b1a3b489cda446d9c64b2fa78b82998311678d2fd8ef9cfa10ab1984560c8623

Analysis

user interaction
yes
max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-fr
resource tags

arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
08/06/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bluemagicdemo.py
Size 19KB
Sample260608-2brphafx2t
SHA256 b1a3b489cda446d9c64b2fa78b82998311678d2fd8ef9cfa10ab1984560c8623
MD5 a15365096c670eda0d6fef146b28b6e1
SHA1 eede7b85d5c1f68321d388afceccfbffeb6c9d67
SHA512 51b7a1147974725202d256fea96d1551d762f0d303a5e7bd726a2daaf35568b167249bc72ef3b1733a8aca93403a6a7d48288e98d8b0d8fb69cf5eb358fe57e1
SSDEEP 384:nXksOckBHsVlirHEMy6wHreh6B6TCiQTCnURrPxyi+pea:nAglirHEMy6wHreh6B6Gikf59a
TLSH
T1F3928731DC942537D5B3C65F88D7D58CD3485287A9324B67BEECC2083FB1851A2A8EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery persistence spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\MuiCache	AppInstaller.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\python-manager-26.2.msix:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	firefox.exe
Token: SeDebugPrivilege	1400	firefox.exe
Token: SeDebugPrivilege	1400	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1400	firefox.exe
1400	firefox.exe
1400	firefox.exe
1400	firefox.exe
1400	firefox.exe
1400	firefox.exe
1400	firefox.exe
1400	firefox.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
3488	AcroRd32.exe
3488	AcroRd32.exe
3488	AcroRd32.exe
3488	AcroRd32.exe
1400	firefox.exe
1400	firefox.exe
1400	firefox.exe
1400	firefox.exe
3052	AppInstaller.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 3488	652	OpenWith.exe	82
PID 3488 wrote to memory of 3264	3488	AcroRd32.exe	83
PID 3264 wrote to memory of 4600	3264	RdrCEF.exe	84
PID 3264 wrote to memory of 4600	3264	RdrCEF.exe	84
PID 3264 wrote to memory of 1628	3264	RdrCEF.exe	85
PID 3264 wrote to memory of 3588	3264	RdrCEF.exe	87
PID 3264 wrote to memory of 2764	3264	RdrCEF.exe	88
PID 3264 wrote to memory of 1520	3264	RdrCEF.exe	89
PID 1568 wrote to memory of 1400	1568	firefox.exe	91
PID 1568 wrote to memory of 1400	1568	firefox.exe	91
PID 1400 wrote to memory of 2860	1400	firefox.exe	92
PID 1400 wrote to memory of 2860	1400	firefox.exe	92
PID 1400 wrote to memory of 2860	1400	firefox.exe	92
PID 1400 wrote to memory of 4640	1400	firefox.exe	93
PID 1400 wrote to memory of 4640	1400	firefox.exe	93
PID 1400 wrote to memory of 4640	1400	firefox.exe	93
PID 1400 wrote to memory of 4640	1400	firefox.exe	93
PID 1400 wrote to memory of 4468	1400	firefox.exe	94
PID 1400 wrote to memory of 4468	1400	firefox.exe	94
PID 1400 wrote to memory of 4468	1400	firefox.exe	94
PID 1400 wrote to memory of 4468	1400	firefox.exe	94
PID 1400 wrote to memory of 4176	1400	firefox.exe	95
PID 1400 wrote to memory of 4176	1400	firefox.exe	95
PID 1400 wrote to memory of 4176	1400	firefox.exe	95
PID 1400 wrote to memory of 2796	1400	firefox.exe	96
PID 1400 wrote to memory of 2796	1400	firefox.exe	96
PID 1400 wrote to memory of 2796	1400	firefox.exe	96
PID 1400 wrote to memory of 2796	1400	firefox.exe	96
PID 1400 wrote to memory of 2012	1400	firefox.exe	97
PID 1400 wrote to memory of 2012	1400	firefox.exe	97
PID 1400 wrote to memory of 2012	1400	firefox.exe	97
PID 1400 wrote to memory of 2012	1400	firefox.exe	97
PID 1400 wrote to memory of 4200	1400	firefox.exe	98
PID 1400 wrote to memory of 4200	1400	firefox.exe	98
PID 1400 wrote to memory of 4200	1400	firefox.exe	98
PID 1400 wrote to memory of 4200	1400	firefox.exe	98
PID 1400 wrote to memory of 2440	1400	firefox.exe	99
PID 1400 wrote to memory of 2440	1400	firefox.exe	99
PID 1400 wrote to memory of 2440	1400	firefox.exe	99
PID 1400 wrote to memory of 2440	1400	firefox.exe	99
PID 1400 wrote to memory of 4524	1400	firefox.exe	100
PID 1400 wrote to memory of 4524	1400	firefox.exe	100
PID 1400 wrote to memory of 4524	1400	firefox.exe	100
PID 1400 wrote to memory of 4524	1400	firefox.exe	100
PID 1400 wrote to memory of 4844	1400	firefox.exe	101
PID 1400 wrote to memory of 4844	1400	firefox.exe	101
PID 1400 wrote to memory of 4844	1400	firefox.exe	101
PID 1400 wrote to memory of 4844	1400	firefox.exe	101
PID 1400 wrote to memory of 2996	1400	firefox.exe	102
PID 1400 wrote to memory of 2996	1400	firefox.exe	102
PID 1400 wrote to memory of 2996	1400	firefox.exe	102
PID 1400 wrote to memory of 2996	1400	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bluemagicdemo.py
1⤵
- Modifies registry class
PID:1292

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bluemagicdemo.py"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=396C5DC81063831C89AA9A6263FF2A8B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=396C5DC81063831C89AA9A6263FF2A8B --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4600
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AEA34470CB7F99F526E84BC427382115 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=21976BAF62446A458E32D2FBE0593E05 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3588
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E4B0890107191848C792CEDFB40AA35B --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2764
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=447BE7C7C7269FDE0D342D9A90A80710 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {24e7d9cb-43a6-4211-b24b-5a64b7938ff1} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {acf0ecd2-3052-453c-818c-f1e3df9fdeba} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 27274 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {525e36e1-19d7-4c03-b71a-a87b7c1ccfee} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27274 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {863fccb5-a6c9-43b6-92e5-c8ad043df266} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2888 -prefsLen 34773 -prefMapHandle 2892 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4436 -initialChannelId {d733dab7-4c5f-4999-9f00-112c6ac73dc1} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4824 -prefsLen 34822 -prefMapHandle 4828 -prefMapSize 270279 -ipcHandle 4840 -initialChannelId {badc77a5-c7e4-41af-8c4b-cb5a0bbd08a4} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5020 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {ed027440-2c0d-4526-8499-b9457533e045} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {37b81cfb-c690-474d-978f-41b709df9669} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {8c97bbdb-829a-40f6-8f16-57858513cbd1} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5996 -prefsLen 33071 -prefMapHandle 6000 -prefMapSize 270279 -jsInitHandle 5076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3088 -initialChannelId {e3194b88-0a16-4cdd-9bd0-e8a0b2298d79} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2764 -prefsLen 33071 -prefMapHandle 2900 -prefMapSize 270279 -jsInitHandle 2904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1576 -initialChannelId {b0f0a86a-00e9-4db2-bf3f-23a17b2ca513} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2996

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\AlternateServices.bin
Size 10KB
SHA256 8ddc4df74c7e26a8db62fd38303886ffb2e6c4ea8f6a8988643d0ea66fd18359
MD5 bf6d3f3572b777415e15aad279a311f9
SHA1 2414151092b1b08ed4bd68d40a8d9a08e49fc535
SHA512 59737f63cda60c291ba63f506537a69994541dbd27e40c4a0a974f0c0bc08db840c1be8f4bb622ab97744cbf703c28cb9f5f1a7ca69808c5acff0695be7dc44f
SSDEEP 24:iBuhMZrzc91SxvP9xNxEJC9BZxlb9FXxb1bP9VvjxnM5q9F55A56xWN9lix:WCYx9rxtPxbpxnBjxOI566xyEx
TLSH
T1AD2292F76B76A462F0A2CFB49059B6CCAC730325057E95C4C74480F702D6A99A17EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\AlternateServices.bin
Size 16KB
SHA256 fb3f2e2aea92fa419727721f507d0ec0fb1f5c67980094e26f064f720f35cfd1
MD5 ce174d41cf1556573917a9040969e246
SHA1 ded49c78aa54eaf796a0926e5954b1f934c18c3a
SHA512 cf849dc56c53fa4d936156b594ab505f0a09719ccf604d6975d9df0ceb056d4e57fbb46faaac4cd461589e255d58b1926bdf406dab9798b997c6e47acf0661e6
SSDEEP 96:fQJlpFlTL3Bx2I562bnwM/pxpVyKKb57:fhQ
TLSH
T18F728EF73772A462F192CFB15098B6CDDC330315197CA984DB04C4E702A6BA5A07EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d5a80b567a60bee0dc8b0bad5e57adc5027c4c08d5de4ce52cb4a55bdc60c358
MD5 242285c6c8a2c96fc33a24653db281e0
SHA1 f4c4fa5a29ae9a08d7acbaa7ade3e8002525cb2d
SHA512 a36e180d4881ee3fa9c56c8bf602ebb94dc69d0bcbfe438ac4a1758b117ffa58051205bc1416e3ca589d41e2345e472f55362cb20650b32ba82c519ff313b527
SSDEEP 192:qOv5zbo8hZY4yj1w0v1d66Joz0dzgCl6mc0dz:Jbo8hZY4yjR9d66JozQzgC1jd
TLSH
T11AE1ED68E628863FC414123BCCA61F440F35398B984F2F2A359C645D2C5B6DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f270798b9a21acef277347ec3ac59d51f1b9055a0bc87f92a6b1d8a9c4da32b8
MD5 78213638beca129e3a417af8fbc58a10
SHA1 5c42e42883f29c252757ce2f1b7b1a05e6fe97ef
SHA512 5fa3cdc43376db664b63b9c27a82fa634ddf0746043bbc022eee8634dd2dde6dde1df873001fb53a1b54adb8ed433f2fee80f55fa0f28e23a4e4107275e0a262
SSDEEP 192:JOv5zboHPhZY4yjlwHv1d66Joz0dzgCl6mc0dz:GbovhZY4yjA9d66JozQzgC1jd
TLSH
T141E11D64E628863FC414027BCCA61F440F35399BD84E3F2935AC645D2C5B6DE3A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f46718b3c1de89ebff48a1075a0621d1ced04c3e37be0f93c2b47c69f7193d2f
MD5 6f5d2614768464cf225d5e2726e8f96d
SHA1 c6379bf8554513dc008b2059f99ce7d6f8713d56
SHA512 8231c0b8b854d5e87ef8ed6fe4f92e21085729c66e0e139f2b81801423f508cfebcc29170c383c53c37166a4fec257847ba75ebaad4eeb71616cd999fe2ab501
SSDEEP 192:eOv5zboHPkY4yjlwdyN1d66Joz0dzgCl6mc0dz:1bovkY4yjCyrd66JozQzgC1jd
TLSH
T15EF10C64E628863FD414027BCCA61B440F35389BD84E3F2935AC645D2C5B7DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 71cae8dc2e748ceac25d87a3bf81ca41e092f84a98e7329ca96af52697b3382c
MD5 4713867f83d06b457aa4ba930dee35ed
SHA1 92ec79cfff8a3a4274b3b0216a4daf58ef33c45a
SHA512 1a585eda509cebcbb2daf91ba738b373506f61a69538929c97990a2dd720e15b157d8db7a0c58a24755e45579af0c2670b47faec135cda9400cdb376a0038fb1
TLSH
T102217C6D39F94D2AA9C7E35D749002CE93514A07049B1D430E13EF8DCDA1AE9317E43D
MD5 SHA1 SHA512 TLSH

Submit Download

0f9824a6-9450-4f6f-a5b0-59357d52c3be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\0f9824a6-9450-4f6f-a5b0-59357d52c3be
Size 235B
SHA256 b2df1526a147cd7d975ccefe6efedfe0eb2b998637b014cc2224239a35538777
MD5 c438858eee6557fdddae32bbaf80137a
SHA1 b4a303247a01d940068585eb35a5b6fe3cc36f62
SHA512 eec40a0a41ce969f374cb7fcc74d55a425969b2df899416f66d096e6de49bde852af8c39f9e079aa989f92f385fe581a0eee4d3d3b46fc94fa2e6b3726e7b8ea
TLSH
T143D097C024982B5E09000F87F0E0E8D23054CC3314B4E810DBA181B48ABDACD4192C16
MD5 SHA1 SHA512 TLSH

Submit Download

1c6e7c35-35f5-4419-82d5-6e935df70143

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\1c6e7c35-35f5-4419-82d5-6e935df70143
Size 16KB
SHA256 39040a2e4f479fbe325bb37173fe1aa18a27726a1292196acbf72ca02ac5e97b
MD5 85166c12852b8cdcb871945cdc03bd55
SHA1 23fe67d6286943cd1beabdcf2874c44a17b5bae2
SHA512 c03619bdb9825679190c595a7bb0ad81d86bd061c69f9a4bde66c5473176b895caf51b4d1955f95fbd81a73ab23a8d7bd8032f77893d92bc5b2594c32d5ce619
SSDEEP 192:TPutmz2G1MPQQLIB1t/xv5tCvMJui2jSzx2CeEEGCrqrFmyQffdLTAt7aSzV5l:butmz2tTLIx9nCvMki2jSlvkMV5l
TLSH
T1A772C956682055BA8251D3AC95FC7FC3E6F538CF4C019FCA9BE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bc4ed43-42f1-4dd6-a380-6bfbc2e5d92e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\3bc4ed43-42f1-4dd6-a380-6bfbc2e5d92e
Size 883B
SHA256 6ef8735409454f1fa9cb2f337e7bae85fcdf9b150ced0f3532f6ea7ae315c0c5
MD5 adf4e5136f6d9973e0e43357f5f5813e
SHA1 a6ed8faa10519f5e264e3ea13dbe708f6990d1f8
SHA512 b5325dd08727ccf1b4d4b06368d00422b66ff12f399c9f4f8bf667b4b0d8f3b4d265e1b86842c41b0b37972ab796386286f1e7579745f5e8882fa3a9ea67d18c
TLSH
T1F811C045A5357AB3CCB8D20F8A9137465BB4B623C0CA48543DB55E180CBE92E936A70B
MD5 SHA1 SHA512 TLSH

Submit Download

94079e5b-eda1-4317-b59e-71fc249e6817

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\94079e5b-eda1-4317-b59e-71fc249e6817
Size 2KB
SHA256 47f4dbdf60270f8a2ca61c1defaddb824b674769c7207d5a9ef310a475c07a7c
MD5 ef4337868cf7ea448f2d866673fe2bec
SHA1 f1823b44d1ec7c0348570c313ab0f64fde1f2300
SHA512 8bad7303601d0b2feaf1e886bb112363a68e6fec3dc6cf1a2e2f2809e57218bdaa6eeb155a45871494414eeb996cd74c9a8ad7737ae31766fd086bcd443a11d5
TLSH
T14341535C36785DBB9CEAE18DD481238E53A48A1300C61C832D95DF4C8C9669D336E53B
MD5 SHA1 SHA512 TLSH

Submit Download

9d7b7e0d-6fa9-4e3e-b252-43f0dadcae2c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\9d7b7e0d-6fa9-4e3e-b252-43f0dadcae2c
Size 886B
SHA256 2c5c121b4c8461b9afef7bd69b6b6910314243d17a02992ee70ed5bc6dae5019
MD5 a2675ba74e3f950ad2ac4c5a8fb05191
SHA1 9ffce8f4e8cdc9b4380269add93b0a8beece9a55
SHA512 b64e1db17fcde07c3904ebdea406cc7aff264e6de933d58ba089c03be034f7442d4957cef299cc759ac4cd104ce984ff539feaba0ad185baa2a335068dd5c288
TLSH
T16011C0418674B5B2DCB8E24B86E17B464BE0B023C0CA4C547E949E194CAAA2E6767707
MD5 SHA1 SHA512 TLSH

Submit Download

c49ba37d-d4b8-43ac-88a4-21f8295ef9ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\c49ba37d-d4b8-43ac-88a4-21f8295ef9ab
Size 14KB
SHA256 4ee36c2b456245140b7e1d55bab8c9109b26b7f05cb8c163b8685fc550cb7e98
MD5 30d8f5a4260767a72e52f445d4d755b8
SHA1 47d21bc8074985eeebcbc2538870e902b367815f
SHA512 7bd280b6be832aeb84251ff7d392fac4bb2f08cf36343f70a3b3f369904b2f1b5f70ff6f00d5d8c9ab6734637cf98c20f39fd8969f9db756dbd1e6f24d6b5469
SSDEEP 96:JvvKNgUkaq1SlOrDnilsShxyCxbGMaq3/wNOJFua1wik97oTe/Mg0SfFfvsMwRdn:JvvN9JoBhioUGQUuSla88Czccr3LE9q
TLSH
T16B62C7FDCD1240473E65E52EF2E5EDAB2017293149CDC3DD2AEE483A26D69BB0527324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3f4b9e1-2048-4955-ad38-55f67e6e21ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\d3f4b9e1-2048-4955-ad38-55f67e6e21ec
Size 235B
SHA256 00e2924626c5c46edf7d1db6781809c69d99bf9cb25f4804b8c2eefded4b1cda
MD5 45a37c1e58e60cabe54ce87053a8c111
SHA1 4f6e33f526c1f3359523649e7d86aceabb2d9925
SHA512 6a1af2739dfc8b9b58b130909d24133a23e534ff6141683c645f87698013d48606d1c014218d5b4873206cbd961e6aeba4f08fa5a20bae403440982c4caae0d9
TLSH
T184D097C06488672C4E114F03B0A168C674448C3324687860EAA045B8AFBDDC80231806
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 8KB
SHA256 6e9fc99f200b7f831d508187e4bf8182c152338cc0281e8cc2960f61c6b66c11
MD5 72bf6fedd6eb04010bc5dc137dd89358
SHA1 ee092b8cd37b3197ede08375ca0d9f41c5fbff62
SHA512 893b13131ff65a0b6c18d2d032f0d60f85e2f71765d8fc25ea3d3ba5c7768d4bf8804eba31eff46a9b06bf48420ecfdebcde5dd53daa710f2dda806390cc0185
SSDEEP 192:FwsPkqSHCRDfzZVZfsJLikdSSq+StBw8OQwivnzNFZgm5Q0OYys1f5Kv1:3d0W+ewfSG
TLSH
T1A412003861488F3F65B6367DBC2449B16962023777BF7CD201F98885042CF2951FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 6KB
SHA256 79fe7b2aefa264e5861521e87596c99358c34e7a83641e5ecea529fc55233ce2
MD5 6004892dc78ee37ca3f93947f63c5534
SHA1 aac71f7687178b59be0243ecd0eaa31958a5458d
SHA512 6e85ea78315d0fe2023ca4b45b97a2ea6c67a8e3e1708b56ea3db6303af828347927b13333e2b6273a269005180a718c776a1c8c0978b6fdfd765b1d8998fa1a
SSDEEP 96:xHPUTUkqGqDf2ZfskzSwLikdSSl5dv9jZn+H+StBw88H8L4cndyJGS:FHRDf2ZfsGLikdSSq+StBw88N
TLSH
T113E1307890088F7F74B677ACAC6888716AB2013B7BBF68C750B95485011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 83592eb64a7bedce109681f10ece3a12e60ae1158cc5646303a4f70cd7a53fc1
MD5 17556a3c1353757d1c7fe971f3eac464
SHA1 9c0850fb6e30bac94f46f83f262249e4778dbfd9
SHA512 ca914fe2f90a64e95db8726b557ea82b7529569f69c85c812ea9841202f2f2dbf5d89ca88c28cae2bdfbc77205f5055cd9d9290481a7a9ac5ed46ae15c3d4096
SSDEEP 96:xHPUTUkqGqDf2h81zSiSSl5dv9j4n+H+StBw88H8L4cndyc:FHRDf2h83SS7+StBw88O
TLSH
T119E12F7894088F7F74B677ACAC6888716AB2013B77BF68D750B95489050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 7KB
SHA256 f7bd6932bbdb622a1bac36f6dfa96fb4e0fd244a982bd74e50b0ec05e2ea021c
MD5 80ecb70bf84373678e5943d1717e1673
SHA1 162ccf685168e07c76f536ff10d3af5285d16d38
SHA512 2c6d8beb278d1805b440fb61eae78a43af91d53854d04a03768e7036378d9acaac9719e959d03fa2339311ecdbd72f39d5c2e99f22d18b2ff02a01e303f6ad8a
SSDEEP 192:FwsPkqSHCRDf2ZfsJLikdSSq+StBw88Qv1:3W0W+ewK
TLSH
T1DCF10E789008CF7F75B677ACAC6888716AB2013B77BF68C650B94485051CF3451FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 514c35dfa1b1a51f5bcdb07e3bbf58d49fcf30d6512ed4d8cba004f35c9b47e0
MD5 05fc21ce67d3e27e98b302a91446f17d
SHA1 7ec49227f781f54b8b588a6b86059907212e6ef3
SHA512 b85509258c4d0dbf7aee19bcf7167478b2a4d52d8e9b4776347ff66c03b4b5942518ddf299479b9c11d274be444807b701ce606ed555f0b16fcbe4d319bfedd9
SSDEEP 96:xHPUTUkqGqDf2Zfs1zSwLikdSSl5dv9jZn+H+StBw88H8L4cndyc:FHRDf2ZfsdLikdSSq+StBw88O
TLSH
T161E12E7894088F7F64B677ACAC6888716AB2013B77BF68C650B95485010CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python-manager-26.o0kJSbnd.2.msix.part

Path C:\Users\Admin\Downloads\python-manager-26.o0kJSbnd.2.msix.part
Size 44.3MB
SHA256 66f0370d3f47068916dbd35b2afdc7cf72cba57500e070844a6ca2aa43ec5d70
MD5 1acbd055b8103e05370ccbe3e2ff5530
SHA1 4488d10ea55cba246b55c5b11fdc5dc5f1aeb9fe
SHA512 b52144a19c5a522a66c4445f6640de420ad523cfbea72964d3713eed45e6c8e632f46636c9d26d4247d7544d1ed8b112e5231112a3787155afe8bd5e8aba37e7
SSDEEP 786432:dXhPIo2xDgAK37y7VmUonZ1AdnyfShaC4nzVXlS8UI6aqrwEz4xcaSjPoA9F1t2u:dXhPd4gW75oAxGSYCh8U7aqrwEMxcjn9
TLSH
T1E9A73311BA090EB7E1D7EF316592CB27830DA190724DB68F2E6407F4157B7CA2B4B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads