f0d65e1672e61cd50f9ea142ebfec61596ec2c4eed46ed3f3e011895d047d022

Analysis

user interaction
yes
max time kernel
53s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
V1.2_nosave.ahk
Size 859B
Sample260717-e42zlsaz3m
SHA256 f0d65e1672e61cd50f9ea142ebfec61596ec2c4eed46ed3f3e011895d047d022
MD5 5cffe999f36e96f2f72b3999ab6269ec
SHA1 a5468fb5e1754986920c32d0654faa25b8a429c2
SHA512 39d6370575cafa7e316a65a07e6a2fecc4a7ff5062bb8a02ce30a2dc643e83f98692836a169e1ff8acc6cbb933b1470c9cd86fe88b4d90f8d6456c03f4a787af
TLSH
T137110C6D97D2EDB02B809735B9C4BE0F028DF30C3A0D16A41BD1648CE4110B44AF01F6
MD5 SHA1 SHA512 TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ahk_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ahk_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ahk_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ahk_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.ahk	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.ahk\ = "ahk_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ahk_auto_file\shell\open\command	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3848	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	2152	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
3848	OpenWith.exe
2152	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2732	3848	OpenWith.exe	90
PID 2732 wrote to memory of 2152	2732	firefox.exe	92
PID 2732 wrote to memory of 2152	2732	firefox.exe	92
PID 2152 wrote to memory of 4600	2152	firefox.exe	94
PID 2152 wrote to memory of 4600	2152	firefox.exe	94
PID 2152 wrote to memory of 4600	2152	firefox.exe	94
PID 2152 wrote to memory of 1688	2152	firefox.exe	95
PID 2152 wrote to memory of 1688	2152	firefox.exe	95
PID 2152 wrote to memory of 1688	2152	firefox.exe	95
PID 2152 wrote to memory of 1688	2152	firefox.exe	95
PID 2152 wrote to memory of 3804	2152	firefox.exe	97
PID 2152 wrote to memory of 3804	2152	firefox.exe	97
PID 2152 wrote to memory of 3804	2152	firefox.exe	97
PID 2152 wrote to memory of 3804	2152	firefox.exe	97
PID 2152 wrote to memory of 4268	2152	firefox.exe	98
PID 2152 wrote to memory of 4268	2152	firefox.exe	98
PID 2152 wrote to memory of 4268	2152	firefox.exe	98
PID 2152 wrote to memory of 1664	2152	firefox.exe	99
PID 2152 wrote to memory of 1664	2152	firefox.exe	99
PID 2152 wrote to memory of 1664	2152	firefox.exe	99
PID 2152 wrote to memory of 1664	2152	firefox.exe	99
PID 2152 wrote to memory of 5376	2152	firefox.exe	100
PID 2152 wrote to memory of 5376	2152	firefox.exe	100
PID 2152 wrote to memory of 5376	2152	firefox.exe	100
PID 2152 wrote to memory of 5376	2152	firefox.exe	100
PID 2152 wrote to memory of 5424	2152	firefox.exe	101
PID 2152 wrote to memory of 5424	2152	firefox.exe	101
PID 2152 wrote to memory of 5424	2152	firefox.exe	101
PID 2152 wrote to memory of 5424	2152	firefox.exe	101
PID 2152 wrote to memory of 5432	2152	firefox.exe	102
PID 2152 wrote to memory of 5432	2152	firefox.exe	102
PID 2152 wrote to memory of 5432	2152	firefox.exe	102
PID 2152 wrote to memory of 5432	2152	firefox.exe	102
PID 2152 wrote to memory of 5572	2152	firefox.exe	103
PID 2152 wrote to memory of 5572	2152	firefox.exe	103
PID 2152 wrote to memory of 5572	2152	firefox.exe	103
PID 2152 wrote to memory of 5572	2152	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\V1.2_nosave.ahk
1⤵
- Modifies registry class
PID:2520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\V1.2_nosave.ahk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\V1.2_nosave.ahk
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {c0822f15-c07f-4c12-a3d7-80b6d37207a0} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {047dfd09-cc93-4625-9fd6-2334db456b3f} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3524 -prefsLen 27276 -prefMapHandle 3528 -prefMapSize 270279 -jsInitHandle 3532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3540 -initialChannelId {f515492d-051a-4abe-9f50-5a02ab5e653f} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3664 -prefsLen 27276 -prefMapHandle 3668 -prefMapSize 270279 -ipcHandle 3784 -initialChannelId {fc9b1ada-6a1f-47c8-a610-0f47dfe03598} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2492 -prefsLen 34775 -prefMapHandle 2304 -prefMapSize 270279 -jsInitHandle 2632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 916 -initialChannelId {adea5981-1ff7-486f-a327-b5593ffc93f9} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1664
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4848 -prefsLen 35012 -prefMapHandle 4852 -prefMapSize 270279 -ipcHandle 3124 -initialChannelId {b6288e3a-66db-4d5a-a51c-3019d73870f5} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 32900 -prefMapHandle 4960 -prefMapSize 270279 -jsInitHandle 5032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5040 -initialChannelId {f93191fd-4234-4a10-ad4c-5974592d4d41} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5076 -prefsLen 32900 -prefMapHandle 5080 -prefMapSize 270279 -jsInitHandle 5084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5088 -initialChannelId {e6d5da4c-8c78-4d1c-9bf6-5f132df0d956} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5068 -initialChannelId {053f2b56-878a-4bd3-af8a-2abbe8f04fb0} -parentPid 2152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 f1adab1e70e054369cf99994493cdeb6d786001d5a5b8e8fa01852ec5381de9d
MD5 e9ae0a5d43ebf58e27ab1b60a9746653
SHA1 3ed68014f552218e253897554d741c27e3a9e394
SHA512 c286dfccef9c9f2b034e2dfd959834a0c1234f9db4495f8935121039791458da74f7ff3b6b8ba26c5c43566325919675b9f4cadf8c2f27335f25c79ecd90930b
SSDEEP 384:H9XghOiO024YVdcs3hk2nhfdDE2Ba/rIVy8euCI:dX+ZYVdv3hk2nhfS2sDIVy8D
TLSH
T14F729DBB9F016C591957D985C8AD8369DC18F9BBCFF6C0A608243449C78432AB0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 00f47a6a83c3a36d3198aca815698edbaf1dc97dd77fa35a8fd6eceb070f20e3
MD5 0936165675a67230376cdcb9d8370ba4
SHA1 6b111c45dd755ea14d96c9a3c86464042b8bb923
SHA512 d65c4e06a4d1733c02ae3035fc93c1a417c30c89da2a195d9531c4ea68417d7d43bca392133bf4500bd9c3abfe917efa45270fcbd957aa4cf8a473d73337c25c
SSDEEP 192:tPOv5zboJZqmyjF81U1d66JozGzgCl6mc0dz:tgboJZqmyjged66JozGzgC1jd
TLSH
T160E10FA4EA28863FC409027BCCA61F414F35395AD84E7F29319D741C2D476DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c97519564c19dd8110e6bcea1eca225eb95a02e2feba3e807eadda1fc33d4aaa
MD5 decc9111dec0ba58a5d4f9c67c90efd9
SHA1 3c60ca453f2792b3f9b6338d4d0024d7644b1dc8
SHA512 22d8c3356a19c865e501cd5dbd11bf08a0412296d5fbdb7854d6c3c17ce8400524dbca1cbe686765b10ea7ed50d2aa325c0860f3444a938c317c2791a3c02b5e
TLSH
T18F21495C39F94D3AA9C7F29CB452128E53518E0704C71D474D22FF8DCE91EE9326A63A
MD5 SHA1 SHA512 TLSH

Submit Download

0908fe32-8f98-43cb-b92a-8ffcde459f71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\0908fe32-8f98-43cb-b92a-8ffcde459f71
Size 235B
SHA256 5950a09a0c4a62f604fe347a64b0adc1f5555901d3d1effdae805916a86fdac9
MD5 41c2597913013ed12edafb4697ea4204
SHA1 63e70c3a80ac599c70bf804b588c668c78c03e3c
SHA512 98358fcef97ebe99d70cc4fb58f2a65716305207b9d754ce0c035b2e2661599a91a537c29b57a230cd7124f2600fee6add26fb23e1cf6e98948225ea40f2732d
TLSH
T1EAD0979824D8636D08300F4BB0E07DE330488C3318E2A810C6A0447899BC9C40212C46
MD5 SHA1 SHA512 TLSH

Submit Download

7325f603-0d50-4d55-9796-231f6eaf50ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\7325f603-0d50-4d55-9796-231f6eaf50ca
Size 883B
SHA256 38b55d7951430799f43f142114970c8be73123f35899a8a8fc40ff0c3bc3f48f
MD5 7c928dcae489d7d78dcce861688fccca
SHA1 df3b062129236cbde0ba71da33c360f88dbfad71
SHA512 75b5e4fd5a71cf6eca1578f5914d9ece80732c42a40cfa2d5c7865c4cd6d642e8dfdc72c49ab5db5b6b05d7734efde6c8fa904f5eacc05247a9fe3342c6ac165
TLSH
T18F11E3D19A34B972CC7CD24BC6957B429FE47523C0C990143EA169180D7AA1EA75E60B
MD5 SHA1 SHA512 TLSH

Submit Download

842560ac-7703-4eb5-9104-d960b4e9ae0c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\842560ac-7703-4eb5-9104-d960b4e9ae0c
Size 886B
SHA256 35c7d96bac641377c8266be82adfb3ad49ba7a152c67b998dbd07b65665a6354
MD5 18d67ca87d02074cee1ad2edf66e2028
SHA1 63093916707de3cdcd71638387cbc4e9a4416580
SHA512 a022052c4c8e55b48b7e4c2d4a0a4ed4a16f18315639349fe850b5f4a9ae9e426652178c98b5cbc2e10a7a4d0d999376a870dab0fcf96b1ada7389c86abab608
TLSH
T1AF1123D18E3475B28C6DD287D6E0B7828AE07633D0CA58147E912F280DFA91F635A307
MD5 SHA1 SHA512 TLSH

Submit Download

9f5ec2a9-bd62-48f5-85ed-ffa5ddefbedd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\9f5ec2a9-bd62-48f5-85ed-ffa5ddefbedd
Size 16KB
SHA256 c821bdd0ad57eced9a1c74953c325ad2363b7608b6ef2c8afb2df4ce9a70ae3b
MD5 4734ecc28732b2046266617fd83e2d2b
SHA1 2c303f5eba55fb45916762d292a285e16a2e770c
SHA512 ffb6e46dc587417f410c8210662e40115756aa01621b9d579359bc2944c6c54ab7dcb9394d7f9b4ffad768ce8987cd89c0c67a0116db64cff0fc637d830a64fe
SSDEEP 192:k9C4JjYboQjaFgIuLVGhvFZT9+dTr26KyeaipuzxQixnFYtpXeUa1rG+53DBCPbh:xMkboQjFeSlQixnFYtpXt+xDovOv6
TLSH
T18A72D956682045BA8251E369D8E8BFC3E5F638CF4C419FCADBE47D081DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed72b88c-2e62-484c-9c3f-a40043561c6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ed72b88c-2e62-484c-9c3f-a40043561c6a
Size 235B
SHA256 17f5bef35c4d6bc6deae897cc473ef07e380ef15e771637053f54f85d3f6f68a
MD5 02f6409649326c23a56868e9161d6637
SHA1 f46d3378a298f0bfe641e77b1e435533facb8c76
SHA512 4191eeb031117e10fbac2ec06816efda87afe32cfd8ba837d58d4983c83e107522a1c841af6699fc0eaef26a1a0d8a0258693553c069d9b082d4c0e9cb75ddf4
TLSH
T1AED0978028AC3B9D08100F42F0A42DC230884C3758A898208B92843889B99D8119189B
MD5 SHA1 SHA512 TLSH

Submit Download

fff36ce0-a576-43ea-acfb-4dd741c057f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\fff36ce0-a576-43ea-acfb-4dd741c057f0
Size 2KB
SHA256 e3fb4f2e8b72cb7c83767506c095ca6cfb82f1721db9532eb2617c0c77a21301
MD5 e7b620188fffa669c69f2b7c9798a6f0
SHA1 4532e5bdb013635befbb2289618c205095299f4c
SHA512 f9868a520c80c40a3bede3dea44e1ceea844097acd364fe4f75b904efeec20e1e920462e80522b9b7718931d099031ed017a53bd96729242d67e63b26f71df00
TLSH
T15D41216C39785C778C9BE69DD482338E57A05F1340C618836E52EE4C8CD66AE236A52B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 9bf872b19696bc651c143c891aac7b0c6c0fd0a8810c7e08c1e5fa7b8517a8d2
MD5 5a9841a022fc4c174d2891014085be21
SHA1 0a50b69550be62b073b651d38a9bf034b9a9f686
SHA512 e5ca6a114faeaf1f8c20b9dae67930da7a3aae90d86b13c0eb21f83fa573d3e16dd8e4a1ca6f0634201b77e783e3fdb080ede2fc74349c131afd1feec280c990
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4HOz4hS:ujI4VRfOXN4e60434L474f4c4g
TLSH
T1BB72531545049EB8294FA78BAA367E01C37D573B60845C78F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 7KB
SHA256 92c078f0abe54738e881ca6a318abf65d1b877d057279bb3035347c3ef18aa01
MD5 4901a755bf7bb69127b10b49958af950
SHA1 7a1d9ecd4593f66713cb1c0605da787a586b8561
SHA512 ad6fc1d8de811f499f6c12cc2c7e2216268a54826a9eb1d7f2834d2423512a0acb4473e35f4765b301eb7767eb346f48b7ce21408af74258c1811c7ef7d02d8b
SSDEEP 96:xHcNTUuqGqdfJW9ObzSDSSlDdv9jqOnERWRgBO+ytBw88IL8L4cnrzBHK:6YRdfJW9VSSUT8RrtBw88nw
TLSH
T1FEF1FD789444CF7F74B6766CAC288D715A62023BB6BF68C710BA94C5050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 cf63645cdfff707c87e4aa82d943202e43f6ea7e5f164abe85b2acf513294947
MD5 f6683d676ce75926edfdd3901c948ead
SHA1 0599fa69bb29e3f8d10990c1f5bc3decb47ada81
SHA512 b4d67988406f27e6c89dacc197f51940281f641aa06e092fce9a731b65483ab024063f082769401a85b5c47c66f38f1a6fa3f2409f2d56bd37489523931af03d
SSDEEP 96:xHcUTUuqGqdf2oE1zSDSSlDdv9jVnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oE+SSw9A1Bw88+w
TLSH
T196E13F7894088FBF64B6767CAC6888716AB2413BB7BF68C750B554C4050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 8514bbca65e1efd3b5045cc2d8aa0d1808493fbfb369c48d2571c11509af1d7e
MD5 946157292d2afae16295747c9d7f4354
SHA1 b191473448db0177e4416b2e519ca32930feeae5
SHA512 6661ef8a463f2663e849261a2daa719a96c0e86774340cec52b67609ac48d624fd83805801098e11a53c32f09fdb1aac52543e8195443652da0854de26a1b4c1
SSDEEP 96:xHcUTUuqGqdf2oE1zSVSSlDdv9jVnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEcSSw9A1Bw88+w
TLSH
T161E13F7894088B7F64B6766CAC6888716AB2013BB7BF68C750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 a22a4c3dbaf7dab4ea5b2c0eb58bd426f45cd97c8d6d7f73dfa06a952ccc71ba
MD5 6ffd95ed3fad075677f9d0f2452e97a4
SHA1 41385272a6d206726cbd95b4fe546e95d1c3455e
SHA512 07605dcd783cf013e25ca3d04ad42bd9faf56ef946f91ca359e415c5d2397c23ad0e9015b419b03ac29cfcfffd0797683c91386c3c2ccae20b05a7eff094fe15
SSDEEP 96:xHcUTUuqGqdf2W91zSDSSlDdv9jqOnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2W9+SSUT9A1Bw88+w
TLSH
T130E13F7894088F7F64B6776CAC6888716AB2413BB7BF68C750B554C4050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 61023b6e1829c35a14adf5a413cf6a571230961a657342ff074d1019c2beefd3
MD5 0d658aed974ac949a9562d70064650e4
SHA1 c5cbee8c0ebb96aa8486557e9a4da9636da2b753
SHA512 0db1688758cb00a135e2f32c1199fbd65e574e9f4615a8a3a8a50d4c540b5a7a6fd094fa4e92db7523799963e766d939287d97a682b038eaf7fe587590d86334
TLSH
T14521D89799DB3FBA7B25A14FE4C64FBA81067030417A0CD0E24AEF6659AC41E770E128
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads