c7faff5fb2e65b364befd2c2eeeb0fb30521b3f2600da24bcee3e8b8d17dbf1c

Analysis

max time kernel
205s
max time network
211s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19/06/2024, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nighty.pyc
Size 2.4MB
Sample240619-1bty7axaml
SHA256 b99a622908a8fa8117e2bc8b15e168572befa29bb863c9c25a9e8fdf0e50ec35
MD5 6bf475ec68cda6fe15458601e1e54cac
SHA1 94487d0e8acb99cb70e8a582c6b9a5112ebbfef7
SHA512 09a38dc7fab45a2a6171746941722e49e51cbf3dd483c1283ff3e020e9603bb2b5a7c7cc6d1644e2d150d39e7824fef139423dbdf1d5250e11196a362bd4adca
SSDEEP 49152:wPJLuY+oiMXC13NXFhnJtAfXJqTLVfUQW9dehdQzqqkDgUrqzOd2FXP:0uYyhFhnJtAfXJKYoQDa+f1P
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4988	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	firefox.exe
Token: SeDebugPrivilege	4836	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4836	firefox.exe
4836	firefox.exe
4836	firefox.exe
4836	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4836	firefox.exe
4836	firefox.exe
4836	firefox.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
4988	OpenWith.exe
3408	AcroRd32.exe
3408	AcroRd32.exe
3408	AcroRd32.exe
3408	AcroRd32.exe
4836	firefox.exe
4232	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3408	4988	OpenWith.exe	80
PID 4988 wrote to memory of 3408	4988	OpenWith.exe	80
PID 4988 wrote to memory of 3408	4988	OpenWith.exe	80
PID 3408 wrote to memory of 844	3408	AcroRd32.exe	83
PID 3408 wrote to memory of 844	3408	AcroRd32.exe	83
PID 3408 wrote to memory of 844	3408	AcroRd32.exe	83
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 3624	844	RdrCEF.exe	84
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85
PID 844 wrote to memory of 4200	844	RdrCEF.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nighty.pyc
1⤵
- Modifies registry class
PID:3076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nighty.pyc"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:844
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A6982A4EA177A582581D48ABABB69ADA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A6982A4EA177A582581D48ABABB69ADA --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D98778AF3257983B3238DC9E6D4E9C12 --mojo-platform-channel-handle=1824 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.0.1380410478\237770750" -parentBuildID 20230214051806 -prefsHandle 1784 -prefMapHandle 1500 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b30a2bb0-b7c6-4bea-8f04-b799b7973920} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 1864 26215830b58 gpu
    3⤵
    PID:920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.1.1599216707\1300981570" -parentBuildID 20230214051806 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e081d431-918c-41b8-b72e-4cf56f8e2bc9} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 2388 26208a89058 socket
    3⤵
    - Checks processor information in registry
    PID:4708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.2.832834996\1723780822" -childID 1 -isForBrowser -prefsHandle 2916 -prefMapHandle 2912 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1200 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b08be3d-b053-42ae-9ac1-8d1007d6bb3f} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 2928 262180ec258 tab
    3⤵
    PID:2728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.3.1360887938\726541041" -childID 2 -isForBrowser -prefsHandle 3556 -prefMapHandle 2692 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1200 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cbe56be-f5b1-4620-becd-0f2038acbedd} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 3564 2621b22e558 tab
    3⤵
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.4.1441043093\1680304902" -childID 3 -isForBrowser -prefsHandle 5044 -prefMapHandle 5040 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1200 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d49a3284-eb06-4e2f-a359-eb332be1b9c2} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 5052 2621d263958 tab
    3⤵
    PID:3844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.5.1050708409\609689702" -childID 4 -isForBrowser -prefsHandle 5128 -prefMapHandle 5132 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1200 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea48b4bb-c2e9-47fa-867d-edbc246d5149} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 5104 2621d264558 tab
    3⤵
    PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.6.131470522\439132826" -childID 5 -isForBrowser -prefsHandle 5324 -prefMapHandle 5328 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1200 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2178bf09-a693-46c3-818a-91a3c4c78d9c} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 5316 2621da14258 tab
    3⤵
    PID:3140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4836.7.234653127\476588543" -childID 6 -isForBrowser -prefsHandle 1680 -prefMapHandle 1604 -prefsLen 27690 -prefMapSize 235121 -jsInitHandle 1200 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1e5cb5b-10fc-45b6-8ea7-a1e582d26bdf} 4836 "\\.\pipe\gecko-crash-server-pipe.4836" 5780 2621da15458 tab
    3⤵
    PID:4820

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg2c1myw.default-release\activity-stream.discovery_stream.json.tmp
Size 24KB
SHA256 b1c67820524164d1a3dfa293fe975493d33681ac7c71b2505a1dc1f23f634c1b
MD5 e764b895c82008deb6101fdefd962025
SHA1 2edbb78ae8b2bacaca414edeacbe237c41ce7360
SHA512 e8519ff939845dda8a4325a0ea5c0829764467cb7cb9dc044fca34accbe99234802712b6d5a6e5f63694b271dd7b6dfef27ad9c168dfc5382809116f3719e1e3
SSDEEP 384:rbVkq5cjsoJPD7rEz476SbSEG4MCEMPRavIe/5EzJs7rFGGkbSWtSk3Eayaa:rbVMb64G4pxEmaDWIrFWbDtD3Eay1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 f35cd8ef03ac924a59943c5dfffc31ab67a8b5aff272e9f47ff776aabc7ee561
MD5 e9aa12ff0be6d995ed86f8cf88678158
SHA1 e5ee38fc2ebef0fcbc3059dee29b39f7daf21931
SHA512 95a67acd2a4784b87d73910c1f1f590937c9d9b901e98448556a37eb8137ae5f458f1c673d65a46cf7d6b90bee5fe6b102ce3eeac9e819062cd9c5c2418bcbfc
SSDEEP 192:NJAFJr9oBiV7vi12YJrtkp1NDuHAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo184uJU:NJWJVq12krtuJ9pmXmlJVjeQ8RJoeaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 355f4081dc19d2bfd40aa473a1f76ff02912cf04906b9af9dd62edb0646e1c5a
MD5 f6cf8a445e1a471d6dff34d1abb8efdb
SHA1 57e4448a4b9475bb529dd7bb3a9808e6e0400b76
SHA512 64e33a1eb07c42dbd55ad342b35b34487b9a659205e0f0a5f6605135f5b710deb4882af894fb1c807e0d48a5acffdf3911740ae6c0eacaa4c173f64351deb3d2
SSDEEP 192:RJAFJr9oBiV7vi12YJrtkp1NDuHAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1i4uJU:RJWJVq12krtuJ9pmXmlJVjeQ8RJoQaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js
Size 7KB
SHA256 47e4228885e3e37c290f5d51f95aaef05788f81260082355ffffe4250d08c63d
MD5 b9b2623c6b2bca24c9cf3c0249dfa0cb
SHA1 9ddd71e1f500607dfc19af9f13b7748aadb17b3f
SHA512 06eb830fa11a0d80c5a04f68c6570b6d6975975321d9a9a51add8519f4ca8ab715225d4e0cc99c64159bcee4ab6e34a41750cc0a20265335f8ff043807fbc58d
SSDEEP 96:xHBVnUTUrqGqyf7sCLHzSE20XlnBOj1j3I2HjN1/H0MBw8H887ZS1GS:zVn2Ryf7syp20XbKj3IYLH/Bw8H88FS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs-1.js
Size 7KB
SHA256 16a60d40a4a629c3a66f80a59c09936a75e72ac57890fb1432efb74254526fc7
MD5 d4f39703785d97ef322cd341f93ebb19
SHA1 d3ade8f20b9e36024d5f79f126d26d23cd293fd1
SHA512 d66f7bbbef152816968e772a0257e148f969cd7516abc46ae972206fc0c4d6ee5b0ab2a4fcd3d1de54a8eb5b86777802b6ef3b2d2668ee697fd2095d3904df12
SSDEEP 96:xHB5nUTUrqGqyf7sCLHzSE20XlnBOj1j3I2HjN1/H0MBw8H887ESo:z5n2Ryf7syp20XbKj3IYLH/Bw8H88ISo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\prefs.js
Size 6KB
SHA256 31793cd9125e50b38fd5d6e81b6e906b0f6f149fc1b22a45aea41f9c5de5430d
MD5 a576e0fe6200bb6e9c8a0c8e08256621
SHA1 70f5b672b3394a00d43da2e8b018a98548361a0e
SHA512 df636e7ec53db2dee14c51c163d4e3aea0fa16e4eb79aed542c485d25b2c1c412ceda59b21fb14ab5f0b9d9ffc0b8f5659e2af20030329644314c197b4c3b325
SSDEEP 96:xHB5nUTUrqGqmf7sCLHzS60XlnBOj1j3I2HjN1/H0MBw8V887wSo:z5n2Rmf7syX0XbKj3IYLH/Bw8V88MSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
MD5 c8dc58eff0c029d381a67f5dca34a913
SHA1 3576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA512 b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 c38d1b131d99277b5a1b9db8e92f231dbf5cc7c0b0e06b63bcb909714505fac7
MD5 4ae21653264504337343ccfe8a9da6f9
SHA1 931bcc075eb5197a58c36a684ffc6684f913fbb7
SHA512 7879c53d44595365175542bf139956d4832d63448f98d74b4ef75efcdce52c6427e7498495033c76fb852496dca534f59dab5869e7eb50c7872e440dd4a4eb79
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 013c0df551295f249b9814a9921832ab35e755f61af6b3f77aa9ba857fe420e4
MD5 9c869571bddd18c4e0fc1acf171e3510
SHA1 ab0af394be6c8e326d55b9e83f8506587ab9a2fd
SHA512 b1c54c7a7c08648145f57ee69fa6f281d1de271aac360abd1208e97e3be8b047b30e4c5fb7587a661dce81fcf66305cb40294edc9a672f3098f06a874690644a
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 06f034be7b3032b4156cd35565c92d8c2dcf5958e152f4327ff86c3dd406e666
MD5 13d89e4429ca02994c5a2c72f6b18ffc
SHA1 f79bc4275364b08d68800d895695239244b108fc
SHA512 dac89f2c7c348d1ff9a0a386c9f6c422555124a850b360ca88fad6c9de47271a1f71ac0867fcbfa93f804b2f8046993b790d426bac404bb5f70c8d99e31576f0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads