be136369c67c55e6ee3505c41b5b4f33bd3b8648f7168046fb5729cff2a15900

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
beta_blocker_v2.pyc
Size 648KB
Sample260508-3wc8aafx2w
SHA256 be136369c67c55e6ee3505c41b5b4f33bd3b8648f7168046fb5729cff2a15900
MD5 9414bb1ea72bbb977516fb7286ab6fa4
SHA1 6b80ea2197ee95465e7164e7256cef78e64e89f4
SHA512 885dd2e95ed373e355527f13d23fa07d935db619aadcd57422a1c8966e08ebda76c910e4bebf9dba508b53980391aad8da6ae2fb974f0ba6aa5de4adf82a8722
SSDEEP 12288:w/nvGYkdlvEAGzUvZxFMUCvYJUEz/vp1xMCKsU:tOAGzawgMCKsU
TLSH
T151E44B8AB9324D67FD66F275214A0350E639731A5394CE22703FE379BF492CD2DA128D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1616	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2700	OpenWith.exe
5048	OpenWith.exe
1616	vlc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	firefox.exe
Token: SeDebugPrivilege	2344	firefox.exe
Token: SeDebugPrivilege	2344	firefox.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
1616	vlc.exe
1616	vlc.exe
1616	vlc.exe
1616	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1616	vlc.exe
1616	vlc.exe
1616	vlc.exe

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2700	OpenWith.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
5048	OpenWith.exe
5048	OpenWith.exe
5048	OpenWith.exe
5048	OpenWith.exe
5048	OpenWith.exe
5048	OpenWith.exe
5048	OpenWith.exe
5048	OpenWith.exe
5048	OpenWith.exe
1616	vlc.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 1496	2700	OpenWith.exe	87
PID 1496 wrote to memory of 2344	1496	firefox.exe	89
PID 1496 wrote to memory of 2344	1496	firefox.exe	89
PID 2344 wrote to memory of 3328	2344	firefox.exe	90
PID 2344 wrote to memory of 3328	2344	firefox.exe	90
PID 2344 wrote to memory of 3328	2344	firefox.exe	90
PID 2344 wrote to memory of 1924	2344	firefox.exe	91
PID 2344 wrote to memory of 1924	2344	firefox.exe	91
PID 2344 wrote to memory of 1924	2344	firefox.exe	91
PID 2344 wrote to memory of 1924	2344	firefox.exe	91
PID 2344 wrote to memory of 312	2344	firefox.exe	92
PID 2344 wrote to memory of 312	2344	firefox.exe	92
PID 2344 wrote to memory of 312	2344	firefox.exe	92
PID 2344 wrote to memory of 312	2344	firefox.exe	92
PID 2344 wrote to memory of 5052	2344	firefox.exe	93
PID 2344 wrote to memory of 5052	2344	firefox.exe	93
PID 2344 wrote to memory of 5052	2344	firefox.exe	93
PID 2344 wrote to memory of 4808	2344	firefox.exe	94
PID 2344 wrote to memory of 4808	2344	firefox.exe	94
PID 2344 wrote to memory of 4808	2344	firefox.exe	94
PID 2344 wrote to memory of 4808	2344	firefox.exe	94
PID 2344 wrote to memory of 4644	2344	firefox.exe	95
PID 2344 wrote to memory of 4644	2344	firefox.exe	95
PID 2344 wrote to memory of 4644	2344	firefox.exe	95
PID 2344 wrote to memory of 4644	2344	firefox.exe	95
PID 2344 wrote to memory of 4480	2344	firefox.exe	96
PID 2344 wrote to memory of 4480	2344	firefox.exe	96
PID 2344 wrote to memory of 4480	2344	firefox.exe	96
PID 2344 wrote to memory of 4480	2344	firefox.exe	96
PID 2344 wrote to memory of 4148	2344	firefox.exe	97
PID 2344 wrote to memory of 4148	2344	firefox.exe	97
PID 2344 wrote to memory of 4148	2344	firefox.exe	97
PID 2344 wrote to memory of 4148	2344	firefox.exe	97
PID 2344 wrote to memory of 1056	2344	firefox.exe	98
PID 2344 wrote to memory of 1056	2344	firefox.exe	98
PID 2344 wrote to memory of 1056	2344	firefox.exe	98
PID 2344 wrote to memory of 1056	2344	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\beta_blocker_v2.pyc
1⤵
- Modifies registry class
PID:5048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\beta_blocker_v2.pyc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\beta_blocker_v2.pyc
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {94fe60bd-18db-4cfb-8d27-345286707074} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3328
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2336 -initialChannelId {d4957deb-40db-485b-8218-0dbba1804937} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 27276 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {12d2a014-375b-4727-8173-63da3ce862ca} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3876 -prefsLen 27276 -prefMapHandle 3880 -prefMapSize 270279 -ipcHandle 3948 -initialChannelId {65433e7c-5ba7-4886-8c0c-ca710b78dfec} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4388 -prefsLen 34775 -prefMapHandle 4392 -prefMapSize 270279 -jsInitHandle 4396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2796 -initialChannelId {9e07d619-8005-42fb-97e6-ab946f7e6c69} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5020 -prefsLen 34824 -prefMapHandle 5028 -prefMapSize 270279 -ipcHandle 5048 -initialChannelId {db71f9ea-bf3c-493b-9e8a-8abb6ee0fc8f} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32952 -prefMapHandle 5356 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {a2ad9af2-4ba9-497b-a308-7df5bd896a7a} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {5fe0e561-100a-4743-b113-23db45218012} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4148
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 32952 -prefMapHandle 5796 -prefMapSize 270279 -jsInitHandle 5800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {43d81dcc-fa28-486c-afa7-dd59991ccd72} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5048

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CompleteTrace.mpg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 eecc31a6b8b6a771bba434c8fe7b630334d875a983280441c605eeaddde43f37
MD5 00e52178e79945fe4995b2e260acc229
SHA1 f41fbc5c6d6c80747c787231b89f668fe6e0fd90
SHA512 90f782de9d168632d9606aa3ebc1b8a841e28a7396b837ca4e84657b308ca785dfff8c1117d2fb63ce175d033439fc14fd4e47fd8411c8457c587a7a75bf0feb
SSDEEP 768:nnSyeo81mGcmhumKYRZqMIfmsb/b4b5bYr5ExqO:nnSyeoYpmG
TLSH
T11DD20144EB2E553FD41912BBDCA50B042F78B88A59192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5c2f9af167fb48a8ec1ef336bb0d0a3fbaf12c4738f2aefda44df1f0234f9af3
MD5 b30fd0ecfe45c4eb18e0c5be9c346fb9
SHA1 dfa01374cac38b6c2fbcab2fc5c966076a686023
SHA512 29e5a1c5b35773e57a3631914f9b88a05962a908fed3662cc9eae07018ff5c9ff01b37e62d12535399fe9f353e239173b55aae12ce24661e25d16a7e96527ba8
TLSH
T155216A5C39F84DAF6DDBE29CB481028E53558E034A871C434D62DE8DCD95AEA326A439
MD5 SHA1 SHA512 TLSH

Submit Download

7b9a45c4-3f8a-4f94-9818-06c30be6599e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\7b9a45c4-3f8a-4f94-9818-06c30be6599e
Size 871B
SHA256 9e5a1dd0c1c1ab306592cd31ea7072807fabce6f21c2a7afc6bfab196927916c
MD5 8d4a051217fa0871150cc9bc6569555f
SHA1 fde843bb79cf655ea2cf3bcfbef67df7eb91ebf8
SHA512 72f0abf95d799888ec3c694e469cd5574e13a09622379a37409751fe2228a996e9121b9b52bf6245cd3ec7eb457b94b92af95afca2377466f7a9b080254d633a
TLSH
T1BA11E391C33076728D78E29BC5953B464BF47613C0DA44143E754A180D7F11EE3AE607
MD5 SHA1 SHA512 TLSH

Submit Download

7d5d02b5-67fc-4802-9b77-34faee4c11b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\7d5d02b5-67fc-4802-9b77-34faee4c11b6
Size 2KB
SHA256 d68d0e5ad3d6cd20161bdf25de03a605fd86ad6189ed2e50ee470637196e7796
MD5 3bc4fa5b553412bc9c5a99166c74bcdf
SHA1 a47128250e8395b97dd884160da58e2d8342151b
SHA512 91155cab9800f6152449332e87b1ad278823386f91cd4d3c2c101c4fcf2f9112cfd8f49bdafb7444cf2824a6d45377ecf9a93cc36825e9bc4ca5d750156e7c8f
TLSH
T15441325836785D7A9DCAF19DD0913B8E53B08A0380C71E432E91DF0C8D967DA73AE52A
MD5 SHA1 SHA512 TLSH

Submit Download

914797d6-c349-46e7-b988-2a9576cd008b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\914797d6-c349-46e7-b988-2a9576cd008b
Size 235B
SHA256 fcbd73287ffcfff223c43584e4b3ef33e6bded62e9ab1eade192777e918cf751
MD5 a9a2e2f32ab75b413e59ee80295320ce
SHA1 9d9a2193b23c384d69de897f6477499000e45788
SHA512 707e45fc24848d117a0efe57cfc8c7fb8b24c8af7a9f40cb1fffdc6c3f6cc2ab4395f6bd78e710283325c6f92f23dffffa02b59f699a2d6f5e3d7ebe64f772c5
TLSH
T184D0978424D87BAC08210F0BF0E0B8C632898C3334B0582085A040788ABBAC8011181B
MD5 SHA1 SHA512 TLSH

Submit Download

d591af6b-8cdc-4074-93e1-5905a26df70e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\d591af6b-8cdc-4074-93e1-5905a26df70e
Size 886B
SHA256 5b443a8e1e4b1fbfffe33b65767afec211ddad541d02e073b5cfec33d92928ad
MD5 db9b48d39353e3137022e960b374f625
SHA1 4cb0a2161b49c5cf91c60824a34b5ad55979ab62
SHA512 f383b1613704e6d3636483e9bdea1a000e9a7386fe11f41d71756a9ac205a75d893765d9bbc8f79d97a55674810ebe099ba1ad446ced641cb62b33eea4155d58
TLSH
T17C110092862075B28D68E29785D0774286E47623C0CA09047FE54B1C0DAB02EA36E207
MD5 SHA1 SHA512 TLSH

Submit Download

eb6d8399-bf92-4f81-b427-080940a49a73

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\eb6d8399-bf92-4f81-b427-080940a49a73
Size 235B
SHA256 e8bf370fc01d638d85632bfe84fe591f01777290908a5cc190609fc85358178d
MD5 cb486db94215df47ef97592dfeca9206
SHA1 697286295db2932596a9456e0eb5411260b3c4f4
SHA512 b02aa193b8d7c8c7783feab3cb321e45186192f3a349653f342059d673426ac1add83e4de821d3693f3136370491714e83b0439299923c7f12592131a43a1d2c
TLSH
T12ED02390688C336E082C0F8BF0F02CC630968C3710705814CBB142349DFCEC8C221D6B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 6KB
SHA256 ac3c7cad4b43448ca8309d8294d718d19f671a2fc1e4a06746f5317a5665a002
MD5 fac5a970832d37cbfc5f4766a641f255
SHA1 a522ba9606558b4411b19729bca51ba602ea0636
SHA512 66450df73e976fa767290338382bdef1975674c47e3f865e80f225d5091ec72cbe9e014e056e2399e39e55b56c2e6fe74c5dd0db2e96611de90a5470b47de593
SSDEEP 96:xHJsUTUoPqGqvfClKaObzSZvSSl8pdv9jknq3RHKG924Bw88n8L4cnAB1:M4CRvfClKaDvSSGT9KItBw88V
TLSH
T1B4E11F7891088B7F79B6776CAC6888715AB2013BB7BF68D750B544C5010CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 03485b02ca4a8bb8cc85f7a79de8914a7377925c477896fa1549df272c67c333
MD5 7a3a3c93e203eccf6bdd239c483ca7af
SHA1 468f7578d410c87fa1ca4d9c4480d175a7c3734c
SHA512 6ce946f1af5ba9d381cba60dd5cf5e251d503bc4924ce11d2dd49f4a041894b3da2c585b6087b7b52149ccea6937172ad0a05729375ecf78065fd40dde21c4de
SSDEEP 96:xHJsUTU9qGqvfClKjwnj21zSpy9ybSSl8pdv9jmLnq3RHKG924Bw88n8L4cnA8b1:MwRvfCl36oy9ybSSGP9KItBw88ap
TLSH
T111E11E7891088B7F74B6776CAC688931AAB2013BB7BF68D750BA44C5010CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 00fa76934448a36be5a6f25c6a28fa7c6f861df7f7d8b5ac9555bc918483f05d
MD5 a33173596c78b1d1aee886a68dd39ab8
SHA1 2161f630e121799a6d0b028fe0b6e3f9eefaa884
SHA512 d535b23bf01103fa4741f2eca62d8523b1278ccb2828a7c8a06847d3eefabc26631e4c4bd3bb634748857398d84a0c2cfe4543ca4c4096bd1e2735976a0b13d4
SSDEEP 96:xHJsUTU9qGqvfClKa1zSZvSSl8pdv9jmLnq3RHKG924Bw88n8L4cnA8b1:MwRvfClKasvSSGP9KItBw88ap
TLSH
T1D8E11F7891088B7F78B6776CAC6888719AB2013BB7BF68D750BA44C5010CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

pVeXcE2E.pyc.part

Path C:\Users\Admin\Downloads\pVeXcE2E.pyc.part
Size 648KB
SHA256 be136369c67c55e6ee3505c41b5b4f33bd3b8648f7168046fb5729cff2a15900
MD5 9414bb1ea72bbb977516fb7286ab6fa4
SHA1 6b80ea2197ee95465e7164e7256cef78e64e89f4
SHA512 885dd2e95ed373e355527f13d23fa07d935db619aadcd57422a1c8966e08ebda76c910e4bebf9dba508b53980391aad8da6ae2fb974f0ba6aa5de4adf82a8722
SSDEEP 12288:w/nvGYkdlvEAGzUvZxFMUCvYJUEz/vp1xMCKsU:tOAGzawgMCKsU
TLSH
T151E44B8AB9324D67FD66F275214A0350E639731A5394CE22703FE379BF492CD2DA128D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1616-425-0x00007FF6880B0000-0x00007FF6881A8000-memory.dmp

Download

memory/1616-427-0x00007FFB1BA00000-0x00007FFB1BCB6000-memory.dmp

Download

memory/1616-428-0x0000023EE81E0000-0x0000023EE81EC000-memory.dmp

Download

memory/1616-426-0x00007FFB293D0000-0x00007FFB29404000-memory.dmp

Download

memory/2700-2-0x000001DA51810000-0x000001DA51F4F000-memory.dmp

Download

memory/2700-0-0x000001DA51810000-0x000001DA51F4F000-memory.dmp

Download

memory/5048-344-0x000002025F000000-0x000002025F73F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads