192136af2a327b174b7e499b4522b1471f552fc8ab59200b19091a33307b7e00

Analysis

user interaction
yes
max time kernel
40s
max time network
39s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
source_prepared.pyc
Size 56KB
Sample260630-pegbqaex4r
SHA256 192136af2a327b174b7e499b4522b1471f552fc8ab59200b19091a33307b7e00
MD5 249f7f34acc182c61d0e38c939f9764c
SHA1 f9cf8a9de7e444f620d81eb781885afe408fd7e3
SHA512 d2f95e59500fe1c35cd3528e1cb8e70a2b54d7af86725d50a84ce5bcb6df4cd76b694b0c75dec449e481877f12318a8037dda725c1806d19074eb9cf615b0592
SSDEEP 768:LN3dFR+jhl5fzNJYsiJugRH2N12wSoqy0zyUruaGioHwU5YasICZK2s2hN:Lz3+jD5fJJpiJRaSVyJpQOYasIUfdhN
TLSH
T1C0434BB89178486BEEC5F03975C2DBE2BB22C090A500C743F5198DF6BFCD6515A86A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	firefox.exe
Token: SeDebugPrivilege	1348	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1348	firefox.exe
1348	firefox.exe
1348	firefox.exe
1348	firefox.exe
1348	firefox.exe
1348	firefox.exe
1348	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6780	OpenWith.exe
1348	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 6780 wrote to memory of 6208	6780	OpenWith.exe	91
PID 6208 wrote to memory of 1348	6208	firefox.exe	93
PID 6208 wrote to memory of 1348	6208	firefox.exe	93
PID 1348 wrote to memory of 1856	1348	firefox.exe	94
PID 1348 wrote to memory of 1856	1348	firefox.exe	94
PID 1348 wrote to memory of 1856	1348	firefox.exe	94
PID 1348 wrote to memory of 6224	1348	firefox.exe	95
PID 1348 wrote to memory of 6224	1348	firefox.exe	95
PID 1348 wrote to memory of 6224	1348	firefox.exe	95
PID 1348 wrote to memory of 6224	1348	firefox.exe	95
PID 1348 wrote to memory of 5168	1348	firefox.exe	96
PID 1348 wrote to memory of 5168	1348	firefox.exe	96
PID 1348 wrote to memory of 5168	1348	firefox.exe	96
PID 1348 wrote to memory of 5168	1348	firefox.exe	96
PID 1348 wrote to memory of 1220	1348	firefox.exe	97
PID 1348 wrote to memory of 1220	1348	firefox.exe	97
PID 1348 wrote to memory of 1220	1348	firefox.exe	97
PID 1348 wrote to memory of 6900	1348	firefox.exe	98
PID 1348 wrote to memory of 6900	1348	firefox.exe	98
PID 1348 wrote to memory of 6900	1348	firefox.exe	98
PID 1348 wrote to memory of 6900	1348	firefox.exe	98
PID 1348 wrote to memory of 3520	1348	firefox.exe	99
PID 1348 wrote to memory of 3520	1348	firefox.exe	99
PID 1348 wrote to memory of 3520	1348	firefox.exe	99
PID 1348 wrote to memory of 3520	1348	firefox.exe	99
PID 1348 wrote to memory of 3932	1348	firefox.exe	100
PID 1348 wrote to memory of 3932	1348	firefox.exe	100
PID 1348 wrote to memory of 3932	1348	firefox.exe	100
PID 1348 wrote to memory of 3932	1348	firefox.exe	100
PID 1348 wrote to memory of 6988	1348	firefox.exe	101
PID 1348 wrote to memory of 6988	1348	firefox.exe	101
PID 1348 wrote to memory of 6988	1348	firefox.exe	101
PID 1348 wrote to memory of 6988	1348	firefox.exe	101
PID 1348 wrote to memory of 2820	1348	firefox.exe	102
PID 1348 wrote to memory of 2820	1348	firefox.exe	102
PID 1348 wrote to memory of 2820	1348	firefox.exe	102
PID 1348 wrote to memory of 2820	1348	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Modifies registry class
PID:6132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6780
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27098 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {b07c7a9a-7969-400f-a160-72e986685970} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {906ed3ae-dd5e-4f2e-81b6-097618810596} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:6224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27274 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {b6806f92-df7e-4024-8b2c-06dffe2877a4} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27274 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {3a523eb5-d551-493e-8585-14b4dafeaf7f} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3180 -prefsLen 34773 -prefMapHandle 4528 -prefMapSize 270279 -jsInitHandle 4532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2940 -initialChannelId {537f97f1-1114-439a-8569-b1e9819980d8} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:6900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1644 -prefsLen 35010 -prefMapHandle 5224 -prefMapSize 270279 -ipcHandle 5268 -initialChannelId {51b80de6-e847-4e99-a156-7b7a31cdd170} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3008 -prefsLen 32952 -prefMapHandle 3044 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {c8119fd1-6165-48ac-bee1-594c303cd833} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {cdb22f88-eb5b-4a03-a7ce-2d547f6f0372} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6036 -prefsLen 32952 -prefMapHandle 6040 -prefMapSize 270279 -jsInitHandle 6044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6052 -initialChannelId {8597f819-2eb0-4ff9-a7ae-6d17715ad252} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 75a5c01997f176e76d84aff1754181215f0580699b2a79bb8acf8f431b3397fa
MD5 caf57f669ab9c05ac8f573ac3c91ab0e
SHA1 3ec874ad6950a4d9452436aeaac14fc88363d0ac
SHA512 a0dbbab5e95c1bc632f71d76c339d8fa3f91541600f4388abaf811aab6c2d98161958d0e0789c07f0600aaa3924e756d8b9656713ac3936d8e255e6ca706d8b4
SSDEEP 192:ZA1d66JoztdzgCl6mc0dSOv5zbo7dZtAyj2MD:wd66Joz/zgC1jXbopZtAyjP
TLSH
T113E10064F628863FC408127BDCA21B540F35388A984F7F1936AD754C2D5B2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a6a1564ac6c91dd908e25e804ef2be684107eb8b0dc86e6e8e7521d255e6702b
MD5 a5053a5ee3d30e16d8a1cb40deae7a6c
SHA1 c7ae6ad562c0415c7f93d789c121ea53a13bece3
SHA512 172b9d030fddef61ac213f5a15bffc5de79ce51a8c59117391f6b5629444e0c4a5cc2cd3281e422e6caa99635bec90bb1aadbc0dafb2ec98529d309803c944a4
TLSH
T15021454C3EB84D2EACCBE29C7440028E67198E4705C71D431E03EF8DCF91A99327E429
MD5 SHA1 SHA512 TLSH

Submit Download

63d6acc0-1f7d-4ce3-9aaf-8422f23fb62a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\datareporting\glean\pending_pings\63d6acc0-1f7d-4ce3-9aaf-8422f23fb62a
Size 235B
SHA256 a7526c9f3bca402d1c6bbb1a4caa36f07b948e9149dde6ef0ea625ed9e169ef0
MD5 58b80b3c051cac481c90b38a8b6b6643
SHA1 6e42df911a3eeda87678e221b655f70bdbd32b85
SHA512 2eb3d8bb63afae5f7e131af4ef6ead73f6cf657ea830b58fad8d8163a1d6b178b055083f8e1f6dac6bfaea3ad7d45f16c3605af26972a0f042c06bd61595a3c4
TLSH
T158D0A7D064E8775D88184F0BF4E179DA70954C3335A59860EA918574DDBEDC8416283B
MD5 SHA1 SHA512 TLSH

Submit Download

ade46078-d2dc-4717-9893-9da29ce48c2c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\datareporting\glean\pending_pings\ade46078-d2dc-4717-9893-9da29ce48c2c
Size 235B
SHA256 da8b7ac1eaaa02efea0468a0fca651b61cb29f006a2204c280d39c5d945d419a
MD5 f7e611cee5eadf9f05bb76ca3e4efe8b
SHA1 225ca0496481a90a3433d48a36198e23cb2d3e51
SHA512 c41aa6923af8d764b492c18c9dbae284c46722b8544511cc2c4f3d99eb23099cef377f6885ea29b9ad0066a0e5154a24ca10f9e44d5b54e792d1fbfc88048f49
TLSH
T196D097812CC8A3AD48200F03B0E0BCCA30C64C3318A49810D662413489FEDC506A3807
MD5 SHA1 SHA512 TLSH

Submit Download

c7cf4cbd-a27a-4a87-b961-a42581db7aaf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\datareporting\glean\pending_pings\c7cf4cbd-a27a-4a87-b961-a42581db7aaf
Size 14KB
SHA256 146a4a5a22915e2403caba0e950f534b676c93c01816b07a8660dd55ce995dc1
MD5 bb54f96028101cc17f597c18f60c80b5
SHA1 29dfd1ca37b06135a53cf2c61e83c75a7e621719
SHA512 d73c236b51e836496d3fd0cd1c1bed684e5e74d6182a8eb92bfe93fbfbc10627ce5c8304e5dc5de4c9eb41239734f22376116a9dd176011827f86fc98acd017b
SSDEEP 192:IxUSzx+siAXRyGFM1CBNCeDvS9PQzAgqsAZWCYmTuUEOi4mgXPuuN6qZasJshe8:wUSlbiAXRfFnfJCPQgXuump
TLSH
T1BF620856243049BA8651E36898ED7FC3E6F518CF4C019FCE9BE47D086AEE06E1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d187e922-1591-4c66-a356-7d25c35cc553

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\datareporting\glean\pending_pings\d187e922-1591-4c66-a356-7d25c35cc553
Size 883B
SHA256 a0b15c78efefff556ddd3b0c8fad25a187c4625e8f555907ad97a116ec124f55
MD5 9eaa331b4f90a7469a1b8518453d7104
SHA1 187a8af9bc8c97c860775f92e83e2e5644c03faf
SHA512 591c68ad4bc84cbfdf9b27d5cc114b53384416f2a59f369c7e0b9fa3ebf93c73fe265675df64ecd8bd2ffc95d1eb32e3a2ebc0974ea645f138eeb2c53ab01a36
TLSH
T12D110041A735BAB3CD3C924FD5A23B4657E4742380C785083EB16E080C7E51ED76AA07
MD5 SHA1 SHA512 TLSH

Submit Download

e81cd0d8-7823-428f-9048-adde88331a34

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\datareporting\glean\pending_pings\e81cd0d8-7823-428f-9048-adde88331a34
Size 2KB
SHA256 9335bc5cc1705204a27741516a1911991d40c295c09ffff4a5145a79a692a28b
MD5 1b5252684b1b7f8921a3ff9a75708f17
SHA1 9f363117e6599df875c9879e858b4c85d83f880e
SHA512 5c387ee76ff7d24f11c1584d4f9998932e777e4aef9b208366423a8eba4cbfdb5bf3a95a1e1aebd7d499b5d4df5e726c1fa20617f6105e7dcfade0acce83621b
TLSH
T10B41236879B85D76DDDAF14EA442378D73609912008B1C433F61EF0C8D9769E236E52B
MD5 SHA1 SHA512 TLSH

Submit Download

f8f4e0ff-7a94-4b5a-8b32-4b8a8cbbb26c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\datareporting\glean\pending_pings\f8f4e0ff-7a94-4b5a-8b32-4b8a8cbbb26c
Size 886B
SHA256 064395df7586f4eb5292834fb31a3e4812593448f820d1afb5287511713ff38a
MD5 86d16ab4d291ae1836d5805906cec338
SHA1 456f828768cd32df7d991d645070a1c1c3abbea5
SHA512 343f8fab7cd69007e6961dc8272070ff940e5d4c5c31aea2afeb3d37a614a08c63390993522c69bc50e46ea167bdabd72e3a86578224d5c459c1b2a897f90bfb
TLSH
T1A21100418734BAE28D78B38BB5E2774956A4342380C748083EA46B080DAA05EA76B607
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\prefs-1.js
Size 6KB
SHA256 8ca30a8e7e4f2421fb6bc4e063983cc38719349829efeeabea73b329206065b6
MD5 ee24c948e9f2dd3bcd53aa116e1b889c
SHA1 b45ed9eda1b7fad40f8dfe09bf5243b9ca0589d5
SHA512 e9f852174b5665b9d59f3c0522b0853b26d5a1b2eea050cd291fcc52e80898a74baf49e57fa211f2188c1c55355eefcdc6b3c165f150eb631db17c1d59b51a8c
SSDEEP 96:xHwxUTU2qGqGffP9031zSrSSlndv9j+nERHB9Ik9Bw88u8L4cncPA:CxRRsfl03eSSV9fIgBw88L
TLSH
T1B6E130789408CB7F64B676ACAC648C316AB2013B77BF68D710B554C4050CF3481FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u2qfxueh.default-release\prefs.js
Size 6KB
SHA256 7d6f7d157738f944baa5c815cbb5be37c4e2884ed28646519933ca9b001ae0b1
MD5 a1fc0f41aa5137fce4d789fb4320a5c0
SHA1 6d4d68a8f9135c5805656137d7416cf9555acfd0
SHA512 4991633b8ca94ffd67d8f4438703e87608d1d83a9168020d0560de4c30cf002140e8ab093dc87d5e74f37acbec1a458c5bad65ab79617a11ce37085cd72bf159
SSDEEP 96:xHwxUTU2qGqGffP9Qk1zSg8ySSlndv9j/nERHB9Ik9Bw8828L4cncPA:CxRRsflQklSS+9fIgBw88D
TLSH
T19EE1207890088B7F64B6776CAC688C716AB2013B77BF68D710B554C5051CF3481FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hqCtPNuk.pyc.part

Path C:\Users\Admin\Downloads\hqCtPNuk.pyc.part
Size 56KB
SHA256 192136af2a327b174b7e499b4522b1471f552fc8ab59200b19091a33307b7e00
MD5 249f7f34acc182c61d0e38c939f9764c
SHA1 f9cf8a9de7e444f620d81eb781885afe408fd7e3
SHA512 d2f95e59500fe1c35cd3528e1cb8e70a2b54d7af86725d50a84ce5bcb6df4cd76b694b0c75dec449e481877f12318a8037dda725c1806d19074eb9cf615b0592
SSDEEP 768:LN3dFR+jhl5fzNJYsiJugRH2N12wSoqy0zyUruaGioHwU5YasICZK2s2hN:Lz3+jD5fJJpiJRaSVyJpQOYasIUfdhN
TLSH
T1C0434BB89178486BEEC5F03975C2DBE2BB22C090A500C743F5198DF6BFCD6515A86A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads