d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

max time kernel
123s
max time network
129s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250207-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-02-2025 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.txt
Size

18B
MD5

5b3f97d48c8751bd031b7ea53545bdb6
SHA1

88be3374c62f23406ec83bb11279f8423bd3f88d
SHA256

d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b
SHA512

ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
217	1600	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2620	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1549004827-922980081-1811511435-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2288	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	firefox.exe
Token: SeDebugPrivilege	3136	firefox.exe
Token: SeDebugPrivilege	3136	firefox.exe
Token: SeDebugPrivilege	3136	firefox.exe
Token: SeDebugPrivilege	3136	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 4916 wrote to memory of 3136	4916	firefox.exe	91
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 4220	3136	firefox.exe	92
PID 3136 wrote to memory of 1924	3136	firefox.exe	93
PID 3136 wrote to memory of 1924	3136	firefox.exe	93
PID 3136 wrote to memory of 1924	3136	firefox.exe	93
PID 3136 wrote to memory of 1924	3136	firefox.exe	93
PID 3136 wrote to memory of 1924	3136	firefox.exe	93
PID 3136 wrote to memory of 1924	3136	firefox.exe	93
PID 3136 wrote to memory of 1924	3136	firefox.exe	93
PID 3136 wrote to memory of 1924	3136	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\test.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 27191 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62108548-f859-4128-a7e8-4db665039aeb} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" gpu
    3⤵
    PID:4220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 27069 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b2c98a2-ad18-4a96-9a3d-a0a0bf8cd336} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" socket
    3⤵
    PID:1924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3000 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3012 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32f9e5a6-3e7c-4d7e-aea9-bbb9a02746e2} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4080 -childID 2 -isForBrowser -prefsHandle 4092 -prefMapHandle 4088 -prefsLen 32443 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50748c09-07aa-4195-89f3-efb9d88db62e} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4884 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4876 -prefMapHandle 4872 -prefsLen 32443 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58e7e1e7-5241-4e0d-afe4-e47b8af551e1} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" utility
    3⤵
    - Checks processor information in registry
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5416 -prefMapHandle 5364 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c488692e-b2bc-4a0d-8cb1-857ddd1139cb} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3d14aa4-71ff-45b9-bd16-2e433ac1fd7d} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5728 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e07b75a-067f-4e02-93eb-f2c8c008d3d4} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4284 -childID 6 -isForBrowser -prefsHandle 4788 -prefMapHandle 5752 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85160dfa-e253-4682-b053-24e854193bda} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:2984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 7 -isForBrowser -prefsHandle 3904 -prefMapHandle 2520 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8c432c3-1167-402c-b66a-206069072c29} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2676 -childID 8 -isForBrowser -prefsHandle 5684 -prefMapHandle 5608 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ea23ca1-93aa-4677-b75d-e30f88eb4f7a} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5920 -parentBuildID 20240401114208 -prefsHandle 1552 -prefMapHandle 1432 -prefsLen 34134 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc0c58e3-fc7a-4309-8404-25076d366d4f} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" rdd
    3⤵
    PID:1396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6696 -childID 9 -isForBrowser -prefsHandle 6512 -prefMapHandle 6516 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a948b93-7bf0-4c98-ad68-4c16d8648923} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6444 -childID 10 -isForBrowser -prefsHandle 6424 -prefMapHandle 6120 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b738561-219a-47ea-8a31-4f6a8c09592a} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" tab
    3⤵
    PID:5192

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDE4MjhBMTEtMjg2Ni00NzNFLUE1MDctQjkwN0I5NThGMTBEfSIgdXNlcmlkPSJ7REIwN0Q0QUQtRDcyMC00MzMxLTlBMTYtQTZFMTdBOTU3RUQ5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTRCREFGMUItODQxRi00N0Y3LTg2ODMtQjI5OUFFOUQzODdEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NDIxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5NzAxODEwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTI5OTMxMDYxMSIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\untlgzrw.default-release\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
fcd1ccbf5c28a9bdc8cbfed061066e29

SHA1
4f98a9576daf9e07ae2c4a496147123fb37b3e8d

SHA256
ae6629f6f2c9abc3096c96e3a10b902af35a2693933fd169d8deb5e637d0b866

SHA512
69c76697154af6235bd8644a155eb686312e0163c47189185380d13a2696eb5e259982d0be1b29fddb204ff6dfa7037aff633391b9f3579e8a61e656247b0cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\AlternateServices.bin

Filesize
10KB

MD5
6157bca58ce5b8986d215f5b8976ce29

SHA1
b071bda6e26780a90355598602eca11c3795480c

SHA256
5e07f042a87f0fb1fd8085dec88019a9301e438c9ed71aaf8f03cf4dcc246187

SHA512
e76ab0ef654ab2db56097ae3a5413f7e077b1685dce63aecd89c25843952c5d6ac085af0642f3e80c0c59d373acc6da70e0a8d48200f9b4e3b79e5e9808c0f09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
997081990ca833de08713560732bd16b

SHA1
c98d241344b8bc75a158ee8824176e5c85db8cfc

SHA256
073e68c26c60d93bf3ac88bce0b0ab6ee3393da46da7f5a4fe088f6c38992b4c

SHA512
ce5353f5007980c177772196af3015178af3e05d6996a815eec8d73bf7ed2039993080ef673161fd444757676dfd897fc61b6f931f5de20a115b4928148ca291

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
22c84579a1c63d041896133aeb037623

SHA1
ea2e8510546ce53239c360bea9db576cd3102977

SHA256
677cd4ddb9d8f471160b1ec547df9eec5a1c5f45b706c9349a4e177a48f3d136

SHA512
a4652e674db6454e7a2f725088b9f4edb3aef2ba55aaff1ebba30d885a419584fca3311ef718d3aa4da89c3ad613dd73f7e2368b3b299e65aff131edcb77dd4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\datareporting\glean\pending_pings\954e1826-617d-433b-9dc4-3558fb0991cf

Filesize
982B

MD5
1d4924990f8d3fb6113c9c4b7af35a72

SHA1
7c81c5c77fe6aa5962ff8e958c33a1d961be590a

SHA256
135ec4cbc40c7daf372898f40449568bce2fcdcf1d7698248473c38e780954fb

SHA512
ed6f4ddfa0861aac1647fa9150f173b9260ac808d987d994def9dfe817ec7db88bac8492d3447739116f3c6f403d7762cefbc41ee204217aedcac06e24119fca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\datareporting\glean\pending_pings\b9fdfc52-7524-4a38-92c7-2d1359c0fd3c

Filesize
27KB

MD5
4d21c2b45c56e35182201edb103dd402

SHA1
7d004c1ff348b353ed33552bf00693a8e6e0bb09

SHA256
d8bbfb3ebef0126fb4d19dcff084254ec8dd20f02d0c2897a3025dd690417174

SHA512
2764f044f6913cc6c2884a8f6320c7f9f502137c1ac267453dd6298baa8966009bbffb77c135e78e56730c9e6b356cc8a9f47593e68eea3b09770f84217e7781

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\datareporting\glean\pending_pings\e3043a8c-27b9-4ee0-a4e5-dc709854a6b5

Filesize
671B

MD5
10452d9698dc17ad4107ee0faa0ea6f6

SHA1
f54cadc0022e80dbb840351d898b99592bab4033

SHA256
1b0b6d1f14ee50f785275751a403f13ccd1d265d2b4d2ff6132189bb29899a86

SHA512
5385270de2ed077807b8387b1c09e8bc53345c9dc17de815cad0307509ad65dd48a735b238d8a25508aea2146eb54b01532df0ca4fda90970f332feffe037754

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\prefs-1.js

Filesize
10KB

MD5
35b6ad08adbeae5964e5f303542c9421

SHA1
0d2103b29ff5dbedf27a901539418c5200579afc

SHA256
166513468436d23ca38a207d3d364f6e110b83c24c32f677455404012f1d8557

SHA512
da1256f4d64afeb4c5ba6801c4aa5e1bd376644b49cb2a1ee9fd2f58f059d12cc6a8180a8e6457a5ce049d92bbc1ab828939113564547179fba84f1f6734fce7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\prefs-1.js

Filesize
10KB

MD5
cde7eeca33f276ff7dbd819102b9121c

SHA1
827682b2e0d3fc8e4771b35f499fde7ffec863f4

SHA256
16393ef3d432239cdb48133c5be9791085f0e7d9676906dc45c61b6522c4298a

SHA512
ae6fe7410d0b0b6e3b3f7119867e7a00930b76fe4655cb6b9ad2332fe1f5c71a2d1f8b0910eb8441f0937a9293d4c99173c8af8c14bb77246b0588189362867a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
bd37a4130139a0b688b90f8fc064096a

SHA1
5f4c43be5dd5f2a5040b73c8262a340d272f5561

SHA256
2574dfa9df1d04d925d0868a7a464505f665b051be59ebf7a6b55d59d38c0960

SHA512
2a3f2bf80a22cee004309aaa3e2aa6aec9e51b6db937771d13ece673e451996c4f40cd468187a86bbb8dea5d49cfdf39db602ec86ebd14b1a5c46310dd95c3a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
76fdbd37e73e9cac07cf2055a65413bd

SHA1
fd3fb10df1581d812d65d9d5f850af669601accd

SHA256
626d06678f66cc42eb313184b725ff3f34e76c6317bb7e5174b8240a6ce29633

SHA512
21aa3e81bd2da4f4296873b606b0e6bdeb2c2bf66d935de438792922f8f45fa8d07e1f2a0894db51d9acc125e86dae97ad456ce012799ed5c63a416852b6bc92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
1837aae9d21a4586a747d856c18f5375

SHA1
014deed656e73f80951d80172223764101c3e20f

SHA256
91ed73ceb0b90ef98647b9ed112a67a4d5ba86eb93117fd1ee292dfb1ad47554

SHA512
53d5d1c5de8b800991cb8227a824b2efe5c53a702def3c3cd11b4661c275355767fd708b8432d3c67f1fe51105f04740421dd082dde1ea6f4c6b8c11c2dfb67a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
d9862dbd04a7a1b91a1c083a6315bad8

SHA1
2c3af939fa5a89ad03c3664bd08d68fd6caf9e0e

SHA256
26c5e7cf5afa5f77e8ad2303289f6df63fd627e39a19d46e8064dc7c87164e80

SHA512
2419ad6aa7716a889e331dc6681584aecd4128040872be1349a5ae4367d2a7ca125c207cf9d3923059ac7e047d5fee60311ffad379720ca8d23ce86135c24d5b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
c9289eb40a1fd8919a6dec8253759ce2

SHA1
139e7d55ac0a2a96672121cfcfabfee4fa2bd989

SHA256
97138c6ed4a55e51ee4c32d1b61c7d0a3c0a9820a44a838b7a497d60776dec37

SHA512
3a9c0e27cfec3166f4b8034bf2f54c377cdcd4ed59d5eb378ca652aadd99341452dfae3980850baba25f4f1ee1ecde300e0af3866b117acc9af0b0564b203709

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
7da757b30137637b4aecce37c056dcae

SHA1
171714bd6673b78dcafa54a85c16d01b5e3a117b

SHA256
6acfe8c1f7ec207d6477ba59541a2adeb0edb3d6118cfb02b504daf21179bd35

SHA512
431e07e14cc75ddcc98ee27ff9c6e0629d7d961071eb8c40e09b94d01a23d1518b79dd33a9f77df0671644f15381c1e60524ac866c0120ded3da391b387d143f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\untlgzrw.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
de06ec107263318817fc02ed8ecb29ac

SHA1
87270b8a186d5722c89b6889eb593c24989b18a8

SHA256
9983114d8f4647fc3c7037f9232eb43563c4cf69cc29573ddaa61c4dc197fd71

SHA512
ea4a1c8e669250427a725ca084fc334c782fc90599c9fe7038af33859a44dae409e2c10d8830af386f6b0e60e8fccb64633b4246a8f4c31b048bb59957094e01

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads