078aaff53208f91cdf4b50ef50b00855fc2a17cd565af2fdf386fea63970660d

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SPOILER_grimloader-1.0Dropsy.jar
Size 7.4MB
Sample260424-r13sysdw8q
SHA256 078aaff53208f91cdf4b50ef50b00855fc2a17cd565af2fdf386fea63970660d
MD5 19e19cbef34029b6e8f019969bb9ea56
SHA1 3d6045e37b858efdd34227c4cdd2b929f00be040
SHA512 2dbc46cb0ba2321167c3a1468e66344bf55d5c5222c47bb5032ad40e62f372d086922168c8efade30eb4c8f73419c1844fc1273896fd43ca92e003288cb702f3
SSDEEP 196608:EyTEC3QIL0j+2oVRbPLs460+WabmxVWktck+Vp7XdmOEfusZ:5EC3QIQYRzLs437auWsJ+VpuDZ
TLSH
T117763346CD69EC90CED2CB734B942E065F58913B42B28DEF1E02F4581C85B2796E2BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence ransomware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5256	NOTEPAD.EXE
544	NOTEPAD.EXE

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	firefox.exe
Token: SeDebugPrivilege	3204	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe
3204	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3204	firefox.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3204	1664	firefox.exe	88
PID 1664 wrote to memory of 3204	1664	firefox.exe	88
PID 3204 wrote to memory of 1908	3204	firefox.exe	89
PID 3204 wrote to memory of 1908	3204	firefox.exe	89
PID 3204 wrote to memory of 1908	3204	firefox.exe	89
PID 3204 wrote to memory of 924	3204	firefox.exe	90
PID 3204 wrote to memory of 924	3204	firefox.exe	90
PID 3204 wrote to memory of 924	3204	firefox.exe	90
PID 3204 wrote to memory of 924	3204	firefox.exe	90
PID 3204 wrote to memory of 3220	3204	firefox.exe	91
PID 3204 wrote to memory of 3220	3204	firefox.exe	91
PID 3204 wrote to memory of 3220	3204	firefox.exe	91
PID 3204 wrote to memory of 3220	3204	firefox.exe	91
PID 3204 wrote to memory of 4748	3204	firefox.exe	92
PID 3204 wrote to memory of 4748	3204	firefox.exe	92
PID 3204 wrote to memory of 4748	3204	firefox.exe	92
PID 3204 wrote to memory of 1184	3204	firefox.exe	93
PID 3204 wrote to memory of 1184	3204	firefox.exe	93
PID 3204 wrote to memory of 1184	3204	firefox.exe	93
PID 3204 wrote to memory of 1184	3204	firefox.exe	93
PID 3204 wrote to memory of 5588	3204	firefox.exe	96
PID 3204 wrote to memory of 5588	3204	firefox.exe	96
PID 3204 wrote to memory of 5588	3204	firefox.exe	96
PID 3204 wrote to memory of 5588	3204	firefox.exe	96
PID 3204 wrote to memory of 5616	3204	firefox.exe	97
PID 3204 wrote to memory of 5616	3204	firefox.exe	97
PID 3204 wrote to memory of 5616	3204	firefox.exe	97
PID 3204 wrote to memory of 5616	3204	firefox.exe	97
PID 3204 wrote to memory of 5624	3204	firefox.exe	98
PID 3204 wrote to memory of 5624	3204	firefox.exe	98
PID 3204 wrote to memory of 5624	3204	firefox.exe	98
PID 3204 wrote to memory of 5624	3204	firefox.exe	98
PID 3204 wrote to memory of 5636	3204	firefox.exe	99
PID 3204 wrote to memory of 5636	3204	firefox.exe	99
PID 3204 wrote to memory of 5636	3204	firefox.exe	99
PID 3204 wrote to memory of 5636	3204	firefox.exe	99
PID 3204 wrote to memory of 3032	3204	firefox.exe	106
PID 3204 wrote to memory of 3032	3204	firefox.exe	106
PID 3204 wrote to memory of 3032	3204	firefox.exe	106
PID 3204 wrote to memory of 3032	3204	firefox.exe	106
PID 3204 wrote to memory of 1200	3204	firefox.exe	107
PID 3204 wrote to memory of 1200	3204	firefox.exe	107
PID 3204 wrote to memory of 1200	3204	firefox.exe	107
PID 3204 wrote to memory of 1200	3204	firefox.exe	107
PID 3204 wrote to memory of 5300	3204	firefox.exe	110
PID 3204 wrote to memory of 5300	3204	firefox.exe	110
PID 3204 wrote to memory of 5300	3204	firefox.exe	110
PID 3204 wrote to memory of 5300	3204	firefox.exe	110
PID 3204 wrote to memory of 776	3204	firefox.exe	111
PID 3204 wrote to memory of 776	3204	firefox.exe	111
PID 3204 wrote to memory of 776	3204	firefox.exe	111
PID 3204 wrote to memory of 776	3204	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\SPOILER_grimloader-1.0Dropsy.jar
1⤵
PID:5044

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {6918552c-3354-450b-861e-ec2716002729} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2392 -initialChannelId {686132c4-bd01-4dd2-bb06-7b4abb4888fb} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27276 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {81ce40bf-4112-4b3e-a94d-6df01a71ac83} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27276 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {b250bffd-d1e9-4834-b71e-f2043be90baa} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404 -prefsLen 34775 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4412 -initialChannelId {9739bbba-996f-4548-91ce-aeb1ea835d22} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3108 -prefsLen 35012 -prefMapHandle 3104 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {67e79191-7460-41fc-9146-475479cca678} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3148 -prefsLen 32900 -prefMapHandle 3104 -prefMapSize 270279 -jsInitHandle 3108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {14ad435a-c021-45cb-a5c9-75b230739f46} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32900 -prefMapHandle 5124 -prefMapSize 270279 -jsInitHandle 5128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {f82ba4d0-6ea8-4859-b9a1-741bfaeee5b5} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32900 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {cb9e7684-0740-44bc-93b8-ad81eb5f9563} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6224 -prefsLen 33031 -prefMapHandle 6228 -prefMapSize 270279 -jsInitHandle 6232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6240 -initialChannelId {13c90bc4-966e-4ee4-b630-d87c13c78a59} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6088 -prefsLen 35143 -prefMapHandle 6480 -prefMapSize 270279 -ipcHandle 6504 -initialChannelId {07530e93-3d5f-4d3c-8880-709b1946e57b} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:1200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6684 -prefsLen 33031 -prefMapHandle 6688 -prefMapSize 270279 -jsInitHandle 6692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6700 -initialChannelId {3023342a-5ec3-441a-b3c4-b59110329007} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6952 -prefsLen 33031 -prefMapHandle 6956 -prefMapSize 270279 -jsInitHandle 6960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6920 -initialChannelId {3e6c1a41-5890-4cbd-b596-236fee4b3d68} -parentPid 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3204" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:776

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\virus.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:5256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\virus.bat" "
1⤵
PID:5200

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\virus.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\AlternateServices.bin
Size 10KB
SHA256 1a88e32131badcbd8fb7cafa5ce0ad1f90c37c2f663a0fd1b491aa37b6059f51
MD5 0474811396c9973d098f7c0e9f3ac3e6
SHA1 52f8d431da6ce86c8f66452b81cc334e1579b516
SHA512 db09a99577c960814e335f4a6330b9dff0dbcc84e13f99d6778dd66e417cea5148a00a4f640e8fe7ca05891fc4c56a33d87f0e83ccd867fcb5e7fd4033e57008
SSDEEP 96:PebOJEbYbobBngbgzTbgbkb/fbjb3brbHbnb:
TLSH
T1F22280EB4B76A462F1524FF44059798C9C23423E69E8C1F4EA14D0D312FA7E4D03EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\AlternateServices.bin
Size 13KB
SHA256 7fe50fae2986130fbcf103f3bcaf607b99432752e917fafaa9ed342031b70bf5
MD5 ef8381eaa96e439668e9a7dc406a6ce6
SHA1 34c92f98d4e9e1523c8c6617e5b976c3c74bc2f6
SHA512 ba6239feb5d681348d9bfc3358a2f05766d3df04cac11db0d495c9e1e7789ac7817475c5368fe2598037a7c15a1982b07835075b2b8ff613a2e29cdfd80fc9ff
SSDEEP 96:PebOJUbZbNbBmgbgzab9bxbZb9bZblb5bBbqebVKUbApebvpf+UbQETbXEbENb:FuPUg
TLSH
T1795261EB0B75A471F1A36FF4409D399C9823422958E5C1F4EA14C0D752FA7E8903EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a472cd8daec3db53f20aa503feaf16a8c0fdf58937565c6a90ac388834c6cebb
MD5 41c957f0fb4eacfa86a3978cd231115d
SHA1 445f4f16edd64af8a7e70fdd5dff20783780479d
SHA512 77971a9c9467313dad75c28af848417b0772b6b060a90c4b01e052c592ac672d3ea6610076a44dfe93f5ff5877f0b002c2523b0c95c0b9d62665c5c60ed6f778
SSDEEP 192:gOv5zbowb8Fyjeh4p1d66JozGzgCl6mc0dz:Lbowb8FyjPd66JozGzgC1jd
TLSH
T125D13EA5E628463FC414127BCCA12F010F39385BD88E3F1935DC658C2D5B29E768D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0c145e2d08331a2b9091ac5e5b8517f355a53506255bb4b05675d5126e4ca817
MD5 5f4b4ab3235ce076279e005ada03e1e0
SHA1 88ca71f2d7e2c78e91f602cfd93db69f457b2cd0
SHA512 2f72e8a4c8bc72836e8497ae14fc7f22037fee89908ae5f784a345460dacc7795d85382e126658b5dc19b7c6031f2e17790df282fe394bbf5e9f4f803d19ca95
SSDEEP 192:bOv5zboPbWZ8Fyjeh4p1d66JozGzgCl6mc0dz:EboCZ8FyjPd66JozGzgC1jd
TLSH
T124E12EA5E628863FC414127BCDA12F410F39388AD88E3F19359C659C2D572DE76CE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8f9c6d03f47f396bd7c093d1dea405cc58a41392702c0c75c3d8b8425c665123
MD5 53cf68147e80add319f34603c327fccd
SHA1 0486e254472ea85d961a12de8ccde7db0dca9539
SHA512 36308775d1a82aaaf7444d2328220bd2447dc40e477217abb540c0a0c992b68a24ce5a91f1b3fae436fb4caa3359dd89bdf6a0e579282e4bfc2b8773444eb002
SSDEEP 192:Ijh1d66JozGzgCl6mc0d1Ov5zboPbF8Fyjeh:Kd66JozGzgC1jAbo58Fyj
TLSH
T139F12CA4E628863FC414127BCDA12F410F39388AD88E3F1935AC659C2D5B2DE76CE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0a2eac1eeb5358fea2f067fd1cfb4097a7f36138949ce74e754ad43b59fdc263
MD5 530dd8cd5c6ac292016b6c2c810e8e71
SHA1 756abfe8a6b6785880f195b5ba8c76790ce02668
SHA512 161ab9b9f3d618892edb05cff4fc9b30e38e37acd06d1bc7cc4edadff019e532ecac747f6b544569955c99ee89a46efdd15c85362519c2bc36fe9973fbd8b82e
TLSH
T19B11579C39B84D7AD88BE39CB445028E67558E1608871D834D43EE8DCDD5ADE322D438
MD5 SHA1 SHA512 TLSH

Submit Download

0387223a-73ab-4fb6-84e5-00c3792a957f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\0387223a-73ab-4fb6-84e5-00c3792a957f
Size 16KB
SHA256 fd4573871f3dd78da64b0682f0f5be417973a2ceae4a99fcdb653172507b3086
MD5 897cc61c1107563014b020c697590b28
SHA1 c91b15e7fc8bdf7eae0d1382f7780c9d7a931e41
SHA512 9737d8b4ef5d81a13f2cb486f9553c089d7af2065f8350892a25b3b9ff1541721fe7ec85c5b674f32b83b3958863c1f21c7571b59d46a77380d9b5d9bff4b8ba
SSDEEP 192:CSadLfv9JsBr18V5uzxedKii+EN9dPWjMLC8AnfKsenuYy183Nh1ENwyD6Li1zHj:K3rsK0ledKii+e99Wj/NjzK5AlUb4
TLSH
T19C72EA56686049BA8351E3A894FCBFC3E6F528CF4C025FC997E4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d5eca76-f146-428c-8b36-16989b1ac452

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\4d5eca76-f146-428c-8b36-16989b1ac452
Size 886B
SHA256 a61f2d4c82421a6b4e9c6705aa412f0638e7b4afe01ea50f98bfd06d5f662ec4
MD5 f732d87d58fdbabbb08638aab7a6c67e
SHA1 836f704e40793cdc56032b90988de347681fde85
SHA512 35236c56004ad0f97a56bb2dc188a2e9dc1f816b87d1ff7ab5208277e41102d4d98fc2c04856dcf021076f716ff56100359c113bb61c22f8902989fa57eefc91
TLSH
T12B110092962079B28D7892ABD5907B4287E43013C0CB09187EA59B1C0DA711EA3EF707
MD5 SHA1 SHA512 TLSH

Submit Download

7e0b4594-e385-41d7-9b41-594180fb9934

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\7e0b4594-e385-41d7-9b41-594180fb9934
Size 2KB
SHA256 da098bee3ebcfafb921d4ae361d6b2d457d5f5bd302edcf1eb9069d9b76354e3
MD5 c35984498cd828135aa7e87e1f760fc4
SHA1 c53b7487f2aa112837dad43a549cf6b46152f510
SHA512 f1054da834206c49c9702de26fead3b8b20e0efad025e868cbc2cd34243eb0e40e8affb3b3bdbc92ac428351b6ab886fe46bb3be7ed1e239a6f1825b2beef6e9
TLSH
T1B541426C35B88D7A9D9AF19DD482374E53A04A0740C719432E51DF0CCCD67DA73AA52A
MD5 SHA1 SHA512 TLSH

Submit Download

89f06727-4137-41af-8519-970fdb87f4fb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\89f06727-4137-41af-8519-970fdb87f4fb
Size 883B
SHA256 aa718a49ddabc06675ca5ae4428fd8188f139ceadde948cb2ef53854814f92ef
MD5 c6b6056e733f572dcfeb7cbe36a4cfaf
SHA1 2f71ae4ebe835dca1c6a254ba8b043f3398bfdd5
SHA512 d72a0886b499f951d65cb3ec2f7ad95f0c6539f446fb06c95a0bcabe529e7ad15b990b89bab7958ec6160ba20c01df456e37e30fb05e3384fa5d7d802b6cce89
TLSH
T1761100C1E23079B2CD6CD25B86957B0647E87513C0C705247F754F180D7B21FA3AA60B
MD5 SHA1 SHA512 TLSH

Submit Download

9778443c-4f27-4afe-b406-4cb961c20f81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\9778443c-4f27-4afe-b406-4cb961c20f81
Size 235B
SHA256 3d38f1d93142582531268e0cb284950cbfaf48dbdbce0b1b3cea0d34843a4da8
MD5 aefda1fe20f6b6a60ecd9a19e765af9d
SHA1 fb0bbba5ba024bc161c26f7b4112e70d49a68da7
SHA512 66d90a7c8e7d7e5d1a5caa658c3ef44727308c215e9b6a892377ccf6a67cc993c729211995d176f8655e4f03bc8e0dab6c7a792af3e8e4ad6782d6d16c7de64d
TLSH
T19FD0979014982B6C48080F03F0F2ACD230948C335474A82089A159B8C9BAED892A2826
MD5 SHA1 SHA512 TLSH

Submit Download

b5784401-ed18-4390-90df-df36259baf4b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\b5784401-ed18-4390-90df-df36259baf4b
Size 235B
SHA256 0188214ecf5aba20c50ccbc38fd61674eb74c80bd0690aad60559b020c94c912
MD5 e2e77a39a10b19e3f9c6080e34a489f1
SHA1 5244fa1a21c67d0feb317ba47441f0988b2e006b
SHA512 05c8eb545831fb5fc1db402a1dd6d39923a93a58702f8e160877900070e92022df45ca1b5765c0917b19d9e3119cb60acda02e297e5904aeb5d51d6919c09a89
TLSH
T1A0D097C41498A77D0C200F13B0E068C6328C8C3314686820866150B89ABEED8431380B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 6KB
SHA256 1a0406a5054350a635655f69d6d317422a3f25967c0aad3c5c058dbe1e7253ea
MD5 d38711d24e6da9ec0f9b99a87cec5c85
SHA1 9beee956f546af93d9faae3d161649dfd4a503d3
SHA512 08c73e4cb2a2b41031ea398141e2decd0ff31d85f02e2897fd66e59a1c2dae9f72d76a5281b3ae7dddb1b7c83d4731dabd923fe68ff0bef4dce40da4fa2e3ad5
SSDEEP 96:xHJsUTU9qGqvfCltux1zSqSSl8pdv9j/nq3RHKG924Bw88n8L4cnA8b1:MwRvfCltI/SSGK9KItBw88ap
TLSH
T18EE1107890088B7F74B6776CAC6889716AB2013BB7BF68D750B644C5014CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 6KB
SHA256 cce853057faee7df924b47729f8b39567ce10de64d1801f826ed734d5f0512e7
MD5 fc2e1f7c331c409648373326cf631547
SHA1 22c20cca4c623a02e794820d1f2442bb8931f6cc
SHA512 13d2d9f4b43c6b4fcd51d0550e7ac2fc6a0947640634865ece9e86047b4f32d41478128c7ed666fd794b7f96638649974a8165f1e05dbb7fa5f348c91ad253de
SSDEEP 96:xHJsUTU9qGqvfCltuxObzSqSSl8pdv9j/nq3RHKG924Bw8On8L4cnAOAGS:MwRvfCltIsSSGK9KItBw8OL
TLSH
T168E10F7891088B7F78B6776CAC6889715AB2013B7BBF68D750B644C4014CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 a1d22e90e814653dca5998e6e8e8a13f3078db02c6a9b2161cf9eed08857d544
MD5 4afbe0fbbd6c8e1181118926a88cc9d2
SHA1 30680d5b78c7e8d50f463f5ddc83f14c7de9050b
SHA512 57798db27ab04a578f6bf59eb5aea1f154bc1089bb4821b0bc8e11c3bca31623c492e808a28601961a0e3c795a37a4da8fa91972c60155939a5ada34784f4b09
SSDEEP 96:xHJsUTU9qGqvfClKjwnj21zSpsF2SSl8pdv9j/nq3RHKG924Bw88n8L4cnA8b1:MwRvfCl36osF2SSGK9KItBw88ap
TLSH
T1FEE11F7891088B7F74B6776CAC6889316AB2013BB7BF68D750BA44C5010CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3cb2a679-b47d-429c-ac2b-5d297e00f495}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\default\https+++www.youtube.com\cache\morgue\149\{3cb2a679-b47d-429c-ac2b-5d297e00f495}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
TLSH
T113C0225846A8EE3620A3CB3CC827E2820A3B831000498484E6F94A540C8BE850129A01
MD5 SHA1 SHA512 TLSH

Submit Download

4084244320yCt7-%iCd7b%-fp3r4e6f.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\default\https+++www.youtube.com\idb\4084244320yCt7-%iCd7b%-fp3r4e6f.sqlite
Size 48KB
SHA256 cef6fa68616775535d17c00cf0fadf8accc1e77d78876b3566f21ebf890c6a88
MD5 b4af8af8cca78d30bedaffa8247699b7
SHA1 7cb202004c3c779316d4b9f7a6e34accc4c025c2
SHA512 8b857ab10579c0e7ee6caa6878d569281579fea3b0e4fbdd95c5edc8ccf4cc2a167c7f07d3733a218f669b34c6c1660e98197935ffb980220a27d77015f03de0
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEoGS:Oa16S6CKnqlizbxV+2xVeU7X2B0bS
TLSH
T1DD236E8E3F07E511C53AF0B178A08D52BC5E321D17222AD57990DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus.bat

Path C:\Users\Admin\Desktop\virus.bat
Size 30B
SHA256 7146b147f6b5ff1cf5a714566ffafdae5174e7b0dc6321f360f28e15e4b58c79
MD5 9457b8bd58d0e0693816a4efb09fd98b
SHA1 087011d0ad52f770148d98f08df7d0611762ac36
SHA512 efc82b62b807004f020e8b41ba0f6b38096fe55ea23b7c8ad78d5d684ead5e8e8832b1626e5433e7b2c55b622d2171672933d2480cb51e534c831a110dda2f11
MD5 SHA1 SHA512

Submit Download

memory/5044-2-0x000001BF66590000-0x000001BF66800000-memory.dmp

Download

memory/5044-12-0x000001BF66590000-0x000001BF66800000-memory.dmp

Download

memory/5044-11-0x000001BF66570000-0x000001BF66571000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads