e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25

Analysis

max time kernel
770s
max time network
722s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25.hta
Size 1KB
Sample240503-vad9fsbc7y
SHA256 e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25
MD5 dda846a4704efc2a03e1f8392e6f1ffc
SHA1 387171a06eee5a76aaedc3664385bb89703cf6df
SHA512 5cc5ad3fbdf083a87a65be76869bca844faa2d9be25657b45ad070531892f20d9337739590dd8995bca03ce23e9cb611129fe2f8457879b6263825d6df49da7a
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
8	3220	mshta.exe
65	4988	mshta.exe
101	2240	mshta.exe
100	2240	mshta.exe
106	560	mshta.exe
107	560	mshta.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	firefox.exe
Token: SeDebugPrivilege	2612	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2612	firefox.exe
2612	firefox.exe
2612	firefox.exe
2612	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2612	firefox.exe
2612	firefox.exe
2612	firefox.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2480	OpenWith.exe
2612	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 4352	2480	OpenWith.exe	110
PID 2480 wrote to memory of 4352	2480	OpenWith.exe	110
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 4352 wrote to memory of 2612	4352	firefox.exe	112
PID 2612 wrote to memory of 2900	2612	firefox.exe	113
PID 2612 wrote to memory of 2900	2612	firefox.exe	113
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3620	2612	firefox.exe	114
PID 2612 wrote to memory of 3100	2612	firefox.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Blocklisted process makes network request
PID:3220

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\234e3b771a244355a1fc513d14ed9ecb /t 4848 /p 3220
1⤵
PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2524

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Blocklisted process makes network request
PID:4988

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\e1f56cc8f69e4e9fa42919543b88f0f3 /t 4008 /p 4988
1⤵
PID:3564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25.hta"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25.hta
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.0.1601344451\995602873" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cf75be4-c13d-4779-9d22-698773e7098d} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 1964 1953cabe358 gpu
      4⤵
      PID:2900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.1.694068521\351072375" -parentBuildID 20221007134813 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58afc75d-1dd2-4af6-9966-7c3cece65423} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 2388 1953ca0ba58 socket
      4⤵
      Checks processor information in registry
      PID:3620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.2.139523737\407666641" -childID 1 -isForBrowser -prefsHandle 3344 -prefMapHandle 3340 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {879b10fc-79e1-49f3-9024-284d4907d95e} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 3352 19540b06558 tab
      4⤵
      PID:3100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.3.1400687787\715071226" -childID 2 -isForBrowser -prefsHandle 4124 -prefMapHandle 4120 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f04b2c3-133f-4254-9cc7-c1e18347d0d5} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 4132 19528e65258 tab
      4⤵
      PID:1868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.4.1166588329\1534731964" -childID 3 -isForBrowser -prefsHandle 2828 -prefMapHandle 4888 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9817215e-4542-4971-a663-2d5d26dc9357} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 5036 1953fb12858 tab
      4⤵
      PID:3292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.5.1803406471\658114221" -childID 4 -isForBrowser -prefsHandle 5052 -prefMapHandle 5048 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36ba9c3b-14ae-4121-ad32-b9e0cb51ebba} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 4912 19543529558 tab
      4⤵
      PID:560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2612.6.1619203001\2084739705" -childID 5 -isForBrowser -prefsHandle 5280 -prefMapHandle 5260 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c298f61f-3010-4970-98b3-81ab8000f135} 2612 "\\.\pipe\gecko-crash-server-pipe.2612" 4900 19543529858 tab
      4⤵
      PID:3900

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Blocklisted process makes network request
PID:2240

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\997c94f6315a463bb6a8cca994772961 /t 2544 /p 2240
1⤵
PID:4108

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Blocklisted process makes network request
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 cdfdb2f045c411174e547e4f2f0a9894c7a176cf650f76e953283816ae66277b
MD5 ec23eac07041bd8c1afcb6c85917d689
SHA1 6763f60665d9bda6b42695cc1ebf20b9182a051f
SHA512 a6a9155b94dc37d7cebad05c0f1a5b89140f310e8af4e614a6fb9fb15f543454dfb8b170386728b687c5cbbf8b749ea952f01f02e32287a2a48cc92d44b5113a
MD5 SHA1 SHA512

Submit Download

4b5228ca-8e7e-4259-b507-d34c3ccd4fc7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\4b5228ca-8e7e-4259-b507-d34c3ccd4fc7
Size 746B
SHA256 24b57e29818f7ae3e868e699561c2cbec95abe046f8e1eb291e8cc931160eac4
MD5 b0d366f576dbce581ca5c90c07aead32
SHA1 03d825c7f2d032f76c6e69ea01b716e4632425ef
SHA512 daad85415382c501c8eed16393994373ca6ee2202263d62c5113539a0a327f0c01418d4121632801a618d0f79593113632fd763a0a9155716ed4d3c7f6afab6d
MD5 SHA1 SHA512

Submit Download

50ceb88d-7c23-4e63-937d-7a9f536bf246

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\50ceb88d-7c23-4e63-937d-7a9f536bf246
Size 11KB
SHA256 84b9e280a3bfc8e6f418dbf24a522fa1093ebb55e31ea91721bbdb2fcd1f4399
MD5 8189751c1ab182b499cb58d7508209fa
SHA1 acd8d3b0d318b7c2f5cccd48dc081bcbed12bd47
SHA512 742874abbff41ad5f820225f85369fa2ce8117e8307b368676f084222dea424ca382ab2c02cb1fbe4dd6d1675ad992951750ecdcb6132232e292d88553fce8e0
SSDEEP 192:1FtWfGyFzaSWlr+k9DwL3j9onz5Ss/MPa9c4lGgDI+EIooaXlkH6AY4GYUDyYJDp:s2FWkoO5K
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 58d4ce7fba60a021ad1979d9ff105a6831f2d89ee4f05859e094d05f72e79158
MD5 eec82150f8d82ecf35f6de38800554c2
SHA1 07446882a5d73d95137b14f183862da3f63c131c
SHA512 8354f47a7a9b57f2b92d557ec5795407c7a1a95f730de2a94fd576a9c569d131b03e237aa989fff4fbd9297fa1a6c4a8072aaf8b4d053110ddbb5e466bf75411
SSDEEP 96:xHGg5nUTeqGqpdIK/eOTzSmPXAnpjzHhE2u5DtRBw8H7kV:35nIRpdIK/eUPXwhExXRBw8HA
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Size 6KB
SHA256 5b88a48931cbe988ed2524217eaa76c6e3caf8c4773e33cb510df36d77cb8b1c
MD5 c550d5cfefeb8a7ae363d5465063bd91
SHA1 9558d93cda78b98e35c1beb6ef064133a484b856
SHA512 637a00c986a79ef79d1cc688ef32c31d036f17f1d51d6d355c763fc6880ae217768c90e1fb3448d4c9a341784c9fd9b1c0ccf6ad279d3b15b5961d87f5eeb05d
SSDEEP 96:xHGg5nUTeqGqpdID1yCeOTzSmPXAnpjubHhE2u5DtRBw8H7k4o:35nIRpdIhyCeUPX5hExXRBw8Hc
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Size 6KB
SHA256 549f3db27c895a924a80eb1f13c82e1e27f49bdb5f5d63700a16533733b63843
MD5 e7d4909afc2c94f56059c806d27c50fa
SHA1 ca60a53cf2e4236364e6ef1fef320192310d3099
SHA512 e4c66a66627da5abd668de5b2e60f62769c144c0f4849b3cedefdaba622c2cbdc38184c2ee6e629b18ae6d257d5ea942d1ec52a14cac5c873c1541b6573a254e
SSDEEP 96:xHGg5nUTeqGqpdID1yCeOTzSnZPXAnpjubHhE2u5DtABw8V7k4o:35nIRpdIhyCeXPX5hExXABw8Vc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4
Size 633B
SHA256 109dcd5c3442e8c5e38e9ab61ba8b6fdd75d17f6a855aad009d35bec429760a7
MD5 69468c263ec2c10ed2c767e25d248e11
SHA1 eeb6d428b7afa171075a23183ae28e240b6a6127
SHA512 2877797fa825e2bde4135a56b67b372b06756cc6e36191725bcd29d324072d5f025badaed4706a48b77a963a153cc2f8bb6b500de630350c727db315c9281f9e
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 ef1ebedd446ce18b79317f09953ff8a6069f92749188b45945567c315388aa90
MD5 b01efd0877d8bb4a5d754d6d5a5922cf
SHA1 6dfaecd4219afbb206185171c64c777e9c73ae21
SHA512 6f5fce89b6dc7e6979fdb01493c0811bcd55cb945d7665cd9a23e93419a5aa28207b3f614461103f04b0406741e8020c35252fda5529e41e3e918e42fd89c086
SSDEEP 3072:EmcHDPRuFPF3y346uaS9vAem6ua9QxeHVVPuT:EmcHDPR093y346uaim6ua9QxeHCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_C4WP9C3.hta.part

Path C:\Users\Admin\Downloads\_C4WP9C3.hta.part
Size 1KB
SHA256 e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25
MD5 dda846a4704efc2a03e1f8392e6f1ffc
SHA1 387171a06eee5a76aaedc3664385bb89703cf6df
SHA512 5cc5ad3fbdf083a87a65be76869bca844faa2d9be25657b45ad070531892f20d9337739590dd8995bca03ce23e9cb611129fe2f8457879b6263825d6df49da7a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads