMemX5:20vMV9ckKEGTm2why1IdzbNb4bl25
TLSH
T15133F1B063A0DF33E1968A739763CC2E5B149478409CEB56718CE40BC0F26E6F50A6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\installerdata\icon.png
Size 138KB
SHA256 852296f7a287309a18c6e2b60810aad122c591730d002f59da11b1cf39f43a2f
MD5 d9f948cfa964a52632350f54c3fe96e1
SHA1 7748013107e79b79f1ad5faf2938db858b4bf028
SHA512 b7c6e0c1806aacf9effb983e87157009101e38cd231519c695c801e6d1f37f73ba0538cf2f52c6f8d9d91d289daf794c6fbd35d4445af548f4b5a9206675cb6b
SSDEEP 3072:Rajcq9l/GsFY2Cmbjm7SZZHAO5Bp/hLnE9mz3aqZ8BgOusg2Zb2gxNcdzO43w2vl:Ra9JNNbjm7eRPrFhDEi3aqZohg2Zb2gC
TLSH
T1F0D3129422C3E0EEBF5B963140526D1A25B8AED3449601348AB5AAD4F34F4570BBF9FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher-logged.bat

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\installerdata\launcher-logged.bat
Size 325B
SHA256 458eec72d05d7b2828268616935562c9aa810694474da928ee4006a25382a87d
MD5 9d6dd667569c452aaa7d9738250811a0
SHA1 b8978f5b7583687d824d907eb4ee17cc8a9787a1
SHA512 6a0515146243f2dab51960177b07ae75d69c3f86ddfe0f9a51886ad24e2dc7d4d4419e3feeb400129ec1f6955b4c306fef35c421778a5545f99043168541994e
TLSH
T1F3E07D2130E09410B13F08CAD8665EAA39FC509C9312C9857B5400FE48CFFBA2D81852
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.bat

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\installerdata\launcher.bat
Size 325B
SHA256 1ac18abb773e086624c2109759af843da6f96014b47f1c6263acf8fded5ea304
MD5 61ec156e4df54b154e3705941bee0b74
SHA1 8e106a804420cf3d5bc6ccdd3f66f3dc3b90c576
SHA512 a95cf7a8ab3abb79c77f143fa214bea81842d927dcbacbaaed92bc477ee628f4f88e0bb3d16fc8397d08ca78024d3cd1d2165394974a3917394ca22cbedef686
TLSH
T1EBE07D2130D09414B13F08D9D8675F6575FC90AC93128984374404FE84CFFBB2C81852
MD5 SHA1 SHA512 TLSH

Submit Download

error_prone_annotations.jar

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\libs\error_prone_annotations.jar
Size 19KB
SHA256 a56e782b5b50811ac204073a355a21d915a2107fce13ec711331ad036f660fcc
MD5 75e3b25da8b8a2136463c4674f5e49bf
SHA1 4381275efdef6ddfae38f002c31e84cd001c97f0
SHA512 e2eb4bf9f36f95a4d4c5ea344db5cd90a456e63bef8e52932b8f6f4ecfdd59cb2f6c2ce9e67b0070c82177e42885688b95afef591b16001f789b378f18afdf30
SSDEEP 384:GzGvxk+KGHaMIvqURstW9SzWa677Iltcex:GK9QMIvqEs4Ja677S
TLSH
T11B92D7A7BA84E53FF90B947231308026F835DEA4761E7697ABA015445D82C1D5F0BBCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gson.jar

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\libs\gson.jar
Size 283KB
SHA256 dd0ce1b55a3ed2080cb70f9c655850cda86c206862310009dcb5e5c95265a5e0
MD5 a2c47e14ce5e956105458fe455f5d542
SHA1 48b8230771e573b54ce6e867a9001e75977fe78e
SHA512 8974a052656d2e5ec968b6bac2edf51413ffc62040fdc65f14f00597e738ab544d22487f8579ba90618b5a7f94ef33773510fac67b408fee6ed274b38f3d9947
SSDEEP 6144:13o1aBBATxSoICcO4CbsIEecPQzX9zpwa7yWEVqv8CneGYZ:1Y1aUTxDcO4CbOnYb1sT8vZeDZ
TLSH
T1A054BFD7B948899FF98FC47A00008016F8F895E9D58AE21F16B085FB4863DD85F16BED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server.json

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\server.json
Size 233B
SHA256 dda6ce6096aed8d021cd08a1c9bfed166bc7c80278f4a0d174f30074ef149aa1
MD5 938b7027fe72ae23782ad48d8b2a8b5d
SHA1 0109fc75eed397a13222838239873d0d254d57bc
SHA512 92f735ba4122fd45fd13fdbecc7802aba8e040cc1d643ded9774ef22d8d55c443fa2ce6917d6f306b57e5ce5dce164d97d308dd5e530d024c352f200a13615b8
TLSH
T182D0A70F3643530F0280968D55987BFD4A8E48E720890D22F714D85EE7EC91D3001844
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\VCRUNTIME140.dll
Size 93KB
SHA256 92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76
MD5 ade7aac069131f54e4294f722c17a412
SHA1 fede04724bdd280dae2c3ce04db0fe5f6e54988d
SHA512 76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048
SSDEEP 1536:wkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOHH+FVfecbTUhnvUuJ:wWD4eUp+HQpcNg0MFGH+FVfecbTUh8c
TLSH
T1CA937C4A7BA442BBD06AC174C1E34A16F771B844873053CF13B64AAA5F67BE05E3E346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
MD5 919e653868a3d9f0c9865941573025df
SHA1 eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2
SHA512 6aec9d7767eb82ebc893ebd97d499debff8da130817b6bb4bcb5eb5de1b074898f87db4f6c48b50052d4f8a027b3a707cad9d7ed5837a6dd9b53642b8a168932
SSDEEP 192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ
TLSH
T186421A838EFC9543F9A66E701B99D9833C3DABD76910905925A8F19C2CC33D1EB0072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-console-l1-2-0.dll
Size 11KB
SHA256 00942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
MD5 7676560d0e9bc1ee9502d2f920d2892f
SHA1 4a7a7a99900e41ff8a359ca85949acd828ddb068
SHA512 f1e8db9ad44cd1aa991b9ed0e000c58978eb60b3b7d9908b6eb78e8146e9e12590b0014fc4a97bc490ffe378c0bf59a6e02109bfd8a01c3b6d0d653a5b612d15
SSDEEP 192:iTWYhWyWWFYg7VWQ4uWq6Cu87ZqnajgnLSyu:sWYhWi1XHllk2yu
TLSH
T15B423A93CEFC9543F5A6AD704699D9833C3CABCB2910916536A8F19D2CD33D1EB00A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-datetime-l1-1-0.dll
Size 11KB
SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
MD5 ac51e3459e8fce2a646a6ad4a2e220b9
SHA1 60cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a
SHA512 6239240d4f4fa64fc771370fb25a16269f91a59a81a99a6a021b8f57ca93d6bb3b3fcecc8dede0ef7914652a2c85d84d774f13a4143536a3f986487a776a2eae
SSDEEP 192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH
TLSH
T1FE322A838BBC4503FEA32EB042A9D9937D3D67D62A10C12A05B5F1682C937D1EB14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
MD5 b0e0678ddc403effc7cdc69ae6d641fb
SHA1 c1a4ce4ded47740d3518cd1ff9e9ce277d959335
SHA512 2badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4
SSDEEP 192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5
TLSH
T1E9321B828BFC9103F9A7AFB053D9D9933C3DA7C72910916605A9F45D2CD37D1AB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
MD5 94788729c9e7b9c888f4e323a27ab548
SHA1 b0ba0c4cf1d8b2b94532aa1880310f28e87756ec
SHA512 ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6
SSDEEP 192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm
TLSH
T146321A928BFC8043F9E76E7017A5D9837C3D77D7295081A506A8F1A92C933D1EF11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
MD5 580d9ea2308fc2d2d2054a79ea63227c
SHA1 04b3f21cbba6d59a61cd839ae3192ea111856f65
SHA512 97c1d3f4f9add03f21c6b3517e1d88d1bf9a8733d7bdca1aecba9e238d58ff35780c4d865461cc7cd29e9480b3b3b60864abb664dcdc6f691383d0b281c33369
SSDEEP 192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu
TLSH
T1E962E853D9B4F25BF98FAE315192D843683852C7042541C91BD8A7AD3CE73C5E3D8A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
MD5 35bc1f1c6fbccec7eb8819178ef67664
SHA1 bbcad0148ff008e984a75937aaddf1ef6fda5e0c
SHA512 9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
SSDEEP 192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N
TLSH
T111323B928BBC4143F9D66E7053E8D9877C3DA3DB2E60815905A9F09D2C837D1EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
MD5 3bf4406de02aa148f460e5d709f4f67d
SHA1 89b28107c39bb216da00507ffd8adb7838d883f6
SHA512 5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
SSDEEP 192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq
TLSH
T1C5321AC2CBFC9403F9A76E705299D8877C3DA7C7291081690AA8F5AC2C973C0EB51E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-handle-l1-1-0.dll
Size 11KB
SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
MD5 bbafa10627af6dfae5ed6e4aeae57b2a
SHA1 3094832b393416f212db9107add80a6e93a37947
SHA512 d5fcba2314ffe7ff6e8b350d65a2cdd99ca95ea36b71b861733bc1ed6b6bb4d85d4b1c4c4de2769fbf90d4100b343c250347d9ed1425f4a6c3fe6a20aed01f17
SSDEEP 192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS
TLSH
T1BC324DC2CBBC8003F9A76E7047A9D9937D3DA3DB2911816A05A9F1692C933C1DB10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
MD5 3a4b6b36470bad66621542f6d0d153ab
SHA1 5005454ba8e13bac64189c7a8416ecc1e3834dc6
SHA512 84b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294
SSDEEP 192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA
TLSH
T13E422A85CAEC9103F9676EB053D5D9873C3DB7C62510802615A8F19C2C937D1EB25B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\awt.dll
Size 1.4MB
SHA256 36e753b5274c965a75da0956fde88cd7b1bee3c58e706ebca0b4ec8ea625af01
MD5 2da1fc83fec0a5be4d850bb637dc1966
SHA1 dec99ea8bd104101f374242b298ae57b0ec024e4
SHA512 1e103d10522c4be87aef72df358e6fa2eee1b8a720c49f8dab793fcd80c3dcf94a031efd5ec0ed21bfb6806ea04f5fa7fd356c10cea4eb7b40b1a042cd967892
SSDEEP 24576:8O48vnOswFDpwFg3stvXyx60hTGLGRfhyl0RSeolz/A72z:T9vnOhyVFyx6gTGLGRfhylrF4qz
TLSH
T1FD656C07E3954095E9EB80B4C15B5A1FE7B27419130097FB27A58B6EFF67BE0A13A301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontmanager.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\fontmanager.dll
Size 658KB
SHA256 328f838aa01c47043c36f65dd07308e3514068150995a50e305431cc5d7f3c78
MD5 c66d70468c06e97847583b088245309e
SHA1 1e01adff53c78d3ac254daf15b4fcfcadda42203
SHA512 692a098f1cf919345bf634d0f61818e770c4e58dc9438e0f9d74459f61daef334e055ba874aa37c975b1c9914efe48508feed71cd4f56cc5da866bf31c42b028
SSDEEP 12288:Gc8Ur84vgkpRKjhA9RgBDPmQ4W0fPRLKXtiFFa:+4vgkpR0PmQ4Wcl0iFFa
TLSH
T180E47D49F75659E5D27F813581E68A1FE3B6B10107034BEB29A847A5EE136F23F3A700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freetype.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\freetype.dll
Size 537KB
SHA256 d2ce1dfa284ef121d22d3cdf2d663661c7419dba374eae232f5cfc91a5b936f2
MD5 1bd39af5e0b93f67913ebc1a576088eb
SHA1 f9f835c2f6f2317b07b586b781ee28a84f436fe7
SHA512 a8226136b789e1aff215c357a604e8e772e52b69d741f7493b3d65904983a63d8db2e8b5e675c46393837e1de0c961d54609d1a6b8d1724b9a543e5de4b2ccf0
SSDEEP 6144:JOUPF+y0/Cnosw6OjHQI0hjK/OXeaMVPL5kUTfvM0qS2Rj+LNFxWsEWmfDnJqnow:J0y4CoswvQI09KGXeaI5nSkdfEWmUow
TLSH
T11AC48D82F3A817E8C667C2388217970BE7B5740513619BDB17E04B6A6F13FE56B39324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\java.dll
Size 140KB
SHA256 34fe8520658397b24b80e0ce550ed649e25adf6e5c0a6bd1697df535a2dbf2ad
MD5 45151f3c20f43568656bcff0aa6f1aee
SHA1 19d86877fbe9921fb7d4f44f15c8cd3509f8104f
SHA512 6c111a6ee580b43019a37981b36e1796d52ea6ca5f22ef4f0a4b9ef8024ca37327d74573ae1fc11ddfad34ba7a368718c017aa5d95898a4d7d4bfa5c773de454
SSDEEP 3072:F1NW6yylNnnmb1VMm31GFVZTVePS34G/0gFPWrr76bb+dy+:zNTVbm7E53C
TLSH
T177E33B0BB30240A2F41AB6B8701A850BD37A7461512DD3BE43E98A4F9F6FB317D97791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\javaw.exe
Size 46KB
SHA256 ba79e11dce8a9d99ffee473635b93a06d1086695d3dd8c4cc5343252393d46f6
MD5 43cfb304bf1600db7a219c84b343ac3d
SHA1 22341bcd96bb196fbb3aed21904f0d9fbb78e71b
SHA512 04544a3a4a766d6276947da5a43dfe8d384a6df8bdbde253b95f94b74fcbc76a5c187907a2e78355bffea2f4b52c692f9666fc4090e53fc8a1fa6ac2da3e19a9
SSDEEP 768:eQ/2UM5R2TyJ5R3s8D/bkt5Ruz3Vb3GyA5aYiUFpyzcEhHh:e6M5RdJ5R3sozkt5RA3Gf5a7UCoa
TLSH
T15D235C87AA182C81F02F84B154A779165574BD032BD1B3FB7DCAB21E0D71391A8276EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\jimage.dll
Size 30KB
SHA256 dbcd2015a99a4cdaf5b65000cd9d6787a8aa31f3661f0db9249808f050601db3
MD5 28b1600bcb31f0f708709f2196332c36
SHA1 8dca0e27375f922900664a2a12e70e7bf903e5fc
SHA512 4177b293b00566374102bd1bc0dee86f0d7ee278d36ad806a5d636bca51b7c1c32031562fc480967cc3ccf951f9d27da6a851c3bac74abb7b3abaa0f472b4a83
SSDEEP 384:lZPLu5NXoonWRpar/c7rIQIcCvL8UlHmsA2IYieTFhO0AhzzehF:lMpnW6s7QvL5zArYiUFYzehF
TLSH
T13AD27C46E6641C66D92BD238C4979B1FE6B1F4829B61C3CB6325435E1F333813B2C366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\jli.dll
Size 83KB
SHA256 21ec26c802a31386b3c9443198eaaed32d2541c38153d5a0d20466f5bbe9ba12
MD5 12591fd2aad121210e183044296a5a9a
SHA1 b78f47e400cd1d0447b22c3cbc56f9a6a117f870
SHA512 b0a2c5648cc77c2ac489e2449593038be4e7e1e6bf9213d2d704b33084d2befdb8e8d03f0af6a8aecd12f85335e227262cec32a50060579913cec2b9aed73a36
SSDEEP 1536:vz+KCcpBEMY3I77mlavd1IOGNwnToIfhjtalYVF7UI8:b9zpbyIgaJYETBfhjJVFQ
TLSH
T179839C9757A010E1DEB28579D6B19A0BD3F0F0462360D38F136D89A60F637627E2CBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsvml.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\jsvml.dll
Size 846KB
SHA256 170bdbae882aec775c37f7cc9fb78eff3f96ef35b7bec00d27f9dff77b7af16a
MD5 b7b60bf1b7585a52350d81ee5fc60835
SHA1 ff9472c8e92fe45cd7b248057ee5cb7bcf8096f5
SHA512 77d41cfaa3cda3cc1dfdfc1522f7ea84fd01e21c3e7506037bbf208e9d2675c79494ab3932d253862c6795c900c17fe332297806624c576c402443708c99de3a
SSDEEP 6144:gae+9H9S3FrAEsSAZqM5mvw6cPi/yJJzD0N5eCUTrYUB/VAA1SMNsFV5JRV+SM4a:x9SSusbiyc5eCu//V71AVNV+Ssc3I
TLSH
T10D05AF82F81284CDC031347124FFBD95A92A1CE9857C0E732772AF8D2AF9B467957A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\msvcp140.dll
Size 550KB
SHA256 254df96324d019a7c4213abd4178944b8bf2873d0c3edc1835d4c668f83d7c37
MD5 4b6ba0947f115ae9fd3016d26d57abb8
SHA1 aabaff269c8777bd93ae8962472ced3eb63439a1
SHA512 5b531ffbfe19871fa5d327566e7d97fbe693ece91f0945f457e92988c17d07c2dc595e12e4cbf3e48cb0c66460316af2a72e042cda8bb612791b447b51975509
SSDEEP 12288:cUfve/yP6vdqumz2etG5ePx2Fl5/G3XLSN6DaQEKZm+jWodEEVfmi:cPbl9G328DaQEKZm+jWodEEBmi
TLSH
T197C41923B74E05A0E195E3B8A1838306D7F17C4A4312A3C792FAD69E2F577E5673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\net.dll
Size 92KB
SHA256 16722a5e125963c92e39189aeaccdc79c01db60375c08049e82264e671d7b3a4
MD5 0ec859e00c7d698449afc9f51777e908
SHA1 9d309c5bd78091eea5b0e56a5a9fd81e7070e8a5
SHA512 49e099b8ede9067da90aa6277a42ae1b014cc8fd105320278d8ae23b87431effd12757906f535148a8c43083b0cfb979548757b947c4519af6729a2ae364237d
SSDEEP 1536:7aW2ALjKrbtK1/Un8eKp0ZL1jLrbx+SNVN+dll85hj6BRt/pqUJI7U4h:7a3SGw1/W8eKp0hhLg2kR85cBj/DIh
TLSH
T16B936A05A36820C5FC67D2B8C642861BC7B3B4B06650839F13B6CA5E6FDB7723E19781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\nio.dll
Size 75KB
SHA256 2daaef78d1c291275d1597f21f0a46da8321baacec4aeb387c237f0408cfdf10
MD5 b1d4371f204b1f35f220a25ad9c91c83
SHA1 dbb239721557eefcc14047d96d15006ccf83ec6e
SHA512 2d435a5116321b22ddad3a1a396d992936a3010bf35d20febcc6db06dc3ae1a76c2fd71ed77ce8c389b151d649d0286586e372e31c9292c27f307fe978d1a429
SSDEEP 1536:48AfrbmGUg1N2+/7S/uW7a3tG0hyLM8s7UwO:4pOGUg1N2+DuuWe3BhyLMxq
TLSH
T1FF7329A24374849BE82A7138525A474BE732FC109500A75F5368C76A9F5F7B33E3E392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\server\classes.jsa
Size 12.0MB
SHA256 e0a451342b6c980fa011ffd2282210f2c93d85c3b4982238892ae0517fcb7a53
MD5 280450ca9e8e88f29eb8c692fbe020b2
SHA1 fb727c2bd46e9eb51e29b90d8bce589f7c0a8aaf
SHA512 a47b6c5949c60df819701ce1f72daa663cba762cfd6998beb82dbe09284d671e6b35501d0ba957ea5e801b331b59c4be742175e9272463f4cc9bf17f0d33bde9
SSDEEP 98304:qcIjbcAOI3z+qnTOJUUl/AchdUShpuhHxeb:dAOI3z+qnTOJUUl/AchdUShpuhH8
TLSH
T1BCC6E517F690DAA3E53887358CA7C3906331E861AB438B073684E37EEDC32D54E569D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes_nocoops.jsa

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\server\classes_nocoops.jsa
Size 12.0MB
SHA256 54b8d03151d7def2a4280eeddfe1530e52b5e1a88398ae60bd21e3026bc05017
MD5 86523a9a092cd9bf107c2006a9e80b9f
SHA1 a5c2988b8c593ddef0ae1ce2438b9571d17f6049
SHA512 168f87c88bd64d5c07181b8fd3d542b711369225407fc43b406d35797f8cfc98674bc554e6c81d4894d1236141db212e947be24cd99abbee40caa749b2a6945d
SSDEEP 98304:FcIjbXMtI3z+qnTOJUUl/AohdUShpiBHApO:HMtI3z+qnTOJUUl/AohdUShpiBHh
TLSH
T120C6E517F690DAA3E53887358CA7C3906331E861AB438B073684E37EEDC32D54E569D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\server\jvm.dll
Size 11.4MB
SHA256 5882e2187c0fe291dcfb836386b014f9f565cc69cbce160af74f37a97a27abae
MD5 58b7cc4c415cd86155a8394e4b6291c8
SHA1 59ded7a9f9ca69fc6611227e6950c27b034f0711
SHA512 f9c5b2236663d74e3fac4ac9cf970776e46804652c073cabe42f4f8957b8269e79d3d80a62b977de5b0f6da9abdbd00918de55a96e08d81fdbbe4f73fb868221
SSDEEP 196608:fN6PCqFK+MpzUdHhx3/E/vBNN6dEPqEQs5X28i4o9z/sfM6Iv4GlmeUiiZ4+s6C3:PqFKxpzUdHv3/E/vBNN6dEPqEQs5X28C
TLSH
T143C68D6AA3B150D5C42BC17C8E2B5A4BE7F1BA549330DFDB11A8464DAF13BE1993E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\sunmscapi.dll
Size 43KB
SHA256 484ac9ac00f241bbc675ce5e7c43009f8d179880f069e3bc18576b2f21b63d30
MD5 3ab6f3fa6ec8d27c9553486d79a87900
SHA1 bddc0c45140e08064c6b3b6366bcf08061069819
SHA512 b68c23512e0741f5ab3ccf6a677d63305b862b0655f31a331bd852017c8a2d539c3e15af6df8965a625ccc79314e516c6670c15e7bc637a2db096b08a65b289f
SSDEEP 768:3cXyz7tPQY2RHUy/RImkSm1Hb4ks0mG6LmcdyLlAhYiUFtz3hX:3cXy1QYmUy/RIPb4ks0mG6CcdclAh7U9
TLSH
T1EE133907C7A108E1FCB3C9BCC066861BEA71B4469122CB8F1765CA099B97B62B73C755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\vcruntime140_1.dll
Size 35KB
SHA256 922124ba0821aa864a0261ed88bd25f8e40f94c24d00d389e23cd9ab2bfc6ba4
MD5 4dc09ca657822c2e8160255f767597df
SHA1 d1a553e6cad4600020113fe2887f5deb0db588c8
SHA512 1504a4c32aefb58b20bfeab4f6e45ddb1b4feb08cfc9b6098b0e0b8d770d2ec5cd53a0506f212a2d4f406a1f6aae5bb03bfe8b87f55a61671e9cbbf684d77e19
SSDEEP 384:1n62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfhuncS79+5WrNKW9mD/HRn:QdCm5PhUcxgHY/ntXBzxvW7bMDvJ
TLSH
T1FCF23A4463784086E16B86B4C4D35F27FB38F5A1A75092CF0BA5829D2F637D0E63D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\bin\zip.dll
Size 82KB
SHA256 6df72071f12cfb8fffdd73f7885899c2184c5f3933b22f17c7b6d0ad5c61fb32
MD5 30c8cae9cbe46c64058744819a723b55
SHA1 fbc53bec522a453e2005f101f24c2e5e7b87397c
SHA512 38ebbeca03782118c63b1e79b3ecdfba50eadb285718f5cfed7b5b1cc38fec99c1f18b58987b9ac48ae1d2804ab5a39116b01ff665eaef0f3e8c854634553e1e
SSDEEP 1536:C4mz9aQNPAf0RVuKeETIOQIOgDnToIfvcp7Up9:C4mz9aQxAMVulE1GgTTBfvcp0
TLSH
T123838D9289A056A2CDFA85B0D4E28A2FD774B05152D4538F535CC69A2F037A23F6C3FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\conf\net.properties
Size 6KB
SHA256 5bc726671936e0af4fdf6bed67d9e3a20a92c30b0ba23673d0314baa5e3ffb08
MD5 385443b7e4a37bc277c018cd1d336d49
SHA1 b2c0dfb00bf699e817bdd49b14bc24b8d3282c65
SHA512 260afc7671a1dc0c443564f1d10386f0b241bb53c76df68d8d03f1d0b1ceaf3f68847ab3477732c876c2b01c812ef7521744befe88e312f3aa63164b608b67a1
SSDEEP 96:6ATE+VEtGObfObz3Ob6Onte3CO0V+r/aJ7SFXtqBZUT+gTzDuBnZkRnF:/LVGG4f4z346et5m27SnCgTe9GnF
TLSH
T127D142C2FF46B72543A9C291E21EA7EAE32C903D5C33757831AC890D2619D76427F4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\conf\security\java.security
Size 56KB
SHA256 38166a975348862d693d95de8d676cf19cecccc45af4a1896c73c45f7bd966ef
MD5 00cf40959861f61f17b90c6b6002a9a1
SHA1 982e48466428e1f49c1a5941c73afdacefd1d22e
SHA512 bad90152685279d896a4063d76dec5befe14831d3dd3260929b9a639505e898fa996b52aab3821a51c6c9aa09d956a23a8bdd870377a10e75c9399629cab5779
SSDEEP 768:rfBzVIMtipMfSSvAOUjt1p+SiIj4sjyaF/IJnoIqHihz3oFoBfCDqrsoZ9d5eDF:rIMy8SCAOUjt1p5/jCG/UoQhzYKpNnCF
TLSH
T10743D422BB897B710AF211A363AEF1D9E76DA12A36721150748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\legal\jdk.internal.vm.ci\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\legal\jdk.internal.vm.ci\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\legal\jdk.internal.vm.ci\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

fontconfig.bfc

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\lib\fontconfig.bfc
Size 4KB
SHA256 968ac99bbaaf8a49a474c934e73ad58f88c6c7f2a363cb44771e0378444e36ba
MD5 0e25b41e6acf99681eaf2e8b572f18d1
SHA1 d6b4290da768e050fe6c310366272f87e6c2b6d2
SHA512 7c1e98bc6582af9e9c58c13cdc4d257e441a6d48fd395a3601ad558ebd481257f138d6f0dcbfe12735eb6bebeb7c8985b3d8af633b545fa01d56738f56360c08
SSDEEP 96:Pdbj5aublPBl7BWBBTiraXnaZziAaZH29sKG:P5j3pfuBTi2cz0Cs7
TLSH
T147A1CC01E5FA6208F2FBFB72A7B88455CD66F851B773DA5C1020405E4BA16408F62F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

blocked.certs

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\lib\security\blocked.certs
Size 2KB
SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
MD5 8273f70416f494f7fa5b6c70a101e00e
SHA1 aeaebb14fbf146fbb0aaf347446c08766c86ca7f
SHA512 e697a57d64ace1f302300f83e875c2726407f8daf7c1d38b07ab8b4b11299fd698582d825bee817a1af85a285f27877a9e603e48e01c72e482a04dc7ab12c8da
TLSH
T1CC512CCAD15E02DA9D407BE208EC82A7779381B2AB2C442A2BF60F420577C5DD73B8C5
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Local\Temp\installer-temp-1793302403-4eb4646a-5c4c-4e4b-89ca-9733109f749d\data\win\java-17\lib\security\cacerts
Size 99KB
SHA256 ccadbb4970973f42ad7391a0a2c4b8aad19559f3b322092a1f2cab044708efaa
MD5 a4ce60734e367268e83c65b561736b98
SHA1 990e01d9a05f5270434015d9ebbba5463bece71b
SHA512 dfb1cfc148dc4e4a423f6fb11f7acb099b3b0e7b1ae3eb85bc56596d65c77388be289bc785cf70c59974e3d85a2b954433c3c13e3e4b58dba3d9be5c26cadd27
SSDEEP 1536:f/YNTer0bHoDpKQIon+VxZ10gJdmvr4eOZVlylRA4M:XYUr0z6pKQeZ3JGOlylRAN
TLSH
T1A3A38D9F4F383921BFCA9E546288E2373E7AB3D4A69A14171565C0F16ED23F4398C41E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

banner.image

Path C:\Users\Admin\AppData\Local\emuferal-online\banner.image
Size 138KB
SHA256 3c7886431e407ebb30bf30f052131e6efa0f9d72a1b3728afd0e61a1c8fba03d
MD5 9a503f1034443048234a500a6348f7f9
SHA1 4e964ec8eb13144dcce57a022d2547ad4d19a676
SHA512 81a217580e6fef8d5bcd7cf46a16d12d70d8b6d02dd0bf84005f70de971efc512ae33e30623845cee9b371f8fd13dce73b836398b643a5c61305f63678581c87
SSDEEP 3072:Rajcq9l/GsFY2Cmbjm7SZZHAO5Bp/hLnE9mz3aqZ8BgOusg2Zb2gxNcdzO43w2vR:Ra9JNNbjm7eRPrFhDEi3aqZohg2Zb2gq
TLSH
T15AD3029422C3E0EEBF5B963140526D1A25B8AED344960134CAB5AAD4F34F4570BBF9FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\AlternateServices.bin
Size 8KB
SHA256 10706d20de1cdf29422dd7be3b4655ad2a1b4d9651eb79fb5d9d044cbaea8a18
MD5 d5019c4b22ccbb3560b032e65568faaa
SHA1 877504865f01271ebe7f4039422fa5e68061d5ff
SHA512 d38ba40d3d68747809c831f6bc55530782ae8e5c8ed325cf308c4616a248cf3ac10fa4259fad80e52f2e4aabf7e31bb3da64236baff13fa7997ae9f9fd10e6f0
SSDEEP 24:fuhMZ9md+591OSw9z9BstwPG9xIawhqxIlHwbOz6TlH1qMVbOzlRdqMFK7zXiR:oIynn080Ilglb2D7
TLSH
T1050204F30F72A022F0964FF1545C7E4DDD7307255AA8D0958A0594E3039AAA6D1FFBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\AlternateServices.bin
Size 15KB
SHA256 3437755b6d8e2c40eead4f13f1da31f205561b908531dde28b6fcd9cdba552c4
MD5 6d1453a51b8428ea573c59e50c3ba02e
SHA1 0e5af8945c1e5df8fa40df2f9c00442ef48e2a60
SHA512 72a48aa320dd0645e0ed0ea90eabc424e395cad611d6356ead6595c6bba7e74157ab89decff130e87408b38660d30f8449354697f60731412c28cfb7d9175c95
SSDEEP 24:6uhMZvi591OSw9z9BstwPG9xIawhqxIlHwbOz6TlH1qMVbOzlRdqMFK7zXiRm+lZ:pynn080Ilglb2D7m4mRoHBrBJhf7
TLSH
T1AC62F3F30B76B061F0A64FF1849CBD4DDD7312264969C0958A0594E2039A6FAD1BFFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\AlternateServices.bin
Size 23KB
SHA256 c8d2e520fceba64fc0c6fdd633a35f7459ae481d05e08b00c1d26185f88402ba
MD5 2aeffeba9325e9feb876b4bb0259d11b
SHA1 870cb9359069b86af4cfddfa4fa9ff5339591827
SHA512 f2f3962e1eb21e3543fd89b2eb1f695bfc565a823c05f7da3410e0516c6a7f679db868c9fc1b9f3db46355b4885f7b6aba10f98aa6a2dc2b1370c67a720f9aea
SSDEEP 96:pyoQrjsIeB+Gkm4YoHBrBJhf7SmXgG+QGjGX8oLZYYpwua36p+UztBZ:euY
TLSH
T107B2F0F70B76B122F0924FB1409CB959DD73022759A9D0D4CA1884E603D67B9D1BFFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\addonStartup.json.lz4
Size 4KB
SHA256 c44ef50b48890b752f58678b08effbaf26c2a66d32a3c4c32e69cf166f0acef0
MD5 f035b5042cbddd65fb2149a07162ae16
SHA1 13e208ddffafc1cd9e0dad815832cf9ceee3979c
SHA512 29f7049dd926eb4fea114d13d27e266d59eb2d4086e8b12a5e2548a741a6458e60ea9a38076a5365a01c6ca58c054d5caa16ae17ecdcf8485c48cabfeaf4f51e
SSDEEP 96:N+K4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NI52xxhD8rGvm6ApwnHUuhN
TLSH
T11AA16CBAD541EFB6FD22C04348D97FB2EA96AB7410A9C4E0F1AAB1194D64A735705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8e6ed2131dd90957fa142586b7becf138804067f4cd8cbc0076c1987116653ee
MD5 162e15d54424160c432c892be56224b9
SHA1 16e94560275426f4a681c2103a2335c6624623a6
SHA512 b9dc61b268fa0993b267cd56b0ffd4592eb69a8dcf44922b91cefac1d49b1384e6963cc76a05d85e9a5c00417f9e5e2fe969ca111d8a5b17e4c9359ab230cc8a
SSDEEP 192:11d66JoztdzgCl6mc0dWlcyEKHOv5zbo7YxTHHyjiW9cs:zd66Joz/zgC1jUlcyEK4boExTHHyjiWt
TLSH
T147E110A4FA28873FD408127BDCA51B404F35385AD88E3F19359D642C2D5B2DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9952448f30f1381009d4e8a9dfbc8b03f32e140ccbebc657be636d4e8c607e99
MD5 bf29062f8f0e5dd44d6c7c3390b572e5
SHA1 f093c117bb0dfda7f672b0f3b1c33cc7a14f4fd2
SHA512 f8854241b09db11d127d6a8bb395e9521095c5acc6e535cb349b53aa60e1f28c9b228d8c66bd78a1008449f5cf85875cf75f962e671daa41e4d8ac4b4a515253
SSDEEP 192:zlcyEKHOv5zbo7hZxTHHyjiW9cr1d66JoztdzgCl6mc0d:zlcyEK4boVZxTHHyjiW+d66Joz/zgC1j
TLSH
T180E11FA8FA28863FD408137BDCA51B404F35385AD88E3F19359D642C2D5B2DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
Size 1KB
SHA256 676570e2c4474793552f752432b84aaf80863677d3c157106ee38244f154f6fc
MD5 1e547541f47f200c6c92f6af1ebe9618
SHA1 146e3381378b264c5fb141dcffeb412f721a22f4
SHA512 af5d0812728b12f8b73cfc0d528ee7c54341404f13e5b802b0ec384eab959a8dcdd8d9185ffbb806cff5c1b409b844842021dd1c98e08d8ad3d5702f6cb1c92c
TLSH
T1C421375C3DF84D2A6CC7E6AD7451128E93954E0B04471C834D52DECECDD1AD933AE528
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
Size 5KB
SHA256 40605a5bca3a3af1d9e2541c1cc3b486cfce12ac1bdf264b25bf200227b07c3c
MD5 fccf0f2f9b3514b4987b4396d4d7145e
SHA1 3bd9312209e6e84f6172559a2eefe7ec5ee6b5a7
SHA512 9891721e52275c7144498815f9244ef074c6cd23a1ebab45d953ecd271ff645f3cd45ea4ee11e6bd2dd7d936b8be4f7d34e1b3eabb131aff3d4fe557e9ae64dd
SSDEEP 48:YFe22np9o89yKRj6/y6fi/Lzkm9VCl0DnVC1KEf9420Qi//vA2lRGPqctKKlUc2Q:QV/yH9clwcX942yYgSKi/sgZA+
TLSH
T1F5B1D01C65F55C7E5DDBD6FEB845038D83E88602C4862D438CCACE8ACC96B59339E639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03ea1926-fe71-4ffe-9402-b1a50f406fcf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\03ea1926-fe71-4ffe-9402-b1a50f406fcf
Size 16KB
SHA256 c361584d67a5ce0bb42bff9ae03d46794d2e2b389b4dbaf44fff6c6460eec6d4
MD5 7455de6688a817ce96242c40763965fd
SHA1 06ed4d63880648a06b4447c7e907134e2a6db8ef
SHA512 b5bdb477828e2b432372434aea5d84733f4669ed3c5051d2a9746a6b85310b092ed867e12f41ab5f4bcc71f2bd6c26ae85f1aa6bb395b0707ab04c9c307cabf4
SSDEEP 384:/xj4kLDisAzO2ojllRnBE9vNfsJXxrZuM:/dDinK2xuJpB
TLSH
T13572C916286055BA8691E36994FC7FC3E6F528CF4C418FCEDBE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34d9fc9e-7695-4499-8873-b1a5450f5828

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\34d9fc9e-7695-4499-8873-b1a5450f5828
Size 235B
SHA256 85266d65af9ffa97fc722c62c7d0d7f862e53e9a94c76b50f6ac571e7aaf5ab2
MD5 32e97af81e2671bbe63ee8e71abad1d7
SHA1 d91a0c6309d951ade97baf7ef4c9435e7ea515e7
SHA512 6ebc428c8f872935102581e1f3bf12b2c5295ed6cbdcf085a312d2b8da97a432bfbd7be50c6b5912be877c79d303a49df30603a62ca8c95c27ec26dfc9d5070a
TLSH
T16FD0978818C86B5D48180F13B0A03EC2714E4C3B24E55C10DA524678AAF8ACC4192807
MD5 SHA1 SHA512 TLSH

Submit Download

6069ad43-91df-4d41-8710-dffb5b1e169b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\6069ad43-91df-4d41-8710-dffb5b1e169b
Size 2KB
SHA256 3a3520039247538b7231f9b520ab6da76d358f1cee6ad59d823aeb76cedc1c7b
MD5 4da7bafbb3d53b83b7fa8324a873d3ad
SHA1 5fea3239da84cd2d42daf338c0afcc0624e29dec
SHA512 9ce720764625ea78e97b57013ad6b616df5c33287cbd551cbfbb55e06da1d3132e411e0494a25b4590f8c304bdf8801b0fc6b786d6c9bcf75a3c756a4c3a6907
TLSH
T1A541346C79B84E368CCFE15D9581338E6760491300C21C476D92EF0C8DD7B9D73AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

b95d3c68-1e43-491b-87b1-0cf4b81f6603

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\b95d3c68-1e43-491b-87b1-0cf4b81f6603
Size 883B
SHA256 e50e94267dd109720cabc4597103b15718573247936b30d3c54041a948970d86
MD5 199807345fecde4a6e1ee1b83d0cfada
SHA1 aa802eb37a0e6359bf7d670a07a65115ae81d5e7
SHA512 a5d64d1a8e6162d7319c764c7b3866e72be18b63e5290296b971b3517762b16f498003b4c970681d40d52769c4cb85287594983e332d63331be9ef0b7cf9eba9
TLSH
T1AA11278065387A71CC6C920FC59437458FF4652380C684043DA54E284D7EB5D936B60B
MD5 SHA1 SHA512 TLSH

Submit Download

e407014f-5833-46ad-9759-4c0aaca1c4d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\e407014f-5833-46ad-9759-4c0aaca1c4d5
Size 886B
SHA256 89f0f0a025cf0eb1a470c6caafd397bf508d1ff7bc574901f779b42c65ca089e
MD5 bb2643a91f0a989821cbc009c105662b
SHA1 d55da76257308bb7cca21d5abc702ab25c5b3f8d
SHA512 7610d563e1cdd1ad87908f1afc738d20c61517b7ead0734c9b2560c65c2cfbe921385e2cd024793bb326c001b11c2d8ec25d559a4a42736432e5258896be3597
TLSH
T10C11E350AA34FA72DC6C924B95E1774287A42023C0CE49183D918F3C4DBE65EB39B71B
MD5 SHA1 SHA512 TLSH

Submit Download

fc4cc887-92e0-4fa4-9aa3-8b29835ec4e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\fc4cc887-92e0-4fa4-9aa3-8b29835ec4e0
Size 235B
SHA256 d8a7f78a709961e8fdd667c796eb4e82c26edb20c046817dc3df100cf7609699
MD5 0e31cb406a1d8522012986a0d209ffef
SHA1 9747c4e69ef9369e6fde33501ce7017f8604eff9
SHA512 168daa80af9710da2246aafa065f3cf5d66dcdff410a140680154a30e427c024251de5536bd301f69139df3e61ac38ba3ead02129c753e24daf3ede97edd698e
TLSH
T1F5D023842898675D0C190F07F0E0B9C735558C336CB7F860D5618575DFFEDD4915181B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extension-preferences.json
Size 942B
SHA256 a56a46aa7451d640626f9adbce3ffb26ea6ab549f15af56fc2cd69f0bcfda67b
MD5 8913f98eab4828647224c9a64b706b3c
SHA1 f886a4456ee44a4e73ef32a2b138193f2fa41d37
SHA512 28869c106812bf053c732469b0f67da993e42a471c7b576e68d45fe66d2f067bab0a66c5334e88c6460e08a06285daa643f5f34771bd0d7361097307137e1630
TLSH
T16211F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extensions.json
Size 14KB
SHA256 9795b210f2fcab9b31f2600f147bf4b0abff94ed1e74a52bd757d44505c61a60
MD5 f04c529a0d10aa0146d03093f8628e9a
SHA1 c446a4ab8dec05e92923b971204f8eb3025d34f3
SHA512 aa34cdf2c15fce60f112cb20f6af1983ae7045d87b6ff548f753119c28d9f9174891ce754645d1760d6e51902fef1f78551c01573b2cb4e15d9e13faebc403f5
SSDEEP 384:DkI4vLUmldvg8dhW394zg96oUL4HDL4PiL4HRL4HSL4HC:AI4TRfZXW4I614P4o4p4A4i
TLSH
T13262531545148EB8298FA78BAA36BD01C37D473B60445C78F4DD8FC842FA6B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
Size 7KB
SHA256 3d00fa16e81a45b153a037f6a9a607c0647aedcde8564e5ddea4f451b07d43dc
MD5 8450b02905512e31171a05018313338b
SHA1 c93af54bdd6332b08d7a53f14c14f26b563f24d8
SHA512 a7887fcee8a13338f596da6e5431b4a403d0ac36a0fa93e958e55120f60705a5ef1046612cdbd4139fcc445981c31a6bd0e5c5bd023843db8f7bfabf8e8f00d7
SSDEEP 96:xHAJTUvqGqjfsadmbzSPNSSledv9jxnGHtcSXvBw88kP8L4cnEo1/GJGS:+DRjfsadpNSShtrXvBw88ruT
TLSH
T116F1FC385404CB7F74B676BDAC6489315A62013BBBBF68C754B948C5050CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
Size 6KB
SHA256 b6e877cd5318b42774c85d3f6c7a14e4153d1c2e8ad46c51a08b63c8d9517439
MD5 a83b3365e05c1769ad24576602acf43e
SHA1 a42db9df0f85208a2cc4e39b0b7bae9c0d770250
SHA512 c0be2ffcecc740b8e71365e433b5ba5436f2e00fe85b90a846836f80b3d2e62ab7acfb6561f399b4d2dfaa31389ebf5baeda016e08c133962da0ef03f11c2896
SSDEEP 96:xHAUTUvqGqjfGadkzSPNSSledv9jxnGHtcSXaBw88u8L4cnEo1/GJGS:+SRjfGadFNSShtrXaBw88zuT
TLSH
T1FAE11F7894088B7FB4B676ACAC6888715AB2013B7BBF68C750B554C5051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 02bc7c3def3e54fbbf0af9ab3426c81db37295d60e8d51ecb3af74d57a158b75
MD5 aa4fd70756be6e89f49cdb4cd12d3975
SHA1 2347e72255053bbf6069b39464e148c1134a8f73
SHA512 df1e0d5ed647919e95dcb912c953c59535d8b89bab4f3e61aed475842b7c0ac20e29ff5a1507ef9a6052365e5acdb2a618a8eb8d27961f4aa8eccafe7c7ea653
SSDEEP 96:xHAUTUvqGqjfG3w1zSjSSledv9jSnGHtcSXaBw88u8L4cnEo1/Gc:+SRjfG3wySSGtrXaBw88zuc
TLSH
T110E120789448CB7FB4B6776CAC6488715AB2013BBBBF68D750A554C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 7KB
SHA256 b90bfefb3e5ab096897f5e1f05d1c5d86ed674646ba8211a5322570c8ee4dd8a
MD5 c4d9bcf0072cc4226145d28ad58abdc4
SHA1 2d613ac96682a52929fed0f7fab36938d7f06e7e
SHA512 0b6b4e6eb7a5c1b1b52bf3b3a1e0b3d9d1b07e31cbe0cfb116f7a2f35d359b7b9b38ce3d7c8d06da5fd2bc3f2d76c19e440da091615ab04376354e30a5d01742
SSDEEP 96:xHAUTUvqGqjfGadNbzSPNSSledv9jxnGHtcSXaBw88u8L4cnEo1/GJGS:+SRjfGadONSShtrXaBw88zuT
TLSH
T118E1207894088B7FB4B6776CAC6888715AB2013BBBBF68C750B554C5051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 7KB
SHA256 a0969504c0e288080e0e0c59c6da189dabaad626cef1d0411441c1b7a9921268
MD5 68139a4e62fe8ffdd5d8ac4eb8cfd1c7
SHA1 2ebf7ec473c88754910c10367d6e937e1945c958
SHA512 480ed28edcc0dfc10426f2d488b573eafcd6bac469a348cd4f92bf21174016ecef35baaa6a21365e65043618e1142ffd9e3374f0ff2798932710debac3bca6d5
SSDEEP 96:xHAUTUvqGqjfGadmbzSPNSSledv9jxnGHtcSXaBw88u8L4cnEo1/GJGS:+SRjfGadpNSShtrXaBw88zuT
TLSH
T1DCE1107894088B7FB4B6776CAC6888715AB2013BBBBF68C750B554C5051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 716265c053b1242f0a7da92189eb35b4cf935a835c66cf40d60f49a747a7e701
MD5 d9cb3846b7f0046fce9db394532587da
SHA1 552a657d09f00ab0bce394cdc8687ed3a2028a83
SHA512 b98b0e7123ebbe5f478eacf2c2371d2562fc87e79fa1f23264966bad903106c478582b8dd50fad19324ba85c05372204605a001544a926ca8762080252fe3b0a
SSDEEP 96:xHAUTUvqGqjfGad1zSPNSSledv9jSnGHtcSXaBw88u8L4cnEo1/Gc:+SRjfGadyNSSGtrXaBw88zuc
TLSH
T1FAE10F789408CB7FB4B6776CAC6488715AB2013BBBBF68D750A954C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 d53f9318396256586b04f69af869d047bfcd5cbe62983c52cbdc7f3510ed880d
MD5 52cb83d17bc0e68f3c60bad0cfc77475
SHA1 17e9d663a32c6903ba5627a7aeaeb7eaf389d476
SHA512 266b57c9c52a7356cc8d755c61e0020fdb9b625a076040ec38fd7bd66e2e270658441a936c1dad14aedbb6b1956fcbdcf1076e42d4aad1a3cd67e8c372ec0073
SSDEEP 192:xxrV33+99ibjsxgURAMcEDQ1tNjzLufA/JGM:/rVn+Dhl1cE8fLuyJ7
TLSH
T1AF12B0D33C571DEA94CDB042CC9D9BD980A3D016C2ECE5C4DF5CDB854076E1417AA7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 843846db91912a720d93ef288b21109cefa0193ab44f2a116b9cb23ef62088ff
MD5 89734220406c3583591fea4af9534250
SHA1 e2ed6b90dcb7dd4a93a664dcdc479ee4d5d43c7d
SHA512 61e7f304a6c3a1440af8c78053de1387b593dc496296a7f394af5b110e43ae8c9e8b1b452cc98bccb0985003d496211956429845f655dad25522c8dbeb735304
SSDEEP 192:BxrV33+99ibFsxVWCxAp78T4nEm74kF1tdjzLufA/JGI:vrVn+DPXxwu4E43LuyJz
TLSH
T14912BF63399A29E694CDB042CCAD77C580B3C412C2FC64C4EF2DDB4910B6F501B9E66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 e2a591f49f771e5d599ed6304af1d4a75fa7fdf2c014329cc2c50af74182b9bd
MD5 ffa3553fb4d366c3f81b46b87cb3a063
SHA1 c73614f826b1df613c3b52f2442ddf4d4b95e5bb
SHA512 7a5567f4bbdc2c81afae34ec52f53f3f8b399e35e84491d711a961f3ad4760ddc1a963fc41f96761b4cb2b7315ec4246a3a6e64ee49ee232da8b04aa3ca8d108
SSDEEP 192:LxrV33+99ibjsxgURAMgQMTf1txjzLufA/JGG:FrVn+DhlBgQerLuyJd
TLSH
T1C012B0933C5B2DE6A4CDB043CCDD97D980A3E016C3ECE1C4DF5DEB881066E1016AA659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 b9fd68800a02fdc302fa86caa0d80ec733a9d2993e28df744b353f45e0a6a99f
MD5 7c8c1891b28ecaa556ea7934076ebb72
SHA1 2f3334e47a7f93ebce38581fc93434008fddac7f
SHA512 85ece875cec2d6d79035e9f4f25acaf9cd3ec7346fc1953cee4f9326d0d563da81d307de43c8fda49b3d6c8defbbfde2727ea79e105001a34ff0609b73548aa0
SSDEEP 192:BxrV33+99ibjsxgURAIYickQzw1tZjzLufA/JGc:vrVn+DhlCickXTLuyJr
TLSH
T14512B0D33C572EE6A0CDB042CCED9B9984E3D012C2ECE5C4DF1DEB880076E0016A9699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 9KB
SHA256 64f6b1fa704f4c97c84927c218f80118f0af923b82f2f60ccc3266655491dd74
MD5 e0d8b1fa880b8deb9a77796d8d5e65f7
SHA1 ab90f7eb60de2679ac65cfca40798d1f448f82ce
SHA512 e91962ccc742ae4d03f35e545027cceb684041f0061847e71fe6dfd24e8d9ab3fb4f71ffe71893fa6e8d4b3879f1c172c80b7a12bf43895c9c243d57cd8793ae
SSDEEP 192:0xrV33+99ibjsxgURA4zjK4Cb1NA1tNjzLufA/JG9b:mrVn+DhlJu42123LuyJMb
TLSH
T10C12B0A33C5B2DE664CDB0428C9D9BD980E3D016C2ECE5C4DF5DEF894076F1016AE66A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 519f76095353c8c02f30b2d5df6cbcf3a29372461d41b5288351d0b9872702a8
MD5 f5e27c5c4fff6c813e64f9f20dfedb16
SHA1 84a08899dda7c2b806ee0be4a896e84e6d8bdf34
SHA512 e7bc8944f3e6b3b2e675c5a0dfdfc157c0dac37e5d08741a9e1c7b60d549be9b47bfdfbe8b63dd615cd9c1453a202e4599183df5b21c07009e8b1e7705ee6b1b
TLSH
T1E7616C5B9A055BE019A894C3DCCC2E8DD692F029C6D42AC0CF14CB1484E4B947A0E2F9
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 f335941d6f4da0be894cad9bd481bbf9f9f181dd48279062a40b1d9d3bd8c0d2
MD5 a6b9f50ece066fe952a8519d97dd40da
SHA1 1f4eaf8609950fcd15983b6e8f8848f70b9ac02a
SHA512 fb0edfa000b6497558e4ab8934616df398f262143af07cf489cd51d13dab8d5c15fff7f7bcc1c879bde9f0055565c1d87eb0fb948d4afee420759b5a059222dc
TLSH
T123816B3AC81C6DC5F8F4A3BF10E189D3EB3F501102E6D164AA545436C49F2C52BD56BA
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 437866077bbd6be246862737c0f214e6b249bcc4cb4d7c95be797c5341c2e92c
MD5 96e7ce2199858a10520b7d177ab86e68
SHA1 b5977571a82e6a102f8d7d8bf27e9416e6e3ada7
SHA512 cbf288d801060aa88871dd2f5476c90a1729290f529cf64ed348ed0e43309bbd0f190445ac2255420ee6c15415fe58bb6090961080dce93de353cfd3e5d81eff
SSDEEP 96:j2TyrlvjD3+9Yy0JHb3dpJlt3sN/H3wubWkmztp3gk9Ifs8zZVB1ekXT2YLufA/v:jxrV33+99ibFsxje5jo1tLjzLufA/JGq
TLSH
T14CF1BF533999ADDB548DB0C4CCFD6B448163F02582DC98C0EB1CEA8994AAE00275E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{da371a1e-a858-4301-93a0-134a1b61e6b5}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\storage\default\https+++www.virustotal.com\cache\morgue\181\{da371a1e-a858-4301-93a0-134a1b61e6b5}.final
Size 77KB
SHA256 a4d773de718398d13df30d4b4ecf8f7ad7b5cb5d8aeb9a52b337f98cac8e61e5
MD5 3ac571b271cde5b3dbd1590afe5f9aff
SHA1 c77cc048cf6fa325cef3e4fc1937b3b45f203f8b
SHA512 19de4642a84f12f83daaffa83414e585e885d9f3826c9b23fb63da2dd3f723aa88ce55ec64cb99602d94360e416dff7a9ce4b4755a48950b18ea44f6cae671b4
SSDEEP 1536:eqn0viX3aOYjVJlJP/zrEfj6EDd1nCXGyJ0P10UpJwjEHiC:eqnoi5EVpg6EDd1n+DY0UaEHiC
TLSH
T17573F1B07B04BAEF2D3751EBE910ACD8539C7F27BA9B8154C1109EA23163774FB4A644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download