4f397363f496b4ba08ede6e5c96564800019d8b8c9f5453e17849caf098dde49

Analysis

user interaction
yes
max time kernel
76s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[iTorrent]Pokoli_szomszedok_1_7_HUN (1).torrent
Size 9KB
Sample260525-wv15dset2k
SHA256 4f397363f496b4ba08ede6e5c96564800019d8b8c9f5453e17849caf098dde49
MD5 f6cc39c8427ddfe4dd7758402a8e7dba
SHA1 de3e33cde27170878279d998dd513f0f755f7402
SHA512 66adfd4a588c1c5c55dcfebd241812d978320e36b55ce0c06850c29750511cf75fc08437376815472ade793a887122faa98a7491987a55076773abcc0e20695f
SSDEEP 192:lqKunqsnCE8nKBx1R7WPX+mZv4Lko8iZl2QsJivBZpHRO6a/L:ltuVnGYv7gumyLei/sJivfpHRVeL
TLSH
T17C227ED50E3C0499BF3EC7828D5A38A38434E26F6E42DEDEB6B7ED8D4C35B051568881
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.torrent	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\torrent_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\torrent_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\torrent_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\torrent_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.torrent\ = "torrent_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\torrent_auto_file\shell\open\command	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4316	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	firefox.exe
Token: SeDebugPrivilege	1416	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1416	firefox.exe
1416	firefox.exe
1416	firefox.exe
1416	firefox.exe
1416	firefox.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
4316	OpenWith.exe
1416	firefox.exe
1416	firefox.exe
1416	firefox.exe
1416	firefox.exe
1416	firefox.exe
1416	firefox.exe
1416	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 2684	4316	OpenWith.exe	103
PID 2684 wrote to memory of 1416	2684	firefox.exe	105
PID 2684 wrote to memory of 1416	2684	firefox.exe	105
PID 1416 wrote to memory of 4268	1416	firefox.exe	107
PID 1416 wrote to memory of 4268	1416	firefox.exe	107
PID 1416 wrote to memory of 4268	1416	firefox.exe	107
PID 1416 wrote to memory of 1344	1416	firefox.exe	108
PID 1416 wrote to memory of 1344	1416	firefox.exe	108
PID 1416 wrote to memory of 1344	1416	firefox.exe	108
PID 1416 wrote to memory of 1344	1416	firefox.exe	108
PID 1416 wrote to memory of 2692	1416	firefox.exe	109
PID 1416 wrote to memory of 2692	1416	firefox.exe	109
PID 1416 wrote to memory of 2692	1416	firefox.exe	109
PID 1416 wrote to memory of 2692	1416	firefox.exe	109
PID 1416 wrote to memory of 4544	1416	firefox.exe	110
PID 1416 wrote to memory of 4544	1416	firefox.exe	110
PID 1416 wrote to memory of 4544	1416	firefox.exe	110
PID 1416 wrote to memory of 2848	1416	firefox.exe	111
PID 1416 wrote to memory of 2848	1416	firefox.exe	111
PID 1416 wrote to memory of 2848	1416	firefox.exe	111
PID 1416 wrote to memory of 2848	1416	firefox.exe	111
PID 1416 wrote to memory of 6132	1416	firefox.exe	112
PID 1416 wrote to memory of 6132	1416	firefox.exe	112
PID 1416 wrote to memory of 6132	1416	firefox.exe	112
PID 1416 wrote to memory of 6132	1416	firefox.exe	112
PID 1416 wrote to memory of 2468	1416	firefox.exe	113
PID 1416 wrote to memory of 2468	1416	firefox.exe	113
PID 1416 wrote to memory of 2468	1416	firefox.exe	113
PID 1416 wrote to memory of 2468	1416	firefox.exe	113
PID 1416 wrote to memory of 1016	1416	firefox.exe	114
PID 1416 wrote to memory of 1016	1416	firefox.exe	114
PID 1416 wrote to memory of 1016	1416	firefox.exe	114
PID 1416 wrote to memory of 1016	1416	firefox.exe	114
PID 1416 wrote to memory of 5148	1416	firefox.exe	115
PID 1416 wrote to memory of 5148	1416	firefox.exe	115
PID 1416 wrote to memory of 5148	1416	firefox.exe	115
PID 1416 wrote to memory of 5148	1416	firefox.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\[iTorrent]Pokoli_szomszedok_1_7_HUN (1).torrent"
1⤵
- Modifies registry class
PID:4312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\[iTorrent]Pokoli_szomszedok_1_7_HUN (1).torrent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\[iTorrent]Pokoli_szomszedok_1_7_HUN (1).torrent"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {63e4b64a-8a4d-4528-b58b-5c71826319d7} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {cbde64bb-508f-4c50-a54b-c7e9849d6e0a} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3908 -prefsLen 27276 -prefMapHandle 3912 -prefMapSize 270279 -jsInitHandle 3916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3924 -initialChannelId {d59cb42a-9886-4fc1-9335-25f5430a13a0} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2692
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27276 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {5503f934-11f9-4257-9080-498c8f583c3b} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4544
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2728 -prefsLen 34775 -prefMapHandle 3080 -prefMapSize 270279 -jsInitHandle 3084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2752 -initialChannelId {1fc42e9e-f705-450b-bc60-927514942994} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3412 -prefsLen 35012 -prefMapHandle 3408 -prefMapSize 270279 -ipcHandle 2672 -initialChannelId {7d052b0a-aefd-4791-8691-dca344f0773b} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5136 -prefsLen 32900 -prefMapHandle 5140 -prefMapSize 270279 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5152 -initialChannelId {ac903c6a-ca80-42ff-b10d-fb4108f4b3ab} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 32952 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {8750171b-acce-42cc-a161-190bc45162f7} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {6a5a1a42-0809-4110-8109-e1dbdd145e0a} -parentPid 1416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5148

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 91e37dc6e1a39d2a1ddf3ecfd438516d5e8905a1f8ab412fed09e246b7c81a80
MD5 2c635311532ab18c7fee1c9f98036650
SHA1 34695ab4e2da1bbbc6a2a95474f103af2d7afab6
SHA512 24504d06bfb64bf04d19bcfddbc0b1a08dcd82b04761da51d045d30eb061b4cf264e6a6e07bf49a25276f50ca7c4cfcf63875dc00bf4ac55d9a5e2d7261e3e35
SSDEEP 192:g1d66JozGzgCl6mc0dKQcOv5zboPkxLpyjO1FAg:ad66JozGzgC1jpboMNpyjG3
TLSH
T16DF10D64E628463FC408027BDCA11B414F39389AA84E3F2935ADB41D2C9B6DE778E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2444d99f6af2c2c70a6fea7fe4af9888b427daf2955c10cf2de4fcf30e947b97
MD5 12f1c4fba54645dd784e381dca27d99d
SHA1 08a3ed03e1a38fc63e24bb005588348c7739325a
SHA512 dae62df8c93f5975f8f11d39c59a7d115e5f27531bb95e671ab180ff7239d481462a669d1e77b8bf8614e60f7b1f025ddec1299058f8b99741cc567eb5ccb14c
SSDEEP 192:OQcOv5zboHbxLpyjO4r1d66JozGzgCl6mc0dz:TboHbNpyjRd66JozGzgC1jd
TLSH
T172D1DB24F629463BC448023BDCA61B414F36355BA84E3F2931ECB40D2C9B6DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9d54e59104fe58ca4109643f372daa35d97bba96562b79e7c2f617827d45a169
MD5 518b5a5b11a42f0d18955a1e701ff233
SHA1 1e7d97ce09a41a41be3c80e8fda9e55a26086479
SHA512 a9192c383d1baf10ae30c369d60f1f9e28aea2a27af854cd7dc179f751d954d83e1302b1b68cc446488fb8ffa3d66c91ed037ada2c119e501c9adb4ce66fa3bd
SSDEEP 192:I1d66JozGzgCl6mc0dqQcOv5zboPSZxLpyjO1FAg:id66JozGzgC1j9boaZNpyjG3
TLSH
T102E10D64E628463FC408027BDCA11B414F39399A984E3F2935ADB41D2C8B6DE778E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5dea1d22fae2427b1448e5a6d9e58377ce1548183b1110b96687c613fa940ed8
MD5 c796ab298b7b553a81293b4b1a42d478
SHA1 59e60fc607ed20e2766ce109654e97b605d097c2
SHA512 8934d8b192c2cb782dc74f7805203e7448388c58c3ce5efaede35599ddba46b19e7878ac48fb2394a3f0801f83baa0d309d813b4280593713619a5bf229d3540
TLSH
T1A2216B5C3ABC8D2A6CD7E2AC7841028E5B998E0724871C474D03DF8DCDD5AD9326E47D
MD5 SHA1 SHA512 TLSH

Submit Download

07eb439d-7590-4e9e-8a4d-adcd6de82063

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\07eb439d-7590-4e9e-8a4d-adcd6de82063
Size 235B
SHA256 51e1871b44135f4af3d3b9f00a1704a8ae8c0bf580c043cd4d2cc3f497aaffac
MD5 a587a83021083a5557ab41064017289b
SHA1 3b24f8351fa8155b0f15a67e68f6cd0c83fff225
SHA512 3dd8203d11fddca78b27f6b1f3c4aedad5e96d476936eb1a485ccd1717c054406846f1ccedc7424ad7d0ea06edc8db988d56bbe00e38a4794b8746fe997653b8
TLSH
T1B6D097C028986B2E48240F0BB0B0BDC63095CC3374B0D850895240BCD9BCAC8416286B
MD5 SHA1 SHA512 TLSH

Submit Download

0c141f7a-198e-4f4d-8c19-dc914f57f085

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\0c141f7a-198e-4f4d-8c19-dc914f57f085
Size 883B
SHA256 8e2c03fab0a9ad8c744f28f44e79f44e1faa88dacd59133ed81f7bb2d942004e
MD5 0c5ded1a077f06928bce9cd18fd9b735
SHA1 4f63785a34426a847f3bd7b5628c33f7f98ca63e
SHA512 149fdf143618c192d8b253685f173fefc04419f4cd5b45d63ed3d753b9176d6454a1ea5766b1c2ae49ad990accccaf481f5ee7659f5835907a57350368d73a3d
TLSH
T149110081963575B28D6CD28FC6613706CBF4761380CA44242CA29D180CBE92F836A20B
MD5 SHA1 SHA512 TLSH

Submit Download

ba29bc36-37c4-41f1-99c6-c9b6197c6f6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\ba29bc36-37c4-41f1-99c6-c9b6197c6f6a
Size 734B
SHA256 73c42b0cb88e620d1ee67080b0eb6fb09499c84428212aafb237457374f53c63
MD5 59bf1bd30a874d5601b8a9da6cd70f4a
SHA1 13b7bedc1bb0037ffc4c796b40330bcc40a10f94
SHA512 d5c16e4b8108dec08e5d5f7685bf35ae13079af1e3b574ec84ad890e959c8235ab6c91882e6d41a319f202c76f75a8cf7df9b3ac8aaf955dbaab005decb1b002
TLSH
T19E0115D25121B4638CB8E34DCA69771ACBF4A03280C604057EB495244EFB07F825170B
MD5 SHA1 SHA512 TLSH

Submit Download

d5288be8-23b3-48e6-8d3b-498823b3ddc0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\d5288be8-23b3-48e6-8d3b-498823b3ddc0
Size 235B
SHA256 86b4987eec48414982a35209dfb90631ccbb18f254a12f4bb8e18594662f95b7
MD5 2a11e3f3deb4a3abac36595b998c72e6
SHA1 141de57d54edc83a76703a63d24145aba0372a3a
SHA512 5ddd278cbcf352155e10640ee737f1578ae85e9f1eb0bcbc5cb7bd2d6e65363b8a6e6a682995a55a8601730fcb44511ec0dcf2d74a6d8d2a8c68a5902e63dbcd
TLSH
T13ED09780B4E8272E0C104F0BB0A029CA30C88C33A0729852DA9209B4AEB89D86261917
MD5 SHA1 SHA512 TLSH

Submit Download

d74763cd-8d29-4fed-8e7a-1784d98270ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\d74763cd-8d29-4fed-8e7a-1784d98270ef
Size 16KB
SHA256 b474c08114b3529b0eef0f125e528bfa2a5b159ca1d397bb8f06f5757dfff223
MD5 0bf5065b2708d2bb7aef0df0e9422a17
SHA1 fe249e2b29dd3a30b4259f4cfcf5139069038c23
SHA512 a44c6c91a41a1227696664f15da6f8737e99835b904f84d83424500b8482767a62fd53b520a4daa29901af22d785298dc86ff5cdc1d6fe58ac9a2bc20603ef50
SSDEEP 192:gFJsFL1gOB8meNWRrdTzrKjuAeQ670SRcKzheSfG+DazvdHrBGiKr6aLXi2FXsha:gSKOekrd/rKyY670SRcKFeUazZzampi
TLSH
T10272D916283045BAC651E3A8D4F8BFC3E5F528CB4C419FCA9BE4BD086DDE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2a5821d-6d20-4a72-9e74-2186b3a74d19

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\f2a5821d-6d20-4a72-9e74-2186b3a74d19
Size 886B
SHA256 5394ccb41e8e2e9d5fe32fc4480faf04485190f4439b05a426dd3a97c2de3f1f
MD5 1e618537aad35ab7f54cf8d790f67308
SHA1 7800939be2f664726966850e64ed136ac61daf71
SHA512 aba184756ffb760800ca0f91cc3709848ba79c8d343c17a3bd35a25fe8b9e45e72719a9216f0944b8c53d842302918e142aa486ef961a3662d52c3a330f7d830
TLSH
T1441127819734F4728C68D2CB95A1B742CFF43123C0C949243D51DA194DEF52E93AA70B
MD5 SHA1 SHA512 TLSH

Submit Download

feee337d-a2bc-43f7-8aa4-eb0c64dc03e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\feee337d-a2bc-43f7-8aa4-eb0c64dc03e0
Size 2KB
SHA256 21c5bf946093d4776927d849168fcfa0f8cf6d2f7259706aa8b3ec94a0c8e236
MD5 1dec04fd39b5dba52f707938f2642066
SHA1 83facd73367946221e3685bc51b18b84db974fa4
SHA512 fc9ca9547bb0f1366e4f47c506b51dd031618f8a3c7e48b788f4d0cc8bb5fef4f07ab3372ffa102e9b8aa061e541701ce400af348c44c57b7ac7b10f2b7d3289
TLSH
T18B41545835788CB78CAAE58DD0B2338D53B44A0344C61C436D62EF0DDC9A69A336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 23efc01c45f1fa85411bf25cfcb4a41530b2b18f79a9565de4d87a59a58fc633
MD5 13b38a0a6319d31fa41c423fbdf1d41c
SHA1 9ff5eb0771811f2e7cfa9d33391194e50ccf1b57
SHA512 f265cf7f0ac8277d63104a4a1c0b338088307e9b9c73c48145fcd976ae5b1010accb64fb0e3dce8cc2943651f2bbc40635a4648be2c897dced6ee4a926673f5a
SSDEEP 96:xHi+UTUHqGqgaf0Pe1zSF7SSlmdv9j4nuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0PeU7SSM5lfWTBw88qV
TLSH
T157E11E7894088B7F74B676ACBC688C716AB2013BB7BF68D750B55485014CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 f13cff6ca35ffdf69f76d8c3d8804612dba9334cb99b33b3d7dbb3d5e14a8d39
MD5 d20276ad307092ea2ae22f10dbbcc0dc
SHA1 13af4f8d8f99c2e48af98e7b81922fb6e7f83069
SHA512 ae8188f55adb659ff4e71728defdcaada4200d8fffa7c7be7c73eebe7b28e68ecb6b8c958b015085565c825901e35ec200958ffeaf40332b55e4163d8d24d00f
SSDEEP 96:xHi+UTUHqGqgaf0io1zSbSSlmdv9jGwnnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ioWSSIA5lfWTBw88qV
TLSH
T165E12F7894088F7F74B677ACAC688871AAB2013B7BBF68D750B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads