9c279b771a8b30be18b982216f6a328dcacd88724be170852f554d6c8541777e

Analysis

user interaction
yes
max time kernel
52s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SkyHanni-7.11.0-mc1.21.10.jar
Size 34.1MB
Sample260418-rl3jmsbv6x
SHA256 9c279b771a8b30be18b982216f6a328dcacd88724be170852f554d6c8541777e
MD5 85fee23d544109cd3a01fc38f921f501
SHA1 599096d780c492961ebbf174dc3c8a4be60d3be0
SHA512 53928c89600c91cfddb002af3340f3fbffae91a250c5a97690e011289baaf1c2004093610f9e3b02bb1581ffa9c5fa2577d91c04a9b685d2a27a4f39ce9762d6
SSDEEP 786432:R/J0tnuW9IWmZD2wRMVgkW+v1X7S0vTOhrcXIywbYTHTjEPCfX:RR0rI/Rtr+tXG0vTOdc4ywbY7TjCCfX
TLSH
T17C77132A3A857419D1174CBB468581F2A83E3BC4BC99743F62743457C7ED8BB070AAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	firefox.exe
Token: SeDebugPrivilege	3452	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3452	firefox.exe
3452	firefox.exe
3452	firefox.exe
3452	firefox.exe
3452	firefox.exe
3452	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3452	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 3452	836	firefox.exe	88
PID 836 wrote to memory of 3452	836	firefox.exe	88
PID 3452 wrote to memory of 1728	3452	firefox.exe	89
PID 3452 wrote to memory of 1728	3452	firefox.exe	89
PID 3452 wrote to memory of 1728	3452	firefox.exe	89
PID 3452 wrote to memory of 3380	3452	firefox.exe	90
PID 3452 wrote to memory of 3380	3452	firefox.exe	90
PID 3452 wrote to memory of 3380	3452	firefox.exe	90
PID 3452 wrote to memory of 3380	3452	firefox.exe	90
PID 3452 wrote to memory of 5128	3452	firefox.exe	91
PID 3452 wrote to memory of 5128	3452	firefox.exe	91
PID 3452 wrote to memory of 5128	3452	firefox.exe	91
PID 3452 wrote to memory of 5128	3452	firefox.exe	91
PID 3452 wrote to memory of 5320	3452	firefox.exe	92
PID 3452 wrote to memory of 5320	3452	firefox.exe	92
PID 3452 wrote to memory of 5320	3452	firefox.exe	92
PID 3452 wrote to memory of 3416	3452	firefox.exe	93
PID 3452 wrote to memory of 3416	3452	firefox.exe	93
PID 3452 wrote to memory of 3416	3452	firefox.exe	93
PID 3452 wrote to memory of 3416	3452	firefox.exe	93
PID 3452 wrote to memory of 5592	3452	firefox.exe	94
PID 3452 wrote to memory of 5592	3452	firefox.exe	94
PID 3452 wrote to memory of 5592	3452	firefox.exe	94
PID 3452 wrote to memory of 5592	3452	firefox.exe	94
PID 3452 wrote to memory of 1684	3452	firefox.exe	95
PID 3452 wrote to memory of 1684	3452	firefox.exe	95
PID 3452 wrote to memory of 1684	3452	firefox.exe	95
PID 3452 wrote to memory of 1684	3452	firefox.exe	95
PID 3452 wrote to memory of 5856	3452	firefox.exe	96
PID 3452 wrote to memory of 5856	3452	firefox.exe	96
PID 3452 wrote to memory of 5856	3452	firefox.exe	96
PID 3452 wrote to memory of 5856	3452	firefox.exe	96
PID 3452 wrote to memory of 2460	3452	firefox.exe	97
PID 3452 wrote to memory of 2460	3452	firefox.exe	97
PID 3452 wrote to memory of 2460	3452	firefox.exe	97
PID 3452 wrote to memory of 2460	3452	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\SkyHanni-7.11.0-mc1.21.10.jar
1⤵
PID:4376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {8ee9e82b-82e0-41f5-b865-5be9b154cee7} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {f3fae07b-edc3-46af-aa04-6e6792471b01} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3736 -prefsLen 27276 -prefMapHandle 3740 -prefMapSize 270279 -jsInitHandle 3744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3668 -initialChannelId {533c7afd-8f4d-4f07-b28e-02f3957800a1} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27276 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3736 -initialChannelId {5d377581-d312-48f6-8889-9c0fa4d41b42} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2656 -prefsLen 34775 -prefMapHandle 4496 -prefMapSize 270279 -jsInitHandle 4512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2952 -initialChannelId {ba72a6d8-e5e8-4594-b4f8-8b5020ae720a} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 1228 -prefMapSize 270279 -ipcHandle 4940 -initialChannelId {70a07067-3595-4716-acc6-b37e0a115172} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32900 -prefMapHandle 5152 -prefMapSize 270279 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {28485ada-2879-48bb-b825-a99da6b622ef} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32900 -prefMapHandle 5360 -prefMapSize 270279 -jsInitHandle 5364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {44cac1bb-f45b-4960-ada2-1808744f2e7d} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5584 -initialChannelId {bba37802-8e52-4629-878c-0af908a3a357} -parentPid 3452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e3a75021e6944b1f56f5276188c0e34922a496881e6295b3d49b40ce8fe81a75
MD5 f1857359f9e80f7baffc6619cc7f815d
SHA1 1b39f52cd275774e5d7fa1f69b037ae4bccc153d
SHA512 a21d9769e15a005d9f6223d8c4292560ed7711bafbf5b9077e2b8827fc8436ffb07a138d542a6c98ee6d9a81d140e37c060de989ca3fae2a284045ad55a18b4f
SSDEEP 192:VOv5zbo9bR4yjyxWU1d66JozGzgCl6mc0dz:Kbo9bR4yjBed66JozGzgC1jd
TLSH
T185D1FF29E6294A3BC848023BCCA61F400F763857D85E7F1932AC645D2D572CEBB8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 36e98181edb65e1e13ef2f46008b6ef7052eedacef7caebcd4af5a45ad103552
MD5 4b77a11d56a64a675b3c996555995b49
SHA1 06ded2b3243df514f89d92fcd03fa02c0c1e1ef6
SHA512 aabde26d3aef3ce7b2312fa06b4da86c1db1c376594ca03cc12e740fbd1798182831320d17fbbb6288910bf860dcc05174419dfb0cf65cca5c15bd7e0341b3de
SSDEEP 192:/Ov5zboPgZR4yjujWU1d66JozGzgCl6mc0d:wbooZR4yjhed66JozGzgC1j
TLSH
T1CFE12068EA29463BC448027BDCA61F400F75389AD84E3F19369C745C2D572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 7b3f4d9a197d1ce7ba8c439e3a8e2ed4fe3b796381daf0df42c97fff31cf3537
MD5 e14062b7ae94cad6de0590c7855a30e9
SHA1 b2f1b7dd5c854786138c5b64070a632db8c8d5b3
SHA512 32713f35612a2b114753a3b90be9a73a6342b87c9f5da3391d6b2a246001edc0a766a1aacf777fc3688801a867054696d3786cc0d96143efc272fed814cff644
TLSH
T12461B859F6298A3FE448413ADC921B405F307456E8AF7F2A36AC608D1E5B2CD76CD13E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\events\events
Size 1KB
SHA256 02605e4e295daf658a4f9812ae4e226932ee2de3a69675bead58b61b8b6c66ff
MD5 2bd9d89954d9df166eff2d6edff5836d
SHA1 03bb39aeab9089b2b8c005dffcb9b92290b2536b
SHA512 c7dfe7d0f78164837adc4a2f4198b4d324e9fcc4c08cc52b209b6b700fa3a9a7d33a127a12f0be7e5b0a201e0d94772976901f870a255333e6098c1545c817d4
TLSH
T193216A9C39B84D6E6C9BE2A87880139E53668E0A04C71D434E22DF8DCDD5ED9336A43D
MD5 SHA1 SHA512 TLSH

Submit Download

17273f60-e656-4eff-90db-6988a32d8c6d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\17273f60-e656-4eff-90db-6988a32d8c6d
Size 2KB
SHA256 d9ab62aeff01bac4561bfae126e76cd8df73f31ff9ac2a6e4489f51257ea0b81
MD5 bb47904dd89f7b3bb11939ca43250298
SHA1 b4a9e92ef7765e7715449a90dae11140932b5788
SHA512 7f84a537277afd6f5fa7ae593b0ff8dc136e4b640da42669eda573dc314889109a96d3321edc6c03b15219505586122f82191e3e7c6b59ed21eb3979300d560d
TLSH
T17041516C35784CFB9CCAF64DE092338953608A0350C62D532E51CF0C8D966ADB36F12B
MD5 SHA1 SHA512 TLSH

Submit Download

42a6d9b7-233f-4f67-afdd-1f67ed9d2972

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\42a6d9b7-233f-4f67-afdd-1f67ed9d2972
Size 886B
SHA256 ff60b6d35b64cb9808170543b7981036914eeb98da313402c62e80ce5a8eae33
MD5 8f97b3f21a2e1732e63aface23cfbe3e
SHA1 a6b45311d95ddf6d1e29d57ec219873f3f829956
SHA512 a98e58792edb6c06ff7faa71f87863ce56db53800b8a824e49728d4724392608d229d77f9cb368b92db42c02c28d2b25909a5cad618f252fa5b1728412d6dbb3
TLSH
T1F911238589697DB28CA8E64BD5E537414BE43123D0C548187EE05B2C0DBB04EE7A730B
MD5 SHA1 SHA512 TLSH

Submit Download

45bcd81e-796f-43aa-8b4d-11739cdfe091

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\45bcd81e-796f-43aa-8b4d-11739cdfe091
Size 883B
SHA256 dbe7ae1fffdc49eb18a3cba6a4bbef7a409bddf3eba55b1ed2e9ba9577c75237
MD5 e3d0bc3939ef089172278bd943527683
SHA1 b2512b04ab4fcc0bdcfa90ec9ca8dde0ebe25611
SHA512 9bff5ea48475212d0629fd008f7de07eacfd1a2dacefd209f09403b00c17fdbc2faad94aa309744df0741ff5c8f475cfb020f23b9d1461be81e1504d46c76463
TLSH
T12011C091963679B38CA8D24FC5A53B018BE43533C0DA84147EA05A14097F51EE76B747
MD5 SHA1 SHA512 TLSH

Submit Download

4cc7d2ce-5864-415b-9b91-8cdf7fd957f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\4cc7d2ce-5864-415b-9b91-8cdf7fd957f9
Size 235B
SHA256 cd65241ef5b11b1ee564425d82f5b8ca9c52b0dc787d2d0feb8a832f3e916d8c
MD5 20cf953af28169f94c345d56152a87ce
SHA1 926e142cb6d76171c09f7e1bde89374470ca342b
SHA512 dc08f732ae97f5252316c28a9e3085eb1c9d48c313a1aa143c409f060ada91f6727f5a0bf6d6f13dcf3041f0439591d2eafd0f8fdc9dfd415bdcf30d0c9f7f61
TLSH
T1E5D097821498ABAC08080F02B0E83ED230898C3314A86820876002F8A9BDEC84222C0B
MD5 SHA1 SHA512 TLSH

Submit Download

9d0eb866-7440-4b5c-9744-a22817a1f8b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\9d0eb866-7440-4b5c-9744-a22817a1f8b6
Size 16KB
SHA256 85931dcd7da55574cbeba87f427090b943f8ee802cd341376edb982cce756bc0
MD5 3e821e99ca79a0932ab228f8834a3996
SHA1 34deed9c9f537667babdb635e2651c0666d3bcd5
SHA512 ab239ff2a922c237105196cbae02cc04746cce99f0128b1dd71f9291ae219d832a10f3c25f89d4aa677fd17f1055947089c1592a495ddf649bf0550c4ec37c11
SSDEEP 192:W5ewgUqAqggwJz/yBsiUcXlBvSv2m4DqJRA/l+7xzaXS7OLDe2iZ8De7meyJ8KmV:Wp5Thel+7xOXS7OLDq8i7ZXuckK
TLSH
T1AA72D9565830497A8291E36895FC7FC3E6F528CB4C419FCDDBE0BE482DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8906d75-f986-422c-b3d9-d259ce718b14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\c8906d75-f986-422c-b3d9-d259ce718b14
Size 235B
SHA256 a6c8e2cda91c6007dbc0179adc2d5ac5c5af9097e8eb71e153e75c81c4b90052
MD5 1374c437e82b1efb5e72812dc692e06a
SHA1 140492b2697bd255fa10e460c8595d48c4e96d7f
SHA512 9f7beca1547a0fe709142d51cc161fcbdc7cb1139450b0e6f2d25824c746fc48ad876f9306a73e93ab6d6fed567d4ded558c28a27ca6bd87201f441e69f4f4a9
TLSH
T1B7D0A781699A676D08190F07B0E16AD630654C3714799CA496518678DAFDDD4816281B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
Size 6KB
SHA256 0a8571f14af01281b79192b5b0fb792d6c06d277c75c380f17d74321298a32fe
MD5 244dda1f174830a52da249c464132ce2
SHA1 f1713c33da39a9ee6537e79d7905e0f594098ee7
SHA512 c273fed94517bf509ffcc4353bc9a36e6e974e5f04955f1549fade5a1510c8672f03ba56ab89c205cce72a92a01717a4f9569727741e57bc787f115fc4f5821a
SSDEEP 96:xHSrUTU5QqGq0fCkKp1zSOSSl8pdv9jon1HacetBw88n8L4cn48gmg:4rJbR0fCkKpnSSGUacetBw88yi
TLSH
T1D8E1317854188F6F74B6777CAC6888706AB2413BB7BF68C750BA5484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
Size 6KB
SHA256 4bcd507e9671b4e294a800db65789224209611331c2221c5595049c31a4a8aee
MD5 4d44b85a3a125243c321c232667cb9f1
SHA1 7bf206e580089831e1003eac6e61eb80fa04c883
SHA512 b14fabf2ddf0746e69feef6876106a1f265b3e9f1246a0d6b148521d3a49d1642d25d0a6bdd3fad8a8b25ca29f1a19dc5d78935a13c01bf6fc74bf4c7248d21e
SSDEEP 96:xHSrUTU5QqGq0fCkKjanjLM1zSpgdSSl8pdv9jIn1HacetBw88n8L4cn48gmg:4rJbR0fCk13MogdSSGUacetBw88yi
TLSH
T145E14F7894188F6F74B6776CAC688C306AB2413BB7BF68C750B69484051CF7442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4376-2-0x000002B516E20000-0x000002B517090000-memory.dmp

Download

memory/4376-12-0x000002B516E20000-0x000002B517090000-memory.dmp

Download

memory/4376-11-0x000002B515650000-0x000002B515651000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads