66e9889cf52d08cd3e6e5f186ee5abce126764773c9f187dc621992604a0b488

Resubmissions

28/07/2026, 02:51

260728-db9nbaxvev

19/04/2024, 23:39

240419-3nar7aae473

01/02/2024, 05:00

240201-fmzctsdgdj3

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19/04/2024, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MouseLockedCursor.png
Size 2KB
Sample240419-3nar7aae47
SHA256 66e9889cf52d08cd3e6e5f186ee5abce126764773c9f187dc621992604a0b488
MD5 9ebf822db727a8e0a3c5c609800149f6
SHA1 ba5b8d7907ddbb58c22c059bdb086eb651bcd69d
SHA512 6c4fc6b52eb8a531522047b9538a8522e8190594914ee3f0c847f561da88eab386067b0cb942fe1edfb4961e84e3e7fb54c5a38445b439f7a993d3fe0bb266dc
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5300	firefox.exe
Token: SeDebugPrivilege	5300	firefox.exe
Token: 33	3792	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3792	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4596	MiniSearchHost.exe
5300	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 1612 wrote to memory of 5300	1612	firefox.exe	94
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 584	5300	firefox.exe	95
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96
PID 5300 wrote to memory of 4300	5300	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MouseLockedCursor.png
1⤵
PID:5808

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.0.460150418\1615950705" -parentBuildID 20230214051806 -prefsHandle 1812 -prefMapHandle 1804 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad922696-8953-4c63-87b4-e4035c3da176} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 1748 1ddb1310558 gpu
    3⤵
    PID:584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.1.785538542\468851719" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d43e9a47-7807-42ba-a049-1fae1277bf75} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 2404 1dda4686b58 socket
    3⤵
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.2.69010829\205439312" -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3000 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1216 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffd365a1-2de7-4dd4-8b73-71803e7fbab4} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 2976 1ddb3ad1d58 tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.3.376398584\187364768" -childID 2 -isForBrowser -prefsHandle 3756 -prefMapHandle 3744 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1216 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6297490a-c64e-4803-b265-506319129e65} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 3776 1dda4676e58 tab
    3⤵
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.4.1149472258\1756910317" -childID 3 -isForBrowser -prefsHandle 5172 -prefMapHandle 5148 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1216 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58c8662a-bad1-472e-b7dd-288a0ad9a147} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 5184 1ddb87f1258 tab
    3⤵
    PID:5324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.5.147411991\1516697259" -childID 4 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1216 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2aee2b5e-794e-4c8b-a110-a1716becb566} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 5420 1ddb8fe5558 tab
    3⤵
    PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.6.423255365\1693835536" -childID 5 -isForBrowser -prefsHandle 5556 -prefMapHandle 5560 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1216 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10d75601-23f9-4406-aa8b-a126461c37f4} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 5548 1ddb8fe5b58 tab
    3⤵
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.7.348169428\1665751667" -childID 6 -isForBrowser -prefsHandle 1400 -prefMapHandle 5880 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1216 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {898d1876-fe26-4d8f-8bda-44e08d2f3576} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 5896 1ddb9ed5858 tab
    3⤵
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.8.621854311\1570808570" -parentBuildID 20230214051806 -prefsHandle 6184 -prefMapHandle 6180 -prefsLen 27774 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edb43774-cdfd-4588-a191-70e8de395b47} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 6192 1ddba786c58 rdd
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.9.672947797\1573963999" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6204 -prefMapHandle 6200 -prefsLen 27774 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46406c36-b68f-46a1-bac7-1d3fc3e89337} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 6220 1ddba92cb58 utility
    3⤵
    PID:1368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.10.1847880356\1361810649" -childID 7 -isForBrowser -prefsHandle 6576 -prefMapHandle 5348 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1216 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f3ba610-c008-474a-ba2c-2354bf8c1c0d} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 6548 1ddba786658 tab
    3⤵
    PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.11.1091298800\1021263562" -childID 8 -isForBrowser -prefsHandle 6780 -prefMapHandle 6776 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1216 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaa36616-9f74-47a3-adfc-4b9a592b6e50} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 6788 1ddbac40558 tab
    3⤵
    PID:4220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5300.12.422507628\2134519495" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 7180 -prefMapHandle 7120 -prefsLen 27774 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51265245-f9bc-41be-8eb3-d04e59b9a9aa} 5300 "\\.\pipe\gecko-crash-server-pipe.5300" 7316 1ddb9ed2b58 utility
    3⤵
    PID:3304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x000000000000047C 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ln14indr.default-release\activity-stream.discovery_stream.json.tmp
Size 25KB
SHA256 f3584ff0e714d5840576c82207f6a83aaf00e1aa222fcc297a6315989aac5bda
MD5 a0ed761cd5bee5dd855dd737bbf0c2cb
SHA1 41e8c67d57c605c5506bcf959f7cd5d85872d66f
SHA512 6ab2ac7bcb19b88cc39caa8817579bae62d05a472bc5f6b2d27afb0a89941241bd553a103a9566a28cb9982f181bbeb2444d1b4d059ec2d280180a2da618adb2
SSDEEP 384:rtAhrSHk+OlgCvJNF6BqabXHZ+MfJ72ydyauKIAIYb:rtsSH6JfQbHZ+MB6ydydd/Yb
MD5 SHA1 SHA512 SSDEEP

Submit Download

23049

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ln14indr.default-release\cache2\doomed\23049
Size 51KB
SHA256 24a7149f8316454ff02bf8a1c682e7496b9ecdc172e0e24eecfff2a71b815993
MD5 ccec07429854b1d7c1efd3618ce9aa50
SHA1 5afaf20d77121f5d569a068e6e4708c790da7d0f
SHA512 a6505a83220b03cb2fe9b621a2e8f6ba005bf450c3a46552de55170d82ec6672be85dd0ee537d2406ba1fbae76e90cd2e15975a69f823d5317d2187d14052efd
SSDEEP 1536:W3oupIvwCxQPv2twKeVWWG93XZbv/3LLjUaBw2XZ:/ZvwYQGRwgNpbHPj3B9
MD5 SHA1 SHA512 SSDEEP

Submit Download

29212

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ln14indr.default-release\cache2\doomed\29212
Size 19KB
SHA256 40a5b910ae9749ef7b8978e25d028c08175a3b15907ce1439d6be7efce85068c
MD5 ad5e013e742d5bad0b5703b2ee3a2d27
SHA1 bec4d9eefa5fe2568655bb739c5de12149feb1be
SHA512 c7b547a8f7c623bb950f328e8519b08325c54e6f7df89a9511416acfa4a762a670e9f5a270f4b16814a48797e5857518e59e0cc6b3693b6374acd79fd35ddc08
SSDEEP 384:PmyBwLH1u7VqN4mAw6pudr2KZHI1w2n2LaA98eehqrufWWCt2BVV0w0C:QdAw6pudObnU8eehq4w2BV2TC
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 92963a271f09cf456fceb337c55409ffae5e84413c92781cf70e87269e130f4a
MD5 96e6e524a1efcaa25f44050dec4800cd
SHA1 b9715e1e8f57049527957eae03c053bfb1eb8880
SHA512 ba3d5688994ed3f088284bd39a49d20a461d1073dcbdf104e1bd96c8aa2927474e6f6e3699f607c040327f6b5ba27bd898ee0bbeb5041c21f9a47251950f7e41
SSDEEP 192:rJAFJr9oBiV7vi12YJrtkp1NDurAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1wuJNW:rJWJVq12krtuJdpmXmlJVjeQ8RJow1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\prefs-1.js
Size 7KB
SHA256 33ec19d1eb2b13fd983bdb5d3fe3e90a17cd4f287486d562b1f3d3463e2b0892
MD5 e92e46f3b45bfd7e4275be38ff31763d
SHA1 c67fa69e22197782925350ba97c5e89c83a846c0
SHA512 df31f51733bc9e1e4e1b68eb042453f28a931b7b224c93f0c0c2bb248c3d509430a6c384e047e9571323afd258ee68c8f0ce9794b42f944a11fd6aa8a44f2507
SSDEEP 96:xHXfnUTUsqGq3fXUpLHzSg0XlnBOjO3I2H54JV5Bw8H8kh3S1GS:VfnfR3fXUtB0Xb13IY54xBw8H8YS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\prefs.js
Size 6KB
SHA256 445c284ed65c4171b14150735be22563c5b0ebed4a4036f39648df16c663e12a
MD5 f6926c5dfe98dcc147d2191eff1759dd
SHA1 84346dd9571f5832413128b79e675b32e2b29476
SHA512 1205248ece04cdc93cc22181984251ae24cdbc744288a8c05c4da9bc60e86a18609c6eb6aa63439187a42dfee6fa761b9c3cbf8c389fe2b7fcd53cf3f963c2b7
SSDEEP 96:xHX5nUTUsqGq3fXZgEDxLHzSe0XlnBOjG3I2H54JV5Bw8V8kOSo:V5nfR3fXaEDV70Xb93IY54xBw8V8vSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\prefs.js
Size 6KB
SHA256 1829ff4b03dabc9c50c235be8f2e2d9d12c5c192e2b99b52e9d3ab6f924d172d
MD5 cdaa1d11b2aaad5bf6a5c74bfe0a59bb
SHA1 123769db38d55a16e320110614b7b4292745ac31
SHA512 83253957c8e2fd2c7022000baa7f1e87c5cc786f0674959d9c168a8c1a9f93aa7d7cd22cc4396ae5131c331ff4ad552e024cac0e21e17c12ac82b4f723fe71b6
SSDEEP 96:xHX5nUTUsqGq3fXZgEDxLHzSg0XlnBOjO3I2H54JV5Bw8H8kH3So:V5nfR3fXaEDVB0Xb13IY54xBw8H8mSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\prefs.js
Size 6KB
SHA256 dd5fd3bf94b0939cea68865bac8a19373c293774c260c47538b0ee8cc67bf981
MD5 b4cab60037e5a9499bcbf9d844927b7f
SHA1 ae83a375c274ff65404dc4d5c0056480fea32e4e
SHA512 60e4cdf74f35a427d5ed375b89548bf7a4ca5b877b7ef65552c7905f4e41e1968c35a04d48fe2c9cfc281ba57b905b77cf14037484a3f9ec32fec61a79942a95
SSDEEP 96:xHX5nUTUsqGq3fXUpLHzSg0XlnBOjO3I2H54JV5Bw8H8kH3S1GS:V5nfR3fXUtB0Xb13IY54xBw8H8mS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

serviceworker-1.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\serviceworker-1.txt
Size 164B
SHA256 992e354cfcd7b2df0aa193836b2f286dafdad13c57225f424d2db9bfc7792931
MD5 363fb02c063ec692e54b31a75e2e63d9
SHA1 b003e7151dd84125bfed68f022ad079f5fdf6d0d
SHA512 1619aae2de309a114c5de8461e16c09b6291986b0ec1611a0915b9cd53e0bb4cb1a6f350daea77069b9c67db6def0e24ca56301e02c57d16352f32826291b24c
MD5 SHA1 SHA512

Submit Download

serviceworker.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\serviceworker.txt
Size 149B
SHA256 5940e2b59fc23d4685191c95da263e6846a4a7ebf9f9403abbbfb6e5f429dd55
MD5 8f5cec1bf54bcd870144514f9a1690cc
SHA1 d31ff218722c279b83f4447d824ebddae9d83fbb
SHA512 68542c74a7e6d70a40973d2d2465dfa975abb948a4342f8296e94f63c66d8b834b2723e305fdb139945c2466533c841aa36c07da97d234ed6b68270dae48c9b4
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 da17efabc71836400a4ff1a104d5d0a9e69f769f124fe3cfe7705e191914cf65
MD5 9422ad6c5cff26d2bd9ccfd8bd06d727
SHA1 3ddb72758cdf4a2de076e69456fb63f568c5fe23
SHA512 3fd7ae26f28380dcb45f40eaf786bf081bb5ab6f31db564dce68e596d2edf2ee12de9d421a24dcb7b6801ae192bce84c7c2a1f9adac0cd807bae5be0ae345aec
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 c70c95b867c3cbbe6a66d61de09ef67e007c6c952b61a337ff2c1a05369c15e9
MD5 bdd3fe4728ba23cc4109a47d754c6425
SHA1 5bc2c12b1d5f016950002551fd2b0e7b502a5ff7
SHA512 0c8203266e4b4f66c5a087ded85e5a07dfbaacfc4c0dae7752e1c4c2be9f75c493498c2fa829125b87bbdd4e0bbc28623b21b4cabc7d70cfd9f64c9e94042f06
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 c3ad56c4a75adffa4c5383a9e13c94654ee110968c0887a899b6dcd133f33157
MD5 264d738e03d42a0c581a52f4ecf57b6b
SHA1 b246e176e1372ab4aa2273e58076701d550679e2
SHA512 f36c1e7b939fbb84a335986d95a8239b24e0c45f1d37f9b77193f2d26188461439f3f3e0baf8bce573c5983d2d74805314c790911f59edfef91f32683dbf26fa
SSDEEP 96:plZMF4nHhnz57KLWMy49CdL28kpwo6+iLZdE+XTJwbJtWEx:ZMOnH3WiL49xpwo6+Yd3jJwPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

{b058e72a-29c1-4187-9cf5-1eb7894f367e}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\cache\morgue\126\{b058e72a-29c1-4187-9cf5-1eb7894f367e}.final
Size 150KB
SHA256 0d5691f2348484094d5cd8e71180e04c0298503cf81a85a499a048d7eb20f231
MD5 c94a62d974cf250c1e29faccff0fd7d0
SHA1 444f190e901caf268fd75fbe68bd554a9723b96b
SHA512 e21cc276e7e52f50c4967e4471d40d0087cab8fc3bb83d0d6fa7d52932f78109a1e83a1fe55ab3755f2e116c412b508e364ff391ed399e4ffdf7b74dd6f16350
SSDEEP 3072:rFdDyGOR6+G9TEIvIY6AyFMNL08ypgV7aw0sL:rPn0IAY6C5XaIL
MD5 SHA1 SHA512 SSDEEP

Submit Download

{09934224-033b-4ec6-895c-846afeb3ac82}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\cache\morgue\130\{09934224-033b-4ec6-895c-846afeb3ac82}.final
Size 13KB
SHA256 e6d1ce16f366e79f06a692b5fb80b5fccfab5c52689cb9fe8f3992c3ab9b4d70
MD5 3c01a2a6c29d189426729620a7af042a
SHA1 1c0beb9ffb76142931b31806ad08713d4661e7e4
SHA512 3908436f677e0c2b1ea5400374a9074564fc937a6ff3c7939cd0d3b280fce70415545095f322f95fd577365c8b313b168a988505bd736633d14ff54e490d8029
SSDEEP 192:li14x2uZPcm5wsqhW05EKuKetpoJxaF5DL22bQVXUdOAU6bgFNlXvZPp0eMkgBEZ:lETPsqhwKuVtCwJLot+43LoWv
MD5 SHA1 SHA512 SSDEEP

Submit Download

{ac18c830-955f-4036-89bb-d4ee882ebea1}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\cache\morgue\161\{ac18c830-955f-4036-89bb-d4ee882ebea1}.final
Size 87KB
SHA256 5d8ca2c46f7ba50b813c2b18f7dc1f80129933894b78c0a819ac6a2722a63583
MD5 9ce438c0b605937c24badb7fa10dec7c
SHA1 36d7fdc4b8f021bf75e5289bf5ae682986f6daf2
SHA512 10f029417ecb7fb5857812a50d4b3ede44aff361107420d528427f16e60becea12ded493777ac2983b382eeb88154d33514da2ad8c1cd8ffd36aa4da268dad10
SSDEEP 1536:5aZwip8lf1rdnFtbQuQLKRZnjdnBGZ4K3dhDlS1Muo9P90fXC:5Uwip8R7QL8ZnmNn81ewfy
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9b98834a-cc0f-4e2c-91dd-bb5a12e531ec}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\cache\morgue\236\{9b98834a-cc0f-4e2c-91dd-bb5a12e531ec}.final
Size 62KB
SHA256 1fb1a66d961468bcab98341754e36e4bdf4b06f722226f1492cdfe449478b188
MD5 f6863661dfb7ec92bbb1a5b316ce9120
SHA1 17fc0760ed2a606c815723725b4f92784209a9b5
SHA512 9bfbe88010def9ee57120ee82f86b722042c9d241a0d0414de5e3dc304142de3a77d754f7400b0aae9068e9d5f594deacc4693caf9f85c0fde791a13dc57a1c2
SSDEEP 1536:0izTMK2u3V+dc+7pIz8lVCUufDzRzf6VvGyCqr/p3XX:dzQ7pKw3qzRzf6nCqrR
MD5 SHA1 SHA512 SSDEEP

Submit Download

{047b698c-51b2-4974-a1b5-3c4787d091ee}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\cache\morgue\238\{047b698c-51b2-4974-a1b5-3c4787d091ee}.final
Size 2KB
SHA256 e047d455c5ff24d77910554311aa77c998dade63d05e702886afd73037a203de
MD5 ee4fa843a3fa412cb49dd561004b7595
SHA1 1ff3a99b520d481a3f1e3bba36b01d8c9852bd5a
SHA512 f3061a505aed74a2f151fc4aa8b5ad161a7b140686ba29e26c7a1d2a2abda90caeaec281d7929ed20a4b5156bb60c12cc7dbb86617c8e2831c9eaabd40d47461
MD5 SHA1 SHA512

Submit Download

{19f08ac8-aa91-4450-88b4-adeb1f9153f1}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\cache\morgue\241\{19f08ac8-aa91-4450-88b4-adeb1f9153f1}.final
Size 57KB
SHA256 f9811e29f6171a2d19e656a551c7afb30ecc518be30b3b9d5d4b449f63225aa3
MD5 8592270c268394a381be09cc7c39eb0d
SHA1 a0646ef526f6ff743fe84e8d37a6b53bbe463931
SHA512 95c06db2d079467744140f9ea661ba46acd8d335966fcc25d18a0351dc79b917a24dbc8570dc0f90258c098795f7cb6ca1c91a2bcd1661d517d5c04e13bc9f1f
SSDEEP 1536:0qR5QNZHR7jF/FMqzw7Z1aarYYPWvhybOG:0SgF/DwNYarYcAhybz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{abe7a3fb-5fb5-4158-940a-ba0d3e9c5604}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\cache\morgue\4\{abe7a3fb-5fb5-4158-940a-ba0d3e9c5604}.final
Size 4KB
SHA256 6221ce6e16a329ef3a234344d1897a73fd2713f9ec7b3632f09ebb48939fb7f1
MD5 0d78b24b46415cace837e30259bc123e
SHA1 41e061caaefddf484ab013034af05bd835d5277e
SHA512 0dc7df83595f1bdad5beaaef768e0310dab69765013cd8b2a26ff5ef62ad393915bcea6efc6e474d05b24dfce4fd32bd13478de04010b92691063bc3a0eb2907
SSDEEP 96:fbjEg9kpYNTNePpwttuIJOIgfyOIV05iDURLMGXQQa44doWBFpSG:fXj9k+RNWcuISf/4gRQGAxz5
MD5 SHA1 SHA512 SSDEEP

Submit Download

{5ed0cc25-0598-4b8e-a7b2-af569932955f}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\cache\morgue\95\{5ed0cc25-0598-4b8e-a7b2-af569932955f}.final
Size 41KB
SHA256 8f5fa21ea8b0af3c3cbe010350273bca38e79f7137c328c2c6be499076261c98
MD5 e792ad3d01ffc2a8d7b80c481da5d241
SHA1 42329c8d70bd3f6adbfec616895e8b6087341c85
SHA512 bf2f7fbb514deeb49bd2b87a2072da793dfedb12b48514331af102ebfda12cf62eb3479895f9bea0dcd0b364a01003455cd65e253b6b0073d0f49aa02e291214
SSDEEP 768:009z5Qmn7DllsZeQMA99BfvOek8SzevQaRs0xvQ3kGuENZTHsg1+Ax13Xoqt/m6m:06KM79ZATFMaRs0x0kGuCYin/Ii//m
MD5 SHA1 SHA512 SSDEEP

Submit Download

2508030415PCe7r%sCi7s%t1ecn2t6E.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\idb\2508030415PCe7r%sCi7s%t1ecn2t6E.sqlite
Size 48KB
SHA256 6e69aa1451eed31e1f27065e0d80c1cc6b86b520c56459b11413786dacd19264
MD5 55c33c4601502e6ee76bc48f0af1a5de
SHA1 be5b64868dc8d74ef284332b03832ba5633ba688
SHA512 1627462c8950b1151e031af0c38b93f3f15e1638e264c1b311aad9e0ac844647d01134630f6d4b65904e6dfec2e1de3c64dc1114bdb334cc107d59fe08af9798
SSDEEP 48:T/OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEl:D16S6CKnqlizbxV+2xVeU7X2B0l
MD5 SHA1 SHA512 SSDEEP

Submit Download

3211250388sbwdpsunsohintoatciif.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal
Size 40KB
SHA256 6cf95028fce09a55026411d206190d786708bfb6c8b09842266478058569e117
MD5 552a86f0a835a42d933a1531076c0c2b
SHA1 45ba2a60cc974ef783180e856ecb4c590a5ec951
SHA512 d2a62fe5c1cea5801e47aa33c45a31e7a2a2aa5dbe483f495dd0e4ca78834fb9ddd3f77d790777ad718d8ced38c889b6f19d0618f03aea1501dffb015600d2a6
SSDEEP 192:/XKLSTILy+TILFh+TILzbh+TILeWbh+TIL1:3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads