241366fae863e43e7a046b66c820c12771f030b6b4590cf5fb2646a4f44de074

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
76s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/07/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Browser/firefox.exe
Size 1.7MB
Sample260706-1eptmshs4r
SHA256 241366fae863e43e7a046b66c820c12771f030b6b4590cf5fb2646a4f44de074
MD5 50e65c27fcb754cac9974ab64a70e661
SHA1 b1bbbeb4ece5f5ab29d5eb476d41903554182a86
SHA512 3e354080da7806e68feffe967ed942bdba7d532475e2e5dbb94c243582aed11a58422a8b949789c9c3f7e01015150903718d4afa523590e222f53f14516bd9ff
SSDEEP 49152:LKhZgvFKvPv1VV5kHsdA1Cyuha3QXXXXXRXXXXX9wwE:mm98kHsdA23
TLSH
T16E857E0FE39502DDDC69D1B1864A5221FD357EB18B90A9CB9B643B212D366F09F3E708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2540	tor.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	firefox.exe
Token: SeDebugPrivilege	3644	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3644	firefox.exe
3644	firefox.exe
3644	firefox.exe
3644	firefox.exe
3644	firefox.exe
3644	firefox.exe
3644	firefox.exe
3644	firefox.exe
3644	firefox.exe
3644	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3644	firefox.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 3644	1372	firefox.exe	79
PID 1372 wrote to memory of 3644	1372	firefox.exe	79
PID 3644 wrote to memory of 4940	3644	firefox.exe	80
PID 3644 wrote to memory of 4940	3644	firefox.exe	80
PID 3644 wrote to memory of 4940	3644	firefox.exe	80
PID 3644 wrote to memory of 1800	3644	firefox.exe	81
PID 3644 wrote to memory of 1800	3644	firefox.exe	81
PID 3644 wrote to memory of 1800	3644	firefox.exe	81
PID 3644 wrote to memory of 1800	3644	firefox.exe	81
PID 3644 wrote to memory of 2588	3644	firefox.exe	82
PID 3644 wrote to memory of 2588	3644	firefox.exe	82
PID 3644 wrote to memory of 2588	3644	firefox.exe	82
PID 3644 wrote to memory of 2540	3644	firefox.exe	83
PID 3644 wrote to memory of 1704	3644	firefox.exe	85
PID 3644 wrote to memory of 1704	3644	firefox.exe	85
PID 3644 wrote to memory of 1704	3644	firefox.exe	85
PID 3644 wrote to memory of 1704	3644	firefox.exe	85
PID 3644 wrote to memory of 4556	3644	firefox.exe	86
PID 3644 wrote to memory of 4556	3644	firefox.exe	86
PID 3644 wrote to memory of 4556	3644	firefox.exe	86
PID 3644 wrote to memory of 4556	3644	firefox.exe	86
PID 3644 wrote to memory of 3216	3644	firefox.exe	87
PID 3644 wrote to memory of 3216	3644	firefox.exe	87
PID 3644 wrote to memory of 3216	3644	firefox.exe	87
PID 3644 wrote to memory of 3216	3644	firefox.exe	87
PID 3644 wrote to memory of 3004	3644	firefox.exe	88
PID 3644 wrote to memory of 3004	3644	firefox.exe	88
PID 3644 wrote to memory of 3004	3644	firefox.exe	88
PID 3644 wrote to memory of 3004	3644	firefox.exe	88
PID 3644 wrote to memory of 1720	3644	firefox.exe	89
PID 3644 wrote to memory of 1720	3644	firefox.exe	89
PID 3644 wrote to memory of 1720	3644	firefox.exe	89
PID 3644 wrote to memory of 1720	3644	firefox.exe	89
PID 3644 wrote to memory of 1904	3644	firefox.exe	90
PID 3644 wrote to memory of 1904	3644	firefox.exe	90
PID 3644 wrote to memory of 1904	3644	firefox.exe	90
PID 3644 wrote to memory of 1904	3644	firefox.exe	90
PID 3644 wrote to memory of 4500	3644	firefox.exe	91
PID 3644 wrote to memory of 4500	3644	firefox.exe	91
PID 3644 wrote to memory of 4500	3644	firefox.exe	91
PID 3644 wrote to memory of 4500	3644	firefox.exe	91

C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
"C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
  C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
  2⤵
  - Checks whether UAC is enabled
  - Checks system information in the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -prefsHandle 2588:26449 -prefMapHandle 2592:276393 -ipcHandle 2636 -initialChannelId {dc9d4ef3-0137-4050-be5c-c95a4afb0c9b} -parentPid 3644 -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 1 gpu
    3⤵
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2292:27031 -prefMapHandle 2316:276393 -jsInitHandle 2056:242716 -parentBuildID 20260628123000 -ipcHandle 2424 -initialChannelId {d22cf800-b3da-4a3e-a8bb-f6162bba0ed6} -parentPid 3644 -win32kLockedDown -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 2 tab
    3⤵
    - Checks processor information in registry
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -prefsHandle 2952:27716 -prefMapHandle 2956:276393 -ipcHandle 1956 -initialChannelId {7c05ee6d-bd64-42db-8626-8f87859b75fc} -parentPid 3644 -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 3 rdd
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Tor\tor.exe
    C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Tor\tor.exe -f C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Tor\torrc DataDirectory C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Tor ClientOnionAuthDir C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Tor\onion-auth --defaults-torrc C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Tor\torrc-defaults GeoIPFile C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Tor\geoip GeoIPv6File C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Tor\geoip6 +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:cbca099a854f7e1e606c9f8d224e5570d999cc499228c34af374cadb83 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 3644 DisableNetwork 1
    3⤵
    - Executes dropped EXE
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3428:27778 -prefMapHandle 3432:276393 -jsInitHandle 3436:242716 -parentBuildID 20260628123000 -ipcHandle 3444 -initialChannelId {ccd533f5-fedc-479c-a76b-2f8966c0f881} -parentPid 3644 -win32kLockedDown -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 4 tab
    3⤵
    - Checks processor information in registry
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3560:27854 -prefMapHandle 3460:276393 -jsInitHandle 3472:242716 -parentBuildID 20260628123000 -ipcHandle 3788 -initialChannelId {3d86ac2e-39ff-45aa-bfaf-51e44b5f36b4} -parentPid 3644 -win32kLockedDown -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -sandboxingKind 0 -prefsHandle 3152:29643 -prefMapHandle 3084:276393 -ipcHandle 4064 -initialChannelId {533db298-d6fb-405d-a43d-f003ff955512} -parentPid 3644 -win32kLockedDown -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4132:28693 -prefMapHandle 4204:276393 -jsInitHandle 4208:242716 -parentBuildID 20260628123000 -ipcHandle 4216 -initialChannelId {12ca9b1c-e8d1-4a2b-9a61-b2ae93a4216c} -parentPid 3644 -win32kLockedDown -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764:28963 -prefMapHandle 2160:276393 -jsInitHandle 1952:242716 -parentBuildID 20260628123000 -ipcHandle 4524 -initialChannelId {9ab760e8-da81-49b6-bc69-a12dabfac9a7} -parentPid 3644 -win32kLockedDown -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704:28963 -prefMapHandle 2160:276393 -jsInitHandle 1952:242716 -parentBuildID 20260628123000 -ipcHandle 3148 -initialChannelId {4f19dfbd-e81a-47aa-8fc5-01f3e17ffc22} -parentPid 3644 -win32kLockedDown -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1904
- - C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe
    "C:\Users\Admin\AppData\Local\Temp\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4692:28963 -prefMapHandle 4696:276393 -jsInitHandle 4700:242716 -parentBuildID 20260628123000 -ipcHandle 4708 -initialChannelId {b8442307-c69b-4ed7-bf86-989b70114682} -parentPid 3644 -win32kLockedDown -appDir "C:\Users\Admin\AppData\Local\Temp\Browser\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.bin

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
Size 17KB
SHA256 c6af581175e3a048879637c6daa859b9000bc588ae18e3d9fb86973260b73fc1
MD5 5bed719c0c712b7a89360c700e62a31a
SHA1 3ae81a10510d69fd84f02ebe539c58e27be3bb58
SHA512 99c664da3ba9f4d8c7764f536f7b23f1171eebe09d76a082d28633bdbdae381bca1b7c8a2adc4ad4f5af722883a998dd4111c960aa6b03847aa44c619566fa0c
SSDEEP 384:9ao6i/ofs5PKOw1lnOTOl20j/7GoeSL4HqL4HML4HsL4H7:9No6qOw2BY444m4G4b
TLSH
T1B982973858989FB9394A66C75837BC84517D47ABE19C8C36B8AA8F0D11F827C4B7710F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 c2ff569bf6472521ab5552e7ff3321b9a7932046cfbbff9f6828b933506370c0
MD5 f5ef4c22e371e7fd1762b22031d508ff
SHA1 ab718d71c26ae58342f2e449e405d1817224c81b
SHA512 4ecc76a47bd6450727022d681a449cd37f4e1f34775f92f0e0fc4c0bf9c76cdf194755eb425d0336eb64ada3263f261e9e07e91283e7c381bef68d2aac3d655a
SSDEEP 96:xH0TnqGqwYtbzvz0zjzh8TtPpn7Hi2PIjeh8CBw8pDG:lRwYtvz7HZ8CBw8pS
TLSH
T1EFB1126895448F7F68B2377CAC694D7196B2053B77AF68C710A54089150CF3883F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 4KB
SHA256 844d1b37da7f47246400002d3e3faeeb88769fab8e16b2da61d1e13154ab71f0
MD5 0949d062c58ed4c7e77fab3e73fc5ba0
SHA1 3b2c69aca633e8952b7fba2d145a13d378a0c6bb
SHA512 a9a62d184d148ec27871f7b7a0359d781700e49eb9d53ec51d9caf40b11bf1c030767ebc71cd1ed7fed9e75b9c9ad73ff14bbc2280d62b0ec01600069c74e45f
SSDEEP 96:xHBTnqGqwy2zvz0zjzh8TtPpn7Hi2PIjeh8C1w8p1:SRwymz7HZ8C1w8p1
TLSH
T151A1006891488F7F68B2377CAC694D7196B2053B77AF688610A54089150CF3883F5AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 795B
SHA256 8ed1624c4c8df91a59cf03a9efd7661a076bfd6b0d65b2aea78ee9fe53438355
MD5 20fdfda5f52f328c8103ee0aa74702d2
SHA1 95316f7ee8a0c6b33ec96e416d8d000ce2647e9b
SHA512 8245b31a60119e04a6c0a0bb5a11dacfdf5360c08b4ced4571d1b917839385f8f13ffa7d5d8cb58a821b1a43ed5304a5cab87c9b4024c52b3efd4123b46c04f6
TLSH
T17A01FDAA1D455FBF51E532E8EC0942E1C3E20639B5AEB44025F880981210F3503F7AFF
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 5KB
SHA256 dbd01fef43a7b995a93220967996c5012fbc3392696538aa3fbe9510e3871e66
MD5 0e2f18cba5ec828f36d8ed2856aa451e
SHA1 f4b292588c3d1d4a942969ea2fdd797272b562d1
SHA512 8d0496a7a304b808807f756ac17a6d2b0db0f2a2ef238edc4ec37358bd3104dbf20e869fea42cc567e937358e58adc7c9004f3e41663206c424a5d96ec3a1a22
SSDEEP 96:xHBTnqGqwYtbzvz0zjzh8TtPpn7Hi2PIjeh8CBw8pY:SRwYtvz7HZ8CBw8pY
TLSH
T10EB1017895488F7F68B2377CAC694D7196B2053B7BBF68C610A54088150CF7883F5AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 4KB
SHA256 137edb669b65663194e06829c4a80632319fab55cceb84d554b0ecb0f1163c5c
MD5 8f7332c31153ec1053837ff194c8b5d1
SHA1 97537c14f24317b93926c6cb08cbe2aa50f6005a
SHA512 1651860b405d507de9e5162fea16ea1c5564ae05d54fcee4ca52f0a1b89ac71a7ba605c760b8bcf30cfd04a18a7cbfb1a4d49c26bd8125bcdb6be5081261d240
SSDEEP 96:xHBTnqGqwytbzvz0zjzh8TtPpn7Hi2PIjeh8CBw8pY:SRwytvz7HZ8CBw8pY
TLSH
T1C4A1017895488F7F68B2377CAC694C7196B2053B7BAF68C610A54088150CF7883F5AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 200KB
SHA256 a53caa04c610b728578d542532a26ab2a409d33c5ab6a6365e81106b16b263ee
MD5 a8c569e7b2b28b1355a7dd52bbde51da
SHA1 3e62de12424064a4a1726e2d65d638a1b4e57cef
SHA512 942b372e9f26dd44b157c3f8babee01e75d8c9f6fe4cdfb4adf1f04ae0ebd1fdfed9a0b0b1a84053d2fd52cbac5ecb43320a10f0ca303b48548a6a0a774eec89
SSDEEP 3072:TpaSLR3y3DvzwP4s8ZpvcH96uac+FJeH1Sf68J:ZR3y3bzwAs8ZpvcH96uac+FJeH1Sf64
TLSH
T17E1409D7B2534463CD370CF3EAE3A2AB2D4E89AA809E03E8755B405C951D4966FF5332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\Temp\Browser\TorBrowser\Tor\tor.exe
Size 9.7MB
SHA256 ec7708e0b43e0e00b1533d11ed3ca244e6f11cb2a7b62d319ad73a7b13123033
MD5 93110c343a740fca8e64cfe00472c527
SHA1 bb6abd60cfa979506bfc2c3b14c725a79cd5ddee
SHA512 d8510b0466104d02fc939806e1713d614c56488a0ded258e7bb8c1490b0839f7be054e5e56f3984012ec145049c7dbbcc0adf912dada78e4363201cd808baf75
SSDEEP 98304:+igyt48AHd7ERbHgshQKnRqNAtLnLisS1Km1mLg9wrHjzsZaUHaa+b:dgyt4hdcnLs1z1mL+ia
TLSH
T142A62947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A62B70B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1704-679-0x0000019A40B30000-0x0000019A40B9F000-memory.dmp

Download

memory/1720-689-0x0000024215390000-0x00000242153FF000-memory.dmp

Download

memory/1800-73-0x00007FFBC5500000-0x00007FFBC5501000-memory.dmp

Download

memory/1800-626-0x000001EB49970000-0x000001EB499DF000-memory.dmp

Download

memory/1800-72-0x00007FFBC5890000-0x00007FFBC5891000-memory.dmp

Download

memory/1800-71-0x00007FFBC5880000-0x00007FFBC5881000-memory.dmp

Download

memory/1904-690-0x0000028646200000-0x000002864626F000-memory.dmp

Download

memory/3004-688-0x000001C899C50000-0x000001C899CBF000-memory.dmp

Download

memory/3216-687-0x000002350A370000-0x000002350A3DF000-memory.dmp

Download

memory/3644-647-0x000001F224DB0000-0x000001F224DC0000-memory.dmp

Download

memory/3644-77-0x000001F221DA0000-0x000001F221DB0000-memory.dmp

Download

memory/4500-691-0x0000027842850000-0x00000278428BF000-memory.dmp

Download

memory/4556-680-0x0000022E3A750000-0x0000022E3A7BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads