hxxps://gofile[.]io/d/48bKeR

Resubmissions

21/02/2026, 20:13

260221-yzpm9sbs6b6

18/02/2026, 15:57

260218-teb48adw2d10

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/02/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/48bKeR
Sample260218-teb48adw2d

Score

10^/10

romcom storm_0978 apt discovery exploit persistence cve_2025_8088

Malware Config

Signatures

Detects RAR archive exploited with CVE-2025-8088 ADS path traversal. 1 IoCs

exploit apt romcom storm_0978 cve_2025_8088

resource	yara_rule
behavioral1/files/0x000a0000000244a9-381.dat	CVE_2025_8088

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	api.gofile.io
36	api.gofile.io
38	api.gofile.io
39	api.gofile.io

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5432	3648	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	7zFM.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\PAWG Egirl.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zO8441E0C9\112.png:Zone.Identifier	7zFM.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zO8442A5F9\112.png_Zone.Identifier:Zone.Identifier	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
5312	OpenWith.exe
3352	7zFM.exe
1096	7zFM.exe
5556	OpenWith.exe
4424	7zFM.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeShutdownPrivilege	3648	wmplayer.exe
Token: SeCreatePagefilePrivilege	3648	wmplayer.exe
Token: SeShutdownPrivilege	2344	unregmp2.exe
Token: SeCreatePagefilePrivilege	2344	unregmp2.exe
Token: SeShutdownPrivilege	5436	wmplayer.exe
Token: SeCreatePagefilePrivilege	5436	wmplayer.exe
Token: SeRestorePrivilege	3352	7zFM.exe
Token: 35	3352	7zFM.exe
Token: SeShutdownPrivilege	1144	wmplayer.exe
Token: SeCreatePagefilePrivilege	1144	wmplayer.exe
Token: SeRestorePrivilege	1096	7zFM.exe
Token: 35	1096	7zFM.exe
Token: SeSecurityPrivilege	1096	7zFM.exe
Token: SeSecurityPrivilege	1096	7zFM.exe
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeDebugPrivilege	2996	firefox.exe
Token: SeRestorePrivilege	4424	7zFM.exe
Token: 35	4424	7zFM.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
3648	wmplayer.exe
5436	wmplayer.exe
3352	7zFM.exe
3352	7zFM.exe
1144	wmplayer.exe
1096	7zFM.exe
1096	7zFM.exe
1096	7zFM.exe
1096	7zFM.exe
1096	7zFM.exe
4424	7zFM.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
3288	OpenWith.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
5312	OpenWith.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
2996	firefox.exe
5556	OpenWith.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2996	1268	firefox.exe	85
PID 1268 wrote to memory of 2996	1268	firefox.exe	85
PID 2996 wrote to memory of 3916	2996	firefox.exe	89
PID 2996 wrote to memory of 3916	2996	firefox.exe	89
PID 2996 wrote to memory of 3916	2996	firefox.exe	89
PID 2996 wrote to memory of 2804	2996	firefox.exe	90
PID 2996 wrote to memory of 2804	2996	firefox.exe	90
PID 2996 wrote to memory of 2804	2996	firefox.exe	90
PID 2996 wrote to memory of 2804	2996	firefox.exe	90
PID 2996 wrote to memory of 3188	2996	firefox.exe	92
PID 2996 wrote to memory of 3188	2996	firefox.exe	92
PID 2996 wrote to memory of 3188	2996	firefox.exe	92
PID 2996 wrote to memory of 3188	2996	firefox.exe	92
PID 2996 wrote to memory of 6124	2996	firefox.exe	93
PID 2996 wrote to memory of 6124	2996	firefox.exe	93
PID 2996 wrote to memory of 6124	2996	firefox.exe	93
PID 2996 wrote to memory of 460	2996	firefox.exe	94
PID 2996 wrote to memory of 460	2996	firefox.exe	94
PID 2996 wrote to memory of 460	2996	firefox.exe	94
PID 2996 wrote to memory of 460	2996	firefox.exe	94
PID 2996 wrote to memory of 1744	2996	firefox.exe	95
PID 2996 wrote to memory of 1744	2996	firefox.exe	95
PID 2996 wrote to memory of 1744	2996	firefox.exe	95
PID 2996 wrote to memory of 1744	2996	firefox.exe	95
PID 2996 wrote to memory of 4476	2996	firefox.exe	96
PID 2996 wrote to memory of 4476	2996	firefox.exe	96
PID 2996 wrote to memory of 4476	2996	firefox.exe	96
PID 2996 wrote to memory of 4476	2996	firefox.exe	96
PID 2996 wrote to memory of 4380	2996	firefox.exe	97
PID 2996 wrote to memory of 4380	2996	firefox.exe	97
PID 2996 wrote to memory of 4380	2996	firefox.exe	97
PID 2996 wrote to memory of 4380	2996	firefox.exe	97
PID 2996 wrote to memory of 4260	2996	firefox.exe	98
PID 2996 wrote to memory of 4260	2996	firefox.exe	98
PID 2996 wrote to memory of 4260	2996	firefox.exe	98
PID 2996 wrote to memory of 4260	2996	firefox.exe	98
PID 2996 wrote to memory of 2316	2996	firefox.exe	99
PID 2996 wrote to memory of 2316	2996	firefox.exe	99
PID 2996 wrote to memory of 2316	2996	firefox.exe	99
PID 2996 wrote to memory of 2316	2996	firefox.exe	99
PID 5312 wrote to memory of 3648	5312	OpenWith.exe	117
PID 3648 wrote to memory of 672	3648	wmplayer.exe	121
PID 672 wrote to memory of 2344	672	unregmp2.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gofile.io/d/48bKeR"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gofile.io/d/48bKeR
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {0d858404-6510-48b7-8dfb-1bb2d9bfe469} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {b88cde51-a04f-4e78-9e9b-708b65675954} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 25164 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {38e3f091-040f-4ec8-9063-b059f67f7383} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27276 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {96599a50-c5a6-4056-bce6-721d51c89282} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3028 -prefsLen 34775 -prefMapHandle 2776 -prefMapSize 270279 -jsInitHandle 2940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2944 -initialChannelId {ba41c0a6-035c-40ad-a48d-c013ce9a97b2} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5044 -prefsLen 35012 -prefMapHandle 5048 -prefMapSize 270279 -ipcHandle 5056 -initialChannelId {a3658eb2-e6b0-4c8b-b347-3b35fd8024ae} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 32952 -prefMapHandle 2924 -prefMapSize 270279 -jsInitHandle 2860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5568 -initialChannelId {9c5dfdab-ffd3-4b22-84a4-edd482aad971} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {65ec9761-da4c-4c6d-bd4e-17b5057fc10d} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5864 -prefsLen 32952 -prefMapHandle 5868 -prefMapSize 270279 -jsInitHandle 5872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5880 -initialChannelId {9bb9ca2d-cf2a-43cb-9e2c-a4705f76a89e} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 32952 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 5832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4892 -initialChannelId {3b986b4d-50b5-478b-b5bb-ea9c8caa17d1} -parentPid 2996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\PAWG Egirl.rar"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:672
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:2344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 2252
    3⤵
    - Program crash
    PID:5432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3648 -ip 3648
1⤵
PID:1892

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\PAWG Egirl.rar"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3516

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\PAWG Egirl.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3352

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\PAWG Egirl.rar"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1144

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\PAWG Egirl.rar"
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\PAWG Egirl.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 5f4be7e52844ece816694098628a51f3e2727540234352ff23b048213b83488a
MD5 123fb4762f168f15b282e71a89439cd2
SHA1 50047bec9fee0df28faaa86e38ba81c0df0788de
SHA512 2c5d6cdb47df57bc451279d8dd07714978689ccaa3020de692a29be9dc53ac5e953cfdfab71a253fb7c0969ced071661565954657151b9836ad5861801bbf9a9
SSDEEP 768:5f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3Y:569tQeoVYocxYCutFCJGAKt2hZ
TLSH
T1E5D40C3BA470A098DF3C35B1E2AD6B4CBD72641A12E006421F74B57F7A237D8DA0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 c55018fa2b7e3f7e5ee07817ec06dd526cbf7cb91e58eea93d6bd9d2e84fc12b
MD5 ad136f0b3409236361068fcd44bb8654
SHA1 02eb38635280f4cc1747caca90a734c0359a9b0b
SHA512 0f82884eaa5ee1902c93b56f5443b689756ac8d6265cff64162f073dc948ce8703a2009d091575148e07805eb88b4c982d6165c86e3afc858fb88ef84838860d
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbam:rZP2tFP3vqY82qEMSTaBacgn
TLSH
T14D257437D190B0C5CE2CB171E9ED8F09BA23A10711A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 7db6d5518a973b1ab6c5cbfe5f391d9ecbaba804241c09f7156529dce0d7c8c0
MD5 47eb6ad2303c6dfdb4570ff057627d37
SHA1 9e64b56c05da586a83c761fb7298525fa2c44346
SHA512 312160966062532d8960d6beea2013bc631d6106dbb38120765717a3b8ac44762d5ab2c9c154dd05911ce7b2ecd893b652d70bfcaf1dcdf702e414f71b27a8bc
SSDEEP 768:10aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbam:zZP2tFP3vqY82qEMSTaBacgn
TLSH
T109257437D190B0C5CE2CB171E9ED8F09BA23A10711A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 fe9dc5d1b8fff0939527089e72bad5466a7d83b3bc18d9c07896c92c1bfe09bf
MD5 f2c3de134fa9e2bb0c41cedbd12fcc31
SHA1 1077e74bf4104119aa674163efe4ffea3f294c26
SHA512 6c637024f9d012e339985ce7e148dd55479d2e0ba7cb553d969205712ecc2332ecff6bd59869a4572d915c4e8d96736a0e6384c2e1574befccd43dfd6bc6e4d7
SSDEEP 768:u0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbam:AZP2tFP3vqY82qEMSTaBacgn
TLSH
T1CF257437D190B0C5CE2CB171E9ED8F09BA23A10711A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lastplayed.wpl

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\lastplayed.wpl
Size 361B
SHA256 9f2955158df5b252504f9a5462d454353d7c6970a733254eabd0229c3dafad0e
MD5 5f775d1910f11494f621b03697dcb754
SHA1 8d7c7857b9fbfc50b2336075abaa3ab48c334bf5
SHA512 6a4404adc3e918090b6beac3c409b68ce81b808f277a7c1c55f486ec79cdeeb54f0a5413d777ea9abcfbb04ea86702d7562916b0bf5726eeb3418161f792ffb1
TLSH
T1CFE08C33B1C87E219AB160546687F962EEA158D702071695B0CC228B4FB3E9486C31A4
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0BD1340651D4AA8F85B88FAE370752D8F1AC9700

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\cache2\entries\0BD1340651D4AA8F85B88FAE370752D8F1AC9700
Size 13KB
SHA256 3cd8b7c6c34add20ee77b573c5a4d4a61a2b8fab438e93e7877b435231ad4337
MD5 f13aff6adbb5cdba506a329a7451fba9
SHA1 a81811f012cbcff57df900324095a0c665c84641
SHA512 4c52b8e87eac87af14ea8c27f487e30081c4c539e8e6c6afc033632255f2cd666efcebe4d73b29593290aba35338c3908852b56781bc698cf2de4f78b1a00180
SSDEEP 384:HWEMiO024YFRXWI3CB80cX+c3P0lpDII+uRk:2SZYFRXW7B80cuCMD8Lp
TLSH
T192529EFAAF0138AE2557E0D8C8BD96098E08BBBBEBF7E19506643409C540798F4F44DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

112.png_Zone.Identifier:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\7zO8442A5F9\112.png_Zone.Identifier:Zone.Identifier
Size 166B
SHA256 375109731b1f821b30f4203492adb2adffe740900351f3da4a6cabaf981d3f13
MD5 6d96775a7b2d6317c7636c9f02db6a1e
SHA1 89ac5e68b8abdf46e6b47d1eca63899670cbd8f4
SHA512 00b96ebb11f29de0c32f3a7f6189815181469310dc4e3aecafed12835ca6f22b04e064012d4b3b25523758f2a8c0f10775034774be23230f7535a78cc7c31282
TLSH
T16DC08CFF8408C275221C2AE200B8A8CCBB1F5A088DEEE600E550408F7C8A568D8D257F
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 593d4b65dbb4f1838723c18f2c0fde203906059ca4a9073498e9d928ce3d9e1b
MD5 a9c0111a24926ade1b84b92ed1e4e365
SHA1 06d7e83c4925510155b57102bcd49648a93fc4d5
SHA512 c26927d41ffd7d6a1902672b3067288849333f99f576c7e1fcd8a7edb89c71a8d449020c0d3ecd2f975e5d174d3f63c3f042fcb3325f12409e0fe4521e8ea449
TLSH
T151214C661B4AE47089E01BE71DEC8E25737787CA93A1D0A5B34DA029480712D6B3E15D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2aaa905b60a0f942bf9f9ced68cb93d587f792c683cf80c0e3dbceca2bbb4738
MD5 8af3934b5fec55019eb51de81c42099b
SHA1 d4072d1740dbffde54fc1db6b9b32ccae610aa6f
SHA512 3911d26aba915f38f9a0cf778890db38e98fd41679fcd2538b7860bc8fafad9a0bda43472a4ce280d092e99818c207d811ea5ce284e88af1adbd82456658bdf7
SSDEEP 192:c1d66JozGzgCl6mc0dh6mOv5zboCbHLfyjWojI:Gd66JozGzgC1jf6dboCbHLfyjW7
TLSH
T120D11F64EA28463FC444523BCCA51F404E76395A9C8E7F1932DD74082D5B2DD768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 69cb942daa2bb0d74f6b562bfc6d93f2054e4f2165040cf3ddb12f69350ee94f
MD5 247c4b6ab09bfbb78efd90affacb1e63
SHA1 4aef2a60e482ba4d98a5a1a5ad25d77219c0e20b
SHA512 a1a100e2cc741058cc059fb82863f8ec1ea75f27dab8a12d72f179af57943e78daf6a92f69f00283646cfec7092a9f6d694e4ceb055e76b1995a155a509ee573
SSDEEP 96:d6mSdF95/7bkW60rcEHLfyUR6Wix2WZLFmb2FkFdFaFt/dd66JozGzgClKtmc0dz:d6mOv5zbowbHLfyjWcx31d66JozGzgC/
TLSH
T151C1CC64EA28563BC444523BCCA51F400E76795A9C8E7F1932EC74082D5A2DD768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f8039d2487f2282bc6799ec0c86c82b71732c150299c4495d56bfd0f383d33f3
MD5 421b558494ffabf7983ffc509c917d34
SHA1 0687be93e58765a1eff806f6f3dfad0aeddcf487
SHA512 77b052ecfa96ea3ddc954f8669da7b95a87d229734d3efec6d7bc0b7965a9eb2cfea659ec82fed75cbb2d8e79979abab595f0e976492d7e8ad92b520cc79c81c
SSDEEP 192:c1d66JozGzgCl6mc0dr6mOv5zboPXZHLfyjWojI:Gd66JozGzgC1j96dbofZHLfyjW7
TLSH
T1D2E11FA8EA28463FC404127BDCA61F400F76389A9C8E3F19369C740C2D572DD768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5aa5a52cfdf3abb17e935023abc9377f464d3659df8cdc012fbe1dae864b8095
MD5 e433a1f141a6852c7b0c8fa857818aaf
SHA1 7e101ebf72630c39b7f9ab8b2a1fd2e9f6f3a513
SHA512 389f23ae328a9a7896d0a8d6e62fd81dd80da2ddd160894cd6a51024948da276e882b362086505ab2960b2ac61bf071e26a31e320865f9038ba88e46f5a06f9c
TLSH
T10D21974C39B84E6AA897E39CB484128E53514E0344C71C574D43CF8DCC95AD9726A63D
MD5 SHA1 SHA512 TLSH

Submit Download

2791683a-67fc-4dfc-81f0-839be983f01a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\2791683a-67fc-4dfc-81f0-839be983f01a
Size 235B
SHA256 fa29a103fb7c2f27da2b3c88682924e0a55230bb97709e5954487910a1200829
MD5 516ee1f3d76a8c22d6ba8de97e5cbf7c
SHA1 9825536d0c11f0e637f16b6375e2c1a354ff542f
SHA512 37d42b5546630374293c09b7d50f5ddedfb7d472a1edc0815bcf3c2a560745853a6fec4c6406eff48aca9f298d805bd2618be4240047d36cb70c0bd1c8420799
TLSH
T1DDD09785788863AC08100F0BF0E139E330488C3310709860DA62087CCABCEC84291867
MD5 SHA1 SHA512 TLSH

Submit Download

367bf1aa-025a-4eb4-a130-37580ab91a62

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\367bf1aa-025a-4eb4-a130-37580ab91a62
Size 2KB
SHA256 4d2c59e128047a1c446a666731d633147d2830a4a6444d3ae96b44d8dfc209e6
MD5 5f90b6adb5ba0e464b5315af0cd20f38
SHA1 f48f2ec3d0b6ec1b096ba52fa49a6a11d313980b
SHA512 3f6f0114e6ba352356036563234f9b5168b7b006dc101f97b5981f6e837dec1109ca1dc24c08b08310e393b794b76c2c9986e5c7d1946bd0908079e2894635f5
TLSH
T19241535C36788CBB9CCBF15DD482338E53618A5300C62C933E51DE4CDCA66D9336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

a9c70822-4688-44a4-94d9-99b550c500f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\a9c70822-4688-44a4-94d9-99b550c500f7
Size 883B
SHA256 bcdad22c6b51cfb33545ca96341fa7034297ffcc43f6e19f5d9ca89860accfee
MD5 7d2344b9280a92da211b91336000a7d5
SHA1 dd40389f34dc61ba6acf3465cc04fb8ac15a8971
SHA512 5476a440d745ce08b54eb6c8b3febef5031ad0231898120da8b9fba9428caa38f58d15f30d789d0874d19e91799a6d87fadfacfe6deed61191395fc7318f5cc5
TLSH
T1AE1123819A7075B3CD68D25BC5953B428BE4B923C0C685043FB05A0C5D7E91EA35770B
MD5 SHA1 SHA512 TLSH

Submit Download

b705041f-5171-4554-8892-d3f334ab2a90

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\b705041f-5171-4554-8892-d3f334ab2a90
Size 931B
SHA256 c36deaff63a4757ed35af781ed04e8c458665c5cc2a5594b060eaa7eb84a695f
MD5 df680a7e390b708ad2ee1fb02e907505
SHA1 bf84e772f7fbd980c75430962bab7a91f82afa3d
SHA512 f1a757452bc9306680bc0fcff64831ad3a6458ceffcd219f09141b1164075d072f0b5a8c5f895187dbebcdb7cbb3e873191d3bdb397f0ab3f48df423d7736a2e
TLSH
T1EA1110909E7474B2CCA8D25794E077825BE4742380C659083F911A084DBF92E9357707
MD5 SHA1 SHA512 TLSH

Submit Download

dafc87ac-2eb4-44ef-beca-f931c55819c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\dafc87ac-2eb4-44ef-beca-f931c55819c2
Size 280B
SHA256 6ef52016ee8656048c835622ba813004a8e8c49e6cd9ebf63467432059525f72
MD5 5a144dfd676c1fd8f99cd28534c25f5d
SHA1 430e7a0da22c12e740502c6da882f39e9f97ca01
SHA512 72a7feb8ba629ce83302b62f5f56cc3c788ea4db5b189d914a83c8c22d9af2d7de19e68d236e9d22bd26d37e6906964f80b00dba77b15837769d086fbb520243
TLSH
T179D02BD16C88676E4C680F07F0B839F7B0658C3325F15910A993493856FFDDD9121A26
MD5 SHA1 SHA512 TLSH

Submit Download

e891352a-eaff-413e-a88c-7197140e42f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\e891352a-eaff-413e-a88c-7197140e42f4
Size 16KB
SHA256 a9e720cbe39f25fd1affdd8072362f5fd83da2164a331dc2582831a1c91d0fab
MD5 cbfc6686ec29e6d299dc920a58bfeb0c
SHA1 d25af66b158a643c717a66b0ed93af228b216e73
SHA512 511bc299d941397f8abae138e1e58320addb995bf311a2a329442853ba88e42a266e03eaf980b8a50eec75805c8aa24608b2bb0e270c49df21e9d65e86d2da67
SSDEEP 192:GtuZVJ1IMYNYDTuPEpzoo/kemegNP1zn80mIBIC1eMzMAJ9qLhwuFSpErzjk7ykV:oufLUP1b805umqL60SpErXk7yy
TLSH
T1FF72C956186044BA8251E369D4ECBFC3E5F63CCF4C419FC99BE4BE086DDA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\extensions.json
Size 16KB
SHA256 f882d752d1fa9666d26f6c347df73abbb81f8ebae34e7c3a222f2a1b7d82ec07
MD5 95b913cf87d506c66c81f431b23829c8
SHA1 80372df2f531f588ad04ef5cc12ba869321e05d7
SHA512 0b32c299e82ac4bd71247f5dc397c1372e462f092f5847eee94e8e8f16f9a56fca9cfaaa97296e3e08efc156812d443b0f5aad7baf2a98e35eebdfb76e4ef820
SSDEEP 384:AkI4v0UmldvN8dhWZ94zq96ojAL4HyDL4PeL4HofL4HYL4H0v4ha:nI4cRf+XA4q6h4a4s4ID4a464A
TLSH
T16C72411545049EB8294FA79BAA36BE01C37D473B60845C38F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 6KB
SHA256 d86af1ac63787adc138336fa00218bc6fe29ad4d705e56a239ff33bd4a0e21e6
MD5 e75b4d7b8936b7922eca4d081ea39298
SHA1 ce61e4f1864c585b873c34defadc73dfbaf2849d
SHA512 906415d424fb70fbbde62dcaefb457f948c74d8d47994a5d000a202d8545ca01eb607053215899cca0710774e19541a727855ef806550993a447a78033819d5c
SSDEEP 96:xH89UTUfqGq8fCqVE61zSQSSl8pdv9jhnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVE6lSSGc6OBw885y3H
TLSH
T11BE12E789508CB7F64B6776CAC688C715AB2413BBBBF68D750B94484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 8KB
SHA256 0428e76d7c5bc64068059beddfe71f3ebaa2d6f9fb6104c43c659518befb868f
MD5 8c81fddfea43b1191693f19e5997ef60
SHA1 ad26f0a9566d31b9ef6f5fc3d1d5d06525a33bce
SHA512 39587a8b894404a44d5a93cfa76e9c05f61bcb60b3c4039fa488405db34c71fa307625418dcdaf01486d160d03b667d90fba2a8c377f728c23ec26af30a2b161
SSDEEP 96:xH89Gbi/bzjTUSPqGqJfjE6ObzSQSSl8pdv9jhnFIWRYOhBw88/Mnn8L4cnoVqFH:2vCRJfjE6+SSGJRNhBw88g5sH
TLSH
T1F902FE7C9504CF7F64B6366CAC2889715AB2013BB6BF68D650B954C5010CF3482FABEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 4657bd2216c3fc2e908223663379fa949144d2d61a80ecd889637a2ab945c4be
MD5 b0fe6782ddbff824d4a68c1a514d7fa7
SHA1 9780efb0ec4f786e8a4f696270281809609cfff5
SHA512 b06e71ce04ddcbe24b3023a4cc4cafc1222dd64a1e94933053adec04ddd77b7e9e24f872561d875c79c333c82850b75100edec4e64ca0f6c0daa7cd8df53435e
SSDEEP 96:xH89UTUfqGq8fCqVKjfnjz1zSp88SSl8pdv9jDwnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVYvo88SSGB6OBw885y3H
TLSH
T1DEE11E789508CBBF74B6766CAC688C315AB2413BB7BF68D750B94484051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 7KB
SHA256 7a69646dfd661c6c2fe917e897a68dbc271351de30d8932cea6fb7b9212692a1
MD5 dfb72c50d95ec26084760013c9d4831d
SHA1 e21ded15b6bc328f80be7e177361c23843ca6bf2
SHA512 0f278abdb7260fa78757bff54e61ba05329f1efbc83f6c44c1d09ca550536c0660842d1e9c21657cc7513073c09621c912356ac6ea148529b1e28054ba740e38
SSDEEP 96:xH89UTUSPqGqJfCqVE6ObzSQSSl8pdv9jhnFIH6OBw88n8L4cnoV81FHn:2CCRJfCqVE6+SSGc6OBw885y3H
TLSH
T1CAE11F789508CB7F64B6776CAC6888715AB2413BBBBF68D750B544C4050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 122e2cd953fbbce3111b145d195862ec05bc14127ef3c0bdbb3989aeed407d51
MD5 3f6369a95ec29c7b757b3533a971275a
SHA1 e382b53e806e0d4b0bc3371881d5706a7785d42a
SHA512 c1dd77b520cc08934d4949edddc31eeba2a75e8b669b50d396563863eb839f2fe6d8371abaa7ff7e90cc45a65de04e028b7a42ff6de1ef270e45a3d164a58a15
TLSH
T10841F982266F0EDAFE75891CE44A5FB5C26E301300FC14518A465BC6BAAF1C5392A9ED
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 fd82170aa154872d6edb44f6bd8cc0f6dd86c4e55398043e72559efd4da4a32f
MD5 bd51ae47b5f6cb1d38ddde16ab5c5fbe
SHA1 589af259cb1842af6288c32603cd3db618f79e37
SHA512 31a23d938692b006af16eac7e5b0ebf2f611de4e9a57b8b0f4bcc6633eec2ccd98f79b5472aa452df4110572f8bdbd6c8f378e589efb8771e318ee3c2da49429
SSDEEP 49152:SrZbGQhf6mWRr2+Uguxh9oQWFBtT3204pJ:qZtymWd2+Uguxh2J7S
TLSH
T13A164BE460D1A343F3418073B58993EB21AFC01C6077DA4457A856E9A5B8CEF8E17BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.3MB
SHA256 abcf33b982f24845c1011460ff87dbfdb2da58d7c23e6d266b32e559747f3b88
MD5 9ce7164a5129800aaebe3fece14ff233
SHA1 c3ad3f3a367678996f521f5d55df67fd3909911a
SHA512 141301c763e3fd010a0f3e4f64003644dda2ac59cc8bc27c4c5583b64a1fb7ea38f1d052f3e51e91e4d16bb200361cf987d34a6f78a5b7e0ecd66ca0d5b1835d
SSDEEP 49152:gSkNRVaAIoW8zN6wlV07ZlxZGuIZN5LZGdsgbsNkqwLlmDOCwmfXGKhG6mWRr2+j:OPjnmWd2+UgmX2Oxso8
TLSH
T1ED465CE430E29252F38644B3B19A53FB10EFC01C60768E44575492FAA9B8CEB4D977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PAWG Egirl.a9PT7hZF.rar.part

Path C:\Users\Admin\Downloads\PAWG Egirl.a9PT7hZF.rar.part
Size 4.4MB
SHA256 24cd674442f2673192620ea9a32f1eb9c90dce16a133f83dce2745c33be68feb
MD5 9e947d4d37df3aba1522fd4d864b6f13
SHA1 2e1be1852db30f9d2f939988b59a73321fe1bee1
SHA512 0e63bcdf1c73838241821492a3206196b618071993d119403c89a0f887ebbdfb5dbdb80e88e8606ff4da2da565c838881ea1cf4d020f846d9038436b5fa27b35
SSDEEP 98304:e5jGJY1xuQ2YL27A8yDurTbwz6NsCw2Twr7AlIv1/GBabGPef:SjG2HH27FgEbwuNrtBu1/GSGPef
TLSH
T1792633A6FA5C8D36D906433DDC7C0D4424B98FBE82F2F2FC4129BCC5A98E5167059BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-422-0x0000000000940000-0x0000000000965000-memory.dmp

Download

memory/1144-784-0x00000000031F0000-0x000000000322B000-memory.dmp

Download

memory/1144-783-0x0000000000800000-0x0000000000825000-memory.dmp

Download

memory/3648-463-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-457-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-476-0x0000000000E80000-0x0000000000EA5000-memory.dmp

Download

memory/3648-455-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-456-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-477-0x0000000004950000-0x0000000004958000-memory.dmp

Download

memory/3648-467-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-468-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-454-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-451-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-450-0x0000000008330000-0x0000000008340000-memory.dmp

Download

memory/3648-452-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-464-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-750-0x0000000004950000-0x0000000004958000-memory.dmp

Download

memory/3648-749-0x0000000000E80000-0x0000000000EA5000-memory.dmp

Download

memory/3648-466-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-465-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-458-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-453-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-462-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-461-0x000000000A530000-0x000000000A540000-memory.dmp

Download

memory/3648-460-0x0000000008330000-0x0000000008340000-memory.dmp

Download

memory/5436-767-0x0000000000940000-0x000000000097B000-memory.dmp

Download

memory/5436-766-0x0000000000750000-0x0000000000775000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads