xworm | 8ac1b7a926bb396cee28bc1fa36f91bf7687c19be5a9a304451efb16a06ce3dd

Analysis

user interaction
yes
max time kernel
171s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/06/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Size 1.1MB
Sample260603-aleddagy6n
SHA256 8ac1b7a926bb396cee28bc1fa36f91bf7687c19be5a9a304451efb16a06ce3dd
MD5 2db88307df49ac83295d7ff1f5d73155
SHA1 fe0324ef14be2780ac4779ce4bac80bdb35b2fb0
SHA512 26e5dba220ff09208416723662baab725a387dd9a9d20e692d47f8bbed45c7dc392a821a6b75030c43b130ee7cf2e63ceb2ae61e278ef37fdb2c91cccab44be2
SSDEEP 24576:DqGgNaxAgQ9iSYlQgaef2UJl1ooYBGIn3OOIdMJlwuAs:DqGgNR3gSYl81CYQa3iowuA
TLSH
T11D351249B6A54F01D28C19B1C097453887D2AA4A637BF39E3FB412F96D423B8DD4D3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm persistence rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3960-13-0x0000000000400000-0x0000000000420000-memory.dmp	family_xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VersionUpdate.lnk	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VersionUpdate.lnk	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe

Executes dropped EXE 2 IoCs

pid	Process
4792	VersionUpdate.exe
3680	VersionUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VersionUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\VersionUpdate.exe"	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2976 set thread context of 3960	2976	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	94
PID 4592 set thread context of 1620	4592	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	106
PID 4792 set thread context of 3680	4792	VersionUpdate.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VersionUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VersionUpdate.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 54 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Token: SeDebugPrivilege	4592	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Token: SeDebugPrivilege	3960	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Token: SeDebugPrivilege	4792	VersionUpdate.exe
Token: SeDebugPrivilege	1620	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
Token: SeDebugPrivilege	3680	VersionUpdate.exe
Token: SeDebugPrivilege	2072	firefox.exe
Token: SeDebugPrivilege	2072	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe
Token: SeDebugPrivilege	5128	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe
2072	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2072	firefox.exe
5128	firefox.exe
5128	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3960	2976	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	94
PID 2976 wrote to memory of 3960	2976	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	94
PID 2976 wrote to memory of 3960	2976	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	94
PID 2976 wrote to memory of 3960	2976	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	94
PID 2976 wrote to memory of 3960	2976	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	94
PID 4592 wrote to memory of 1620	4592	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	106
PID 4592 wrote to memory of 1620	4592	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	106
PID 4592 wrote to memory of 1620	4592	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	106
PID 4592 wrote to memory of 1620	4592	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	106
PID 4592 wrote to memory of 1620	4592	QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe	106
PID 4792 wrote to memory of 3680	4792	VersionUpdate.exe	110
PID 4792 wrote to memory of 3680	4792	VersionUpdate.exe	110
PID 4792 wrote to memory of 3680	4792	VersionUpdate.exe	110
PID 4792 wrote to memory of 3680	4792	VersionUpdate.exe	110
PID 4792 wrote to memory of 3680	4792	VersionUpdate.exe	110
PID 4196 wrote to memory of 2072	4196	firefox.exe	112
PID 4196 wrote to memory of 2072	4196	firefox.exe	112
PID 2072 wrote to memory of 5112	2072	firefox.exe	113
PID 2072 wrote to memory of 5112	2072	firefox.exe	113
PID 2072 wrote to memory of 5112	2072	firefox.exe	113
PID 2072 wrote to memory of 5016	2072	firefox.exe	114
PID 2072 wrote to memory of 5016	2072	firefox.exe	114
PID 2072 wrote to memory of 5016	2072	firefox.exe	114
PID 2072 wrote to memory of 5016	2072	firefox.exe	114
PID 2072 wrote to memory of 1664	2072	firefox.exe	116
PID 2072 wrote to memory of 1664	2072	firefox.exe	116
PID 2072 wrote to memory of 1664	2072	firefox.exe	116
PID 2072 wrote to memory of 1664	2072	firefox.exe	116
PID 2072 wrote to memory of 3116	2072	firefox.exe	117
PID 2072 wrote to memory of 3116	2072	firefox.exe	117
PID 2072 wrote to memory of 3116	2072	firefox.exe	117
PID 2072 wrote to memory of 3256	2072	firefox.exe	118
PID 2072 wrote to memory of 3256	2072	firefox.exe	118
PID 2072 wrote to memory of 3256	2072	firefox.exe	118
PID 2072 wrote to memory of 3256	2072	firefox.exe	118
PID 2072 wrote to memory of 5908	2072	firefox.exe	119
PID 2072 wrote to memory of 5908	2072	firefox.exe	119
PID 2072 wrote to memory of 5908	2072	firefox.exe	119
PID 2072 wrote to memory of 5908	2072	firefox.exe	119
PID 2072 wrote to memory of 5996	2072	firefox.exe	120
PID 2072 wrote to memory of 5996	2072	firefox.exe	120
PID 2072 wrote to memory of 5996	2072	firefox.exe	120
PID 2072 wrote to memory of 5996	2072	firefox.exe	120
PID 2072 wrote to memory of 6032	2072	firefox.exe	121
PID 2072 wrote to memory of 6032	2072	firefox.exe	121
PID 2072 wrote to memory of 6032	2072	firefox.exe	121
PID 2072 wrote to memory of 6032	2072	firefox.exe	121
PID 2072 wrote to memory of 6040	2072	firefox.exe	122
PID 2072 wrote to memory of 6040	2072	firefox.exe	122
PID 2072 wrote to memory of 6040	2072	firefox.exe	122
PID 2072 wrote to memory of 6040	2072	firefox.exe	122
PID 2072 wrote to memory of 5544	2072	firefox.exe	123
PID 2072 wrote to memory of 5544	2072	firefox.exe	123
PID 2072 wrote to memory of 5544	2072	firefox.exe	123
PID 2072 wrote to memory of 5544	2072	firefox.exe	123
PID 2072 wrote to memory of 6004	2072	firefox.exe	124
PID 2072 wrote to memory of 6004	2072	firefox.exe	124
PID 2072 wrote to memory of 6004	2072	firefox.exe	124
PID 2072 wrote to memory of 6004	2072	firefox.exe	124
PID 2072 wrote to memory of 5128	2072	firefox.exe	125
PID 2072 wrote to memory of 1508	2072	firefox.exe	126
PID 2072 wrote to memory of 1508	2072	firefox.exe	126
PID 2072 wrote to memory of 1508	2072	firefox.exe	126
PID 2072 wrote to memory of 1508	2072	firefox.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3376

C:\Users\Admin\AppData\Local\Temp\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe
  "C:\Users\Admin\AppData\Local\Temp\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1620

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\VersionUpdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\VersionUpdate.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\VersionUpdate.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\VersionUpdate.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {47c1726d-84af-4bd9-9c30-a797e9f2c41f} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {2ad4842b-2930-4ed7-b79d-e5fcf293dcfa} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4004 -prefsLen 27276 -prefMapHandle 4008 -prefMapSize 270279 -jsInitHandle 4012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4020 -initialChannelId {de817c07-eb45-464b-ba16-d9c4b419ce47} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4184 -prefsLen 27276 -prefMapHandle 4188 -prefMapSize 270279 -ipcHandle 4284 -initialChannelId {80d4fa70-df20-46c2-9c60-360ff2a314fe} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2812 -prefsLen 34775 -prefMapHandle 2816 -prefMapSize 270279 -jsInitHandle 1664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1248 -initialChannelId {ffcd4196-b0e3-461e-ad34-dcfeb867238b} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4888 -initialChannelId {f5177260-6255-4e29-976b-a8f06dec0fd2} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 32900 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {34bff35f-d5b2-4b0a-8be4-69bfeb8d042f} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32952 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 5388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4824 -initialChannelId {76a0b87c-b986-4d35-8879-25477f77b977} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4836 -initialChannelId {2e1545a5-73cd-4a4c-9d28-17997dab0a53} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2952 -prefsLen 33031 -prefMapHandle 6164 -prefMapSize 270279 -jsInitHandle 6168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6192 -initialChannelId {d19bd964-31b6-4a15-9fe5-dfb3528c02dc} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6684 -prefsLen 33031 -prefMapHandle 6688 -prefMapSize 270279 -jsInitHandle 6692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6700 -initialChannelId {188a82d6-c249-48d3-8def-9d067db2a454} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 6680 -prefsLen 35143 -prefMapHandle 6444 -prefMapSize 270279 -ipcHandle 6408 -initialChannelId {41888457-9d20-4a89-b7e2-63ad37513fea} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6432 -prefsLen 33031 -prefMapHandle 6656 -prefMapSize 270279 -jsInitHandle 6504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6528 -initialChannelId {53db00c1-d441-45f4-8db9-74b570779353} -parentPid 2072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2072" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION_#PO-20260602-7701663 E2S A105N.pdf(783KB).exe.log
Size 1KB
SHA256 c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765
MD5 400f1cc1a0a0ce1cdabda365ab3368ce
SHA1 1ecf683f14271d84f3b6063493dce00ff5f42075
SHA512 14c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45
TLSH
T1F1216B303222B5D94D022F530C5869C513EF4759BB64EE2CB959235EDD2A457AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

21407

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\doomed\21407
Size 18KB
SHA256 e218c34f2d7b6dad67f07389af4bc181971fab147c47c2d9d2323919121b5bd9
MD5 882320d867ed4e7d29204c8f7606d02a
SHA1 b4acc4087ab1ad2ba6015b10aa7cae3935a27446
SHA512 fc70c9577b1bb0f8872e7b8abcd28a5ba942cca8d3d877df6141501ee55df05172646e692f358cf409ca667e0dc52415f1a41e851eb1b27442b066c264dc5458
SSDEEP 384:P9dlfbWIvGUHCb1EiffaIqildtt/py7GJTnbAsFWCt2BBs:Ppb3LO1EsaIqkrt/py7OTn0xw2Bu
TLSH
T13482BF3F2F24314D8554E1924E4A72822DBAE7576BD6F06CD1442B11C8C9FE4F8F989B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28724

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\doomed\28724
Size 60KB
SHA256 fb8de0257f1c92708b332c713eb2aa79f8d69e5729d311738238982e04f53dca
MD5 61194aa016bd4735fcb4e804a62c9c99
SHA1 430225b6ceb62d5a0869a54fc4246c7827bc3111
SHA512 44acf99d5d699a5ccf30030febc3b3f6c26e031a3a14776e81958f92e73c09886e6ea27c8491e0769992f872b8e8b7a6c7132be9cd7c678757363fc78633ab46
SSDEEP 1536:gpWfF+KC89dpoa/VMWYgNlclOIV1z5sTfKsMbKIj/p4Ongw2v:ggfFPCYoGFYqlclOmVNFKIjeOngL
TLSH
T19D5302AE5F26475C0E5571EE0CD83EDFEEA056328A91FFF992602182C954B90FCC7891
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 837da8b4439caca64c0f7263bdd5c3fa08b3b780d7eb8a785fe8b58e3485995c
MD5 f9960e7c113c4d40217304b9aac750ea
SHA1 685bd54337cfd9900eb72f0710559c6d7e9ad1a1
SHA512 b3c1d634f65ae268bf51149d049da084d135df56b094c108deb671dffe1b1ac2bd37ac0b6746e7a68ca7e91dc079b6cff75d90ae830d405b895128afa1157631
SSDEEP 384:HUr7iO024YXOo6J+Sl1xDnZBPsac4j0lpDII+p4B24Bu:0SZY+o0+Sl7zZlsac4ID8LpBx
TLSH
T11E528D7D9F0138BA2A27C091E9FD92548E05A6BFDEE3C06619543C04CA847B9F0E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VersionUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\VersionUpdate.exe
Size 1.1MB
SHA256 8ac1b7a926bb396cee28bc1fa36f91bf7687c19be5a9a304451efb16a06ce3dd
MD5 2db88307df49ac83295d7ff1f5d73155
SHA1 fe0324ef14be2780ac4779ce4bac80bdb35b2fb0
SHA512 26e5dba220ff09208416723662baab725a387dd9a9d20e692d47f8bbed45c7dc392a821a6b75030c43b130ee7cf2e63ceb2ae61e278ef37fdb2c91cccab44be2
SSDEEP 24576:DqGgNaxAgQ9iSYlQgaef2UJl1ooYBGIn3OOIdMJlwuAs:DqGgNR3gSYl81CYQa3iowuA
TLSH
T11D351249B6A54F01D28C19B1C097453887D2AA4A637BF39E3FB412F96D423B8DD4D3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VersionUpdate.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VersionUpdate.lnk
Size 1KB
SHA256 17a466900cfa75148e3ec2e7fac05281f52e89f241e6465ad734a6f741fbdb77
MD5 464b85eb15d1ff5edcb8f252b0cdbd16
SHA1 ce65ebe88c48d107557cbdfe217f061eca4a6ac5
SHA512 f27b584e3436ccca4d677ac85350ddf1d149c3f3f4ba255f732224d2245b3274502ae984009f2fb5331c5cf27d68fda39d0c1b9b980fe8e242c5499366e65808
TLSH
T19A211F453AC39B6CF1B7C7BAA47BA330F334F902EE1453CD104001492C50A419578BAF
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
Size 10KB
SHA256 c8cbe22d21b47a292c2af3b72c9fc9a91268818bce586503a97a7ed0164d000d
MD5 bd67aef01a0e70caecfaa48f685129ed
SHA1 238182bf0e0346cb0eaf2c45d60ebdad65ad3505
SHA512 b231261fe31f3fdb87a8b6b5d812e20d7b93dcdb725c7825010b2ea560f91f22304f03ba6c2d5d03a0990b5cd76015dde72fb891b956c079accdd52a5c753af8
SSDEEP 24:FTuhMZp3f14wYfhKu7K+7lfxA7OQufqfFezMyMfRvyzQFGqflGGjGxp4fl2:FDvSwIIumM0uf+UzX08zaG+QGjGxpoU
TLSH
T13D229EF7077AB4B5E5628FB44098F198CD33113BAA6985D4CA54C0E207DA7ECD03EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
Size 12KB
SHA256 93677ea77ab8aa64f61cb766af0315a9e1de98f82e779b5d2a30eeced8f5aa14
MD5 ebaed8e32cc44cfa1505673f194f7c5b
SHA1 9a54e847e7803c304bfd8104aa7dc6184867b72b
SHA512 bc9648ab6bf0d80b67744a2c38d1b4883acd8626521b10e3b80756fe683246c834ef50aa0f86a445459273307e16ef408e10b074383eac2e4a52510babe6dc7e
SSDEEP 96:45NleWl+Uz9CGkG+QGjGGq0bq1G+8GbGer4:
TLSH
T141427FE7177E74F5EA624FB44099B158C9330637AA69C5C08A54C0E603C679CD03EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 b446000d1fdb2b554fc1959c1dd8e317d28e048b4c7be7a6958b92153acaf4f2
MD5 05eab3d6eb4d3662fbfe597ea5738dde
SHA1 1fd4d46e186d42336cda3019ef9bbc52b16a97a3
SHA512 c8a9c26ee5326d0c418e51f0bcde2700f79c9b6a23aaf07216a9b325bf476c098d3aa37db8912c47b7b96556e3aba74b8d7901f51ab8fc7910144a8c483338f4
SSDEEP 1536:jMdUYYfo57Uz6DbE9mmZmN8QiGzgRXFUWpow5:jMbSoOz6/9n8CzIroI
TLSH
T177630F44EB1A953FD92803BAACD21B103F39F8895A1A2B67375C54782C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 e7936acd54e55758c7824642ec4df258ee65d6762bc7d1b60b525f34d03e14fb
MD5 f5044df6fc8bf6446662e8f213f4adae
SHA1 2a174668bc0d3a6e42a968f621f2cbee440f5a3d
SHA512 5f8f4f3e7f1b321ebdd3b4da3d84a9b7e0e4b03fe342155da83be525870b951fbbbbb778c9f6b4fd540f7bceba5ad7cf9afd9b11da97faf21b93938d1166698a
SSDEEP 1536:JMdUYYfo57Uz6DbE9mmZmN8QiGzgRXFUWpowd:JMbSoOz6/9n8CzIro+
TLSH
T1A4630F44EB1A953FD92803BAACD21B103F39F8895A1A2B67375C54782C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 c928bd5ef7f87df00d03730c91d12d57d3bd76c4b32e7bd484d1efd48f7b0bce
MD5 7110c396a7fcafd2fa9b2d8767c698c2
SHA1 4be98576ea0d1c2ec71d04f9ba78e715a88cecd0
SHA512 589a9777b4c3087b331eda58e211a1aa1529fc82a5374423cf209fdeabb32ee94e1b4841c558d161cb5e14000fa577f841ca3d5cf873a713ed011cfd5e702195
SSDEEP 768:cbq321cGcmhuzspRK1JEokbYbmbmbdhyNEV:cbq321pEJ
TLSH
T167D20144EB1E953FD41952BBDCA50B002F79F88A98092F673A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 c6f768fa69b9784ff0726fbf9851c92eb6489ba1b1663422600261c75ff2c689
MD5 99ecd7b8c8476dcd90d709a7c339b026
SHA1 96059e7a8d8fd0de2c5d6332d37bd83e4c367ec2
SHA512 770167e936763f3838b4abe92a8ce0574ce3f55cb391ee0c6ce53e4ca2758efa0b4967f25ff6cc93390c8ba47009d1b424f8a2ed3cb35f78f6984a3eb490152d
SSDEEP 768:cbq321cGcmhuzspRK1JEokbYbmbmbdhyNE/:cbq321pEL
TLSH
T1CCD20144EB1E953FD41952BBDCA50B002F79F88A98092F673A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 44cc0842fc9fbac95492614eaec24766f59d3c93efff2207c09ae9963a25e77f
MD5 9fa22bf3718b298097d5d37f527aaa39
SHA1 5f067c2a94b1a127382c6eef9014498ba84a9e28
SHA512 99c2e68cae799cf6529fd37421da14f0c7ff0c179af00adcb2d060e1324f466a3081ac83d677df304b5b8211ba94c1414b5ff51e485aab0dca01d700f02bc374
SSDEEP 768:cjNELbq321cGcmhuzspRK1JEokbYbmbmbd:Hbq321pE
TLSH
T1A5D20144EB1E953FD41912BBDCA50B001F79B88A98092FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 431a1a8a6db66569107c9de25cd027a5bcf22ad9e5b20613227a604de31622cb
MD5 a4ad7826c0a4962f4d0662611f80cc26
SHA1 703eb55e4d74a12745ed1b3d110c83dfe650cb45
SHA512 46ae132c4cacd4b01217e961313f7dd090170c96f4b2ecdb712c72a2a22d734ae15fc8e3cf775cff809d5a1317dacb6e0136eb7a9d12017a6eb68d4de355e3bd
SSDEEP 768:lELbq321cGcmhuzspRK1JEokbYbmbmbdZcq:Wbq321pE9
TLSH
T180D20144EB1E953FD41912BBDCA50B001F79B88A98092FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50b799b1-e3b1-4fe7-a1b1-5c81bf475bc8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\50b799b1-e3b1-4fe7-a1b1-5c81bf475bc8
Size 871B
SHA256 c35f707179c291ebe23f10c7ad9dee2c97b4bc9e13eac120851708d91ad59e50
MD5 3d83fe430508bd8a0f2d1bd1ac1cb1da
SHA1 1b98c224c73d2edd46e9a05aa9701e00c9f266dd
SHA512 26b817480e467a5e0fa643b773f5e1755c1289b22c6fcd408d8cb4640162782843424fcee393059672f3fc7948169bfd9055ea96cf2e731177e7107780148acd
TLSH
T150112F81E638BEF2DCB8C24BD5613B928FB4742380CA54143EE04E040C7E62E97BA747
MD5 SHA1 SHA512 TLSH

Submit Download

774477b7-ed13-4095-8cbb-bfcfabde8d1e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\774477b7-ed13-4095-8cbb-bfcfabde8d1e
Size 886B
SHA256 761acdf0f7a1dc350364372322d3771708a3c957f7c54b577417a47e291eae9a
MD5 f99c0f4f60520a29d919974db8af50a5
SHA1 ac753be453be67d05aa45747e8ab194ea6741446
SHA512 ce02f18a0b0780988f4fe8a0deb5b327edd052219c2c08794e74db9587ee18da5722b20914206ecabe648fca94340b1998467427b6ea20f0747a7661788a0e33
TLSH
T10611274295397EF2D8689247D5B277828FF47023C0CA5C047E901E084C7B51E577B307
MD5 SHA1 SHA512 TLSH

Submit Download

885a8595-0b8c-428e-945e-0e20de6a6450

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\885a8595-0b8c-428e-945e-0e20de6a6450
Size 2KB
SHA256 dbabb6578e83f706d6a36a83fbf063bc5ee7c1bdb9b322ceca4272ffa7e07a30
MD5 f6bf509684df08a821cf588850ef3db8
SHA1 4d5d7ddc85d17c95f93a94da8b41a45aa076e4bb
SHA512 89f462ac9d4cac6f8531a1be3329eedb2884b00a2549d04b10ebfe26bc7cc8bc7f07fcdc5f0db0b517804b4db7b4a50712cf91b51681cfc8d32cdcbbc33a4276
TLSH
T1B5414028757C4DB698EBF29EE442238E97704E1300C62CD32E52DF4C8C9665D237A53B
MD5 SHA1 SHA512 TLSH

Submit Download

886ab440-4cd3-4aaa-a294-d77f3fbd5c8b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\886ab440-4cd3-4aaa-a294-d77f3fbd5c8b
Size 235B
SHA256 5970ba8ba00c0faee57a58ccf39afd711543d5c26f601405e7129583afc1d290
MD5 3d6c88693f30a4808367b8e5c55e48c4
SHA1 3cbf306d6635912508efd01b3bc76d178d3f68e2
SHA512 617b3f9518d23cf38d4ca8ffe602acab6996d8416b54fb078b0050902bc10b2a941364d86aa5335025f907759aa451ff004f1a5b9c21be1dc3a8c6b7a8956839
TLSH
T15FD0A78114A86B6E08154F57F0E17DCA30498C3728A89D60D9A2857499BB9D8426291B
MD5 SHA1 SHA512 TLSH

Submit Download

c60a3331-1065-4ba3-a636-e9670a04a861

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\c60a3331-1065-4ba3-a636-e9670a04a861
Size 235B
SHA256 ae27273eba593c43ae2fb8fbc2c5c1455f40b096aca4a9c2b898cf1d37d864b0
MD5 7f48b0b37d8572842db40bd6d2ee3739
SHA1 97a6a0dc73b3f07a4db89e9b48dd2276203e8fd5
SHA512 636e72b43f3a91a481b829c75d208b642ea56f3caebd164088bde55e46cf35f47aeaf657b81d98600eb72cc11068a813c586a3efee96db13abd6feb28d2a4e9e
TLSH
T148D023C024E8736C08180F03F0F029C330444C33A4787C64C7504134DAFDDC84252D17
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
Size 16KB
SHA256 720db0443e99b669dbae06a01205248789a03d5ef549f68b5c27e2c8f9788b26
MD5 f5546b7becdb44cb638dfc0aef0305c7
SHA1 b8fbb204618c1bc655be09e5d1a0d568c074b56f
SHA512 38d2fb65d242bddb2f0b175b286f578d40e6d82a3f6d6b9333d522a3ef1220442ae4f38c773fbc393305d037a2c9b68c795e09c6d9f2775b5147d1595fc97702
SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4H4S4hB:nI4qRf/0Xen4K6W454d4P4j4r4X
TLSH
T13772521545049EB8298FA79BAA367E01C37D533B60845C38B4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 8KB
SHA256 c05759b01816fe3cf07d700b971addf0da481f9274107c712aecf188b8cf634d
MD5 f84f9b174825866890456fd3e68e13ce
SHA1 0e629aa0ffa4d400f96788cf27a53e1fe85bb75d
SHA512 5f11be8c44b3aa4140cb72950c5c733b76eda2aaec0f14d1fd7c6ad9f7518be4b875b65037e65f08daec8a0d1d22cc16ca95b5576ac3b000dc8dab7a5789f48b
SSDEEP 192:9wdMRd1TRFfzhdASOw8SSIRP4/3TEgqBw88/4/I5bH:7LRnwrV
TLSH
T160021E785408CF7F69B6766CAC288D315A72023BB7BF68D710B99484054CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 6KB
SHA256 b1340784b258811c298c22628fcba892e38096da9aa5a535b3293a25a3b945a8
MD5 e3aeec7c342b8c3a551242fedbbbcb00
SHA1 abfc6c8cad875b079dddb941826a0d737409990f
SHA512 a046f0058c524c62a28b2d23ad07b41f21c4e144832b36ca232f784ded5957fe169b6b6a7289aca34830f9b03dda0cc9f5e8471ce4541700ee953150ff2dace0
SSDEEP 96:xHHUTUZfvqGqqkf+dA1zSwOw8SSlDdv9jEAnLHH4/39Bw88n8L4cn/MVzW:9QRFf+dAdOw8SSBH4/39Bw889g
TLSH
T1DCE13E7895088F7F64B6776CAC288D316AB2013BB7BF28D750B55484054CF3481F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 31d66015abf253fad6d9ea3642efa858870cdea9f84e69d6f89db638e77fa481
MD5 4fbae54dd6a7e6e326212e0b78d1906e
SHA1 952541e498f6756de7296559ee41a267abf4e623
SHA512 9f13a68b4fb3c269ab6a60fee209cd2e5544b92e7d35bbccb0cbf44c9d99c2d4ae6b3c4dd102d07fea6b17f716b32d6a5dd0709f41220940fe645c35d5db41f4
SSDEEP 96:xHHUTUZfvqGqqkf+23G1zSySSSlDdv9jXnLHH4/39Bw88n8L4cn/MVzW:9QRFf+CGPSSSlH4/39Bw889g
TLSH
T1B4E11E7891088F7F64B677ACAC688D316AB2013BB7BF68D650B65484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 5b9dc9eeab766d1cf4e58a487d3c50de78970f480f67086d463e87d3f784049f
MD5 18ca83ee5ebf6d9aac278513b9da99a4
SHA1 242432aad78a5502a35da1eb1d261ec0989df6ab
SHA512 11a65ba3e474f58a6b4a248eef26e1602182a47982be27a85b846a05529937ae505c35a89ae7f67584f459c5f94602471056a632406c37cbffea29ba92b2ec6f
TLSH
T1FD414CE23D062C6DAB60E01938C72A25CCB93263810F6894F948D710018439FFFCB36A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 23f7e9707f005bf6ef6633e0408201c7049e1c6507747fda88edb4fb132b61a5
MD5 948dce04e038dd14c2fe986fb2a40c2b
SHA1 f6fc6ffcc4841ddee8d18830018c75fed591606d
SHA512 21ca9d217b324f74d00b57bce7100715cfbdfe475ce28630926ba673f5371ca2bbec7d8a54c476a9f581d1d6bde1667fc6b6a9ae2e6224f299181f9344c1d157
TLSH
T1984118D26D093D5D5F84E14EB4872A64C8792273421EA894F1A8C64101883DFFBDB35B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3304451167cbb18405df81f33e8adbd7f26531e81fb36ba97bfef0824b8f38c5
MD5 acaef1c7b8d38d65c1d81da280598f56
SHA1 8fe4738e642667f2a73d88fe3fdb7eb4e4a44c51
SHA512 d2195bd760f1f96eaf33684bed687aa54a25e2fa9387ab5f507d355eabea317af6a78c34ad5779f99852fa2d29e294091e3652624ce5974bd07a58734071f659
TLSH
T15A31C983FF5B1CFC1090D1CBA0CA5BF98B6151228554E8D4E898A844068477B33DE75F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 44d15e623d03329653eb1b9f4b8feb039205ae074b831978c9d7b92a9b6e8b7c
MD5 bf1726a853bef85520b1c6eae02acab0
SHA1 9840301ff8529997949e8853c78713b72e4d9707
SHA512 6948d5fa41917a54edf436f137d5e50b3901e9a23b4e0d1df84af542039d1d4697a9b016d084bb22d607bec9701ac893b8ce44b7d389870f52b29cf5b0ea1524
TLSH
T16331E9C27F1A38FD3E50908AA897676685F51253D74EE8C4F7AC4A10025436F658A34B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 2d81be7ed08f4dd0bd86184be24863dce063fab2104c53ffab282ebfdd88cb2f
MD5 0009b8b7fb67a77fbe3bcfe37acefbdf
SHA1 6f6be6f383026fee6ec679f0fd37a6b67378a775
SHA512 b666a5fa6ffd1a62bc68d46cbefcad5cf82230b36d4e921c0ced9fce29e043596af0f8690717ca22d9d7cab3ac2872022d44efb39a90ffe6dca0cfd71b987526
TLSH
T119410CD37B093CAE6B51E049588A2675C5752213A65D7490F75CC611014835FE5CE35F
MD5 SHA1 SHA512 TLSH

Submit Download

{6eb10919-7811-4b60-8903-649e7105ea74}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\default\https+++www.virustotal.com\cache\morgue\116\{6eb10919-7811-4b60-8903-649e7105ea74}.final
Size 72KB
SHA256 433c6e1c9123d0affc64e856e8767f6a526bf4773716d1830359edd1b0dac3b5
MD5 7f64bc4c07603b87cc47a724076c3ade
SHA1 e9cc873d359f1755911d32fea3bb5411b5b9c15d
SHA512 dae156bb7f624f2204e06512fa935f25988ae0a9192e05dcf7f9aa990e9c77cdd2952e6bc742ebffdbc009bcc92359023ed946e908db6ee87b780d52419d0655
SSDEEP 1536:RAUcltXudo1ZvkrEPNPdTjEUZbgT36BLwWWhs3Tb:RARtedaZCEzUUZbgT36BkvGDb
TLSH
T18073F2A476007BEF792C03B3F621ACD8219DDA52F90A455240E8F7C432EF78A9B8D059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 02a5330d1ca97cd6bb019e981898b7b87d779c34b899599f9dde5d89b395491c
MD5 b3ec3c194947b6ede294d599d95649a9
SHA1 7895e82a4c7db985fb4f1bc390c89e9db015a0ca
SHA512 a8073f302559a862f03f273f8e1b7a1307af523ab5749301b2b493fd5272563ce68b4691ad4d09fe6e938cb791e0f7ea13c33d8bb28f5393174b321b14a80aaf
SSDEEP 49152:M7+BfsyyaP6ryMty/drC9S8rRz3UghkR0bPHY6p1:WGfs9aP6ryMty/wRz3UghkC1
TLSH
T1EA1639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.2MB
SHA256 cbd381f1903bef66df00e1cb5a2928c9d71ae806154f3408f64eb552de064398
MD5 4492dfefa5c4a0a618c7a7ee59060a5a
SHA1 c51e3f3cd907e0757700940ae1efb6c7846dc2f7
SHA512 8488696a6d691202f1e3570374a9a9101b6620c49eac7f18715211c7eb361ababe78ed1230d17fbdb93836cc786c3381037386afc70d9be396a394cf7af4d149
SSDEEP 49152:8LqLyzaeUe6QC5zYY9eTgWzc1wXWinYzn5XO9RuEx7WY3L7su2wtCuWaJ9z6u0OH:tGV2zuWaJ9eu0O87OgUj4N
TLSH
T15C666CE420E29252F38140B3719A53FB11EFC01C6076CE44579896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2976-12-0x0000000009370000-0x0000000009422000-memory.dmp

Download

memory/2976-7-0x00000000067D0000-0x000000000686C000-memory.dmp

Download

memory/2976-0-0x00000000006F0000-0x000000000080E000-memory.dmp

Download

memory/2976-5-0x0000000002D00000-0x0000000002D0A000-memory.dmp

Download

memory/2976-1-0x0000000005340000-0x0000000005350000-memory.dmp

Download

memory/2976-2-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Download

memory/2976-8-0x0000000006730000-0x000000000674E000-memory.dmp

Download

memory/2976-4-0x0000000005270000-0x0000000005302000-memory.dmp

Download

memory/2976-3-0x0000000005900000-0x0000000005EA4000-memory.dmp

Download

memory/2976-6-0x0000000006660000-0x0000000006732000-memory.dmp

Download

memory/2976-9-0x0000000005340000-0x0000000005350000-memory.dmp

Download

memory/3960-13-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3960-16-0x0000000005320000-0x0000000005386000-memory.dmp

Download

memory/4592-11-0x0000000003230000-0x0000000003231000-memory.dmp

Download

memory/4592-10-0x0000000005850000-0x0000000005860000-memory.dmp

Download

memory/4592-23-0x0000000005850000-0x0000000005860000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads