hxxps://github[.]com/Zalafina/QKeyMapper/archive/refs/heads/master[.]zip

Analysis

user interaction
yes
max time kernel
118s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Zalafina/QKeyMapper/archive/refs/heads/master.zip
Sample260718-ed3s8aax3x

Score

1^/10

persistence

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\宝ꑞ氀谀>\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\md_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\md_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.md	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.md\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\宝ꑞ氀谀>	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\md_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\md_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\md_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\md_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\md_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\md_auto_file\shell\open	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\QKeyMapper-master.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
556	mspaint.exe
556	mspaint.exe
996	mspaint.exe
996	mspaint.exe
4220	mspaint.exe
4220	mspaint.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	firefox.exe
Token: SeDebugPrivilege	3268	firefox.exe
Token: SeDebugPrivilege	3268	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
3268	firefox.exe
1260	OpenWith.exe
2036	OpenWith.exe
556	mspaint.exe
556	mspaint.exe
556	mspaint.exe
556	mspaint.exe
996	mspaint.exe
996	mspaint.exe
996	mspaint.exe
996	mspaint.exe
4220	mspaint.exe
4220	mspaint.exe
4220	mspaint.exe
4220	mspaint.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3268	2608	firefox.exe	88
PID 2608 wrote to memory of 3268	2608	firefox.exe	88
PID 3268 wrote to memory of 4340	3268	firefox.exe	90
PID 3268 wrote to memory of 4340	3268	firefox.exe	90
PID 3268 wrote to memory of 4340	3268	firefox.exe	90
PID 3268 wrote to memory of 2680	3268	firefox.exe	91
PID 3268 wrote to memory of 2680	3268	firefox.exe	91
PID 3268 wrote to memory of 2680	3268	firefox.exe	91
PID 3268 wrote to memory of 2680	3268	firefox.exe	91
PID 3268 wrote to memory of 3932	3268	firefox.exe	92
PID 3268 wrote to memory of 3932	3268	firefox.exe	92
PID 3268 wrote to memory of 3932	3268	firefox.exe	92
PID 3268 wrote to memory of 3932	3268	firefox.exe	92
PID 3268 wrote to memory of 4796	3268	firefox.exe	93
PID 3268 wrote to memory of 4796	3268	firefox.exe	93
PID 3268 wrote to memory of 4796	3268	firefox.exe	93
PID 3268 wrote to memory of 5468	3268	firefox.exe	94
PID 3268 wrote to memory of 5468	3268	firefox.exe	94
PID 3268 wrote to memory of 5468	3268	firefox.exe	94
PID 3268 wrote to memory of 5468	3268	firefox.exe	94
PID 3268 wrote to memory of 3832	3268	firefox.exe	95
PID 3268 wrote to memory of 3832	3268	firefox.exe	95
PID 3268 wrote to memory of 3832	3268	firefox.exe	95
PID 3268 wrote to memory of 3832	3268	firefox.exe	95
PID 3268 wrote to memory of 3336	3268	firefox.exe	96
PID 3268 wrote to memory of 3336	3268	firefox.exe	96
PID 3268 wrote to memory of 3336	3268	firefox.exe	96
PID 3268 wrote to memory of 3336	3268	firefox.exe	96
PID 3268 wrote to memory of 4168	3268	firefox.exe	97
PID 3268 wrote to memory of 4168	3268	firefox.exe	97
PID 3268 wrote to memory of 4168	3268	firefox.exe	97
PID 3268 wrote to memory of 4168	3268	firefox.exe	97
PID 3268 wrote to memory of 3960	3268	firefox.exe	98
PID 3268 wrote to memory of 3960	3268	firefox.exe	98
PID 3268 wrote to memory of 3960	3268	firefox.exe	98
PID 3268 wrote to memory of 3960	3268	firefox.exe	98
PID 1260 wrote to memory of 2892	1260	OpenWith.exe	104
PID 2036 wrote to memory of 4444	2036	OpenWith.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Zalafina/QKeyMapper/archive/refs/heads/master.zip"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Zalafina/QKeyMapper/archive/refs/heads/master.zip
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {7b0f1d9e-35e3-4c63-b35f-f288ec7da567} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {0749c70d-e6cf-4e50-a8b1-f6d47a8ac394} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 25164 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {8e4a6279-5ded-43f8-9370-8c3d0947b0da} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27274 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {f485ab86-e31e-48a4-9757-cca36522911c} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4552 -prefsLen 34822 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3124 -initialChannelId {a9169ac9-0bf4-4599-8d7d-0b797702e0aa} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4604 -prefsLen 35010 -prefMapHandle 4552 -prefMapSize 270279 -ipcHandle 4560 -initialChannelId {164c6911-1ac6-4fa7-b634-8462ae14f193} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4568 -prefsLen 32992 -prefMapHandle 5044 -prefMapSize 270279 -jsInitHandle 4576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {9a0fc016-aa95-4076-81f1-cebdd6e0cb16} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32992 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5896 -initialChannelId {b3174637-94a4-44b5-a357-a78271a3a5d0} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6100 -prefsLen 32992 -prefMapHandle 6104 -prefMapSize 270279 -jsInitHandle 6108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6116 -initialChannelId {801e6417-0631-40db-a4c5-b8c112dede10} -parentPid 3268 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3268" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\6af2bb2e-890e-495b-bb22-d7410f92ed6c_QKeyMapper-master.zip.d6c\QKeyMapper-master\.claude\skills\qkeymapper-workflow\SKILL.md
  2⤵
  PID:2892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\d1f6b7d9-ce24-4f5d-95fd-019c152f12d5_QKeyMapper-master.zip.2d5\QKeyMapper-master\readme\QKeyMapper_README.md
  2⤵
  PID:4444

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\89f9b5e6-1a55-44b7-9525-dfdb89fe2bd2_QKeyMapper-master.zip.bd2\QKeyMapper-master\screenshot\QKeyMapper_QGroup_Number.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:400

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\9f8dd540-6c7d-433e-9200-238f89454c1a_QKeyMapper-master.zip.c1a\QKeyMapper-master\screenshot\QKeyMapper_screenshot_02.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:996

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\c09075af-e725-41c0-9be8-13f790d8df3a_QKeyMapper-master.zip.f3a\QKeyMapper-master\screenshot\QKeyMapper_screenshot_03.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 1adba15cb143bac8e0ea49bbe9d82a5841af4995f52acf338157efba55ddadfa
MD5 98b9fc06b9433784e69da5a853f6b49b
SHA1 97a56f1d1520be9d1e3a6b005ca1dd56b74ffd7b
SHA512 bc995b90df08143f0faadfd3639da1a865c912bc2b63e9a5f99d8b55591b60fff655687be21eb99797026ec66ac2cfc046f8352f74b6bf45a167bd1e76951dda
SSDEEP 384:HwCe7iO024YWdcs3hk2nhfdDE2Ba/rIVy8eMer+oer+3:QqZYWdv3hk2nhfS2sDIVy8u+d+3
TLSH
T1F9729DBBDF412C5D1967D989C5AD8369EC05F9BBCBF690B608243049C784326B0FA4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 53408825c63f7edbad4344b01d80b039667bfc70cac6ab6a6f4d5a3f4beee646
MD5 892252d5a60085689c7a8240e93877c2
SHA1 f2884c24de5e7b8e8de37bb120e9ba544f744d78
SHA512 2df7797f7cfe2dc53426a0569287fa842ce06ba1c484561582cba1e8a12ea81a609192c8c5fa7e426e73c9c1ae0aa22caab90fa332a8977bcfc81a17967cae70
SSDEEP 384:H9XghOiO024Yudcs3hk2nhfdDE2Ba/rIVy8e1ey:dX+ZYudv3hk2nhfS2sDIVy8s
TLSH
T1FF729D7F8F116C5929679585C8AD8379DD05F9ABCFF690A60824344AC78472AB0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a46f7ad49743beaf7469bacac76cf555020a634a957c69368f633ede113eb21e
MD5 f40d56fd67ca0cedd3409f1a13d1a4b2
SHA1 c7f1d3f24d99839f60fd3350bd30f9c1edca497a
SHA512 69b86f9fc38a60a04edc1f808c5f509d43eea3e2aa54b4ae40787edf11120e11914497baffce2c6c3c7b0a5f8eeefe04f93a8f45df1f1b6f564d830eb1ae2960
SSDEEP 192:jOv5zbo3ZAmyjHxyS1d66JoztdzgCl6mc0d7:sbo3ZAmyj5d66Joz/zgC1jt
TLSH
T12CD1ECA4F629567FC418023BCCA61F404F35385BA84E3F2971AC640C2D9B2DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 aefd6d1866cbf81bd20969037d4437dd4beff459ab5a05a55d5952ee6bca8ba7
MD5 65016d7bad0cd7d932c423df36d2c811
SHA1 f838061d7b4cca7ea65cf0f68e9cb8f5f7ad913b
SHA512 58281ce34541c0882852c876a3c68b5ce0d4eb0d83f1121dd888d50f300039d3b16bc192d8a7b012284dc1fe13973bce25d958df458676403b8f4755b3be1044
SSDEEP 192:LS1d66JoztdzgCl6mc0dDOv5zbo76ZAmyjv3PZ:wd66Joz/zgC1juboeZAmyjvR
TLSH
T1B1E10EA4E628867FC408437BCCA61F414F39384AAC4E7F19759D74082D9B2DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 079010528145945d10ca3b214419e9eb42aa3b706a3e7a4fa27e0350b99f4f67
MD5 b4a90b3964c7e506a8aa1b21c1b85831
SHA1 b9d1d76df7e170b8496cf54918eba4b284188a2d
SHA512 82ff73a3b985007743556f34b3fa95fbd690780a9670963a850141701b29b6270078937e7a8d31ddf43ea3ae7263857b9c432948913660346fbd2a583d26bf91
TLSH
T193216A4C3AB84D6A69CBEA9C7851168E93944F0604C71C834D62FF8CCED1ED9326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

01cceb2d-ce23-4499-b36d-bd00a88ec269

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\01cceb2d-ce23-4499-b36d-bd00a88ec269
Size 886B
SHA256 6b7e1faa60662816d6940b56c6a1e95944e7773a8703a0840294b1af68a8bb5e
MD5 441f3ac7d9013f662ec6c262130024b0
SHA1 6f3fa51fc2a701b9aecad2e207aab30837e6eb3a
SHA512 13cc80a53d51731b5a8eda9ed99774df04fd6d717e7c1159753fc694199f3f6ebb211b9bb91105e018983648b1a8c5b1480c27ee8ab98603e3b28fb9f49767ea
TLSH
T1D911D0509A35B9F1C838924B88B27742C7E4702380C619187D755A080EEE52E535A70B
MD5 SHA1 SHA512 TLSH

Submit Download

7c88c119-dd41-487d-af0a-180db491ffe8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\7c88c119-dd41-487d-af0a-180db491ffe8
Size 235B
SHA256 ab6d5212045837f02b4c557836a123033ea2a4b829f2ed44a248754e0381d367
MD5 edca02ae9e67399b4454386fd6bf45e3
SHA1 ec7324997957ceb43ca6469f38fd7a259bb16e29
SHA512 1e3d28effde42b4900f64707a90c10006878152bf05f30f1136c393f65a0d65d2d5d1f56a8239a5539f601ce53e72b22f35a29d548e6af9eb4bf672289f7e8ae
TLSH
T121D097C928C8777C08241F03B0B029C330998C3320B4E810D66109789DFE9C4423282F
MD5 SHA1 SHA512 TLSH

Submit Download

86e6269b-34f2-4b01-90fd-b7dbd3173a80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\86e6269b-34f2-4b01-90fd-b7dbd3173a80
Size 235B
SHA256 619e613411e26c88cc653b35ad39c74494b0aa53e9e22ff291dc560241f6da84
MD5 a25ede393d3f31d4a58ced4c54ef7fb4
SHA1 a5bc50cacd226b06c7def877987b9cfd216b30a1
SHA512 f280b39a4523aa5694cc50c12b0acd0992f668829a589c9d855732d8d2388d81a2578eb7f84a1798e446e12ef73f5a56ff9463acc699870b6565389f54c47e9e
TLSH
T1A9D097C038982B7D0C200F1AF0F13EC238D58C7318AAEC108690027499BEAD54111807
MD5 SHA1 SHA512 TLSH

Submit Download

b662cc79-d898-475f-94c3-a2aca68f99f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\b662cc79-d898-475f-94c3-a2aca68f99f2
Size 2KB
SHA256 d7ba40311ceb93d5c89ab3446407961ed856a2de54cc82cce8cde30f79fd2448
MD5 3171f4d2f0b5524dc7cce51bc088d9e5
SHA1 f8826f2aeb78ea637827a9a8a0fd173471094138
SHA512 25178b1a7f20247f9abfd77616fc69372c11a899bfa5e275281c018c4402fc371505d2dabc14888f9b3a53381caaf4023aef31d73da73f715ad1a96d399faec9
TLSH
T10941565836788D779CCAF65CC49133CE93A05A0354822C472D41EF0CCE9279E336A52F
MD5 SHA1 SHA512 TLSH

Submit Download

dbd71c61-bebc-4b54-ac0e-12f42917ee22

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\dbd71c61-bebc-4b54-ac0e-12f42917ee22
Size 16KB
SHA256 7dc23c6d47cd5feaef1f48e1e59016c4cf9e4a80293c5c87c7e21e19c0bf54f8
MD5 d98df9fc893f0d8e71c8a3ec18e60bba
SHA1 759d34916244b518344d9ff42c35b8ff372f86ed
SHA512 ce7006b4f8262e831ee9f025b22ac6669b8fbcd2c38f56cab63e3d060b4e1edda1090a4b0512afd79c663cf5f7b66daa21c5a4d3175def7df01297dfbda34c7c
SSDEEP 384:fnjH4AiI+2sq7srb9CGdAB2DrF+VNMJu3:PjH4Hryi4R
TLSH
T1D572C856286096BA8251E3A894BC7FC3E6F638CF4C019FCE97E47D085DDE05E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deb7717e-c6e4-44a2-8da1-8d1f091cab6c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\deb7717e-c6e4-44a2-8da1-8d1f091cab6c
Size 883B
SHA256 c56961849f73ef05f727e1d7252f7afc660e07de2939b06c83b0a8e676e9fbe9
MD5 8c17c14cda8c38f2e0e96dedcd192dbb
SHA1 38b9dbabac21682ca3efc20c9ebc6df6888cbfb8
SHA512 b401f7f02c0dccfaf7956497da8d9296a22acd5a90226b743888db628e5f3239b58a34f5e86889d912e511384e33608ecc575c39a0e53c5a5e699bcc777cd972
TLSH
T1CB1104809625B5F2CD38930FC5697742C7E4751384C6550C3EB56E080FBF52B575670B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
Size 16KB
SHA256 72634fa8d1162151ee15c9b890483be50d39caca8532da3e4a501f735d5decf2
MD5 5657f6a7c325f31a55aca31de4ed6ab5
SHA1 e56e7cf7e946a60d90c3bd2e2bee59f556f4e231
SHA512 781ed1b82330b26ee8870b226f26564afeeb74064300278b8b20f9871ccae9a1ec99545a42e89b560270795acbd7d705a7147f2b7031015dc40f56c2378d65ce
SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4Hb74h+:1I4vRfjXM4H6F4/4r4Y4x4P44
TLSH
T1E972521545049EB8294EA79AAA367E01C37D473B60845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 7KB
SHA256 a8ed64f80592fcd1121643d37f41b6ddfc7588ac795caa8f44d34a8ddd1a6b69
MD5 b47850c0414e65f0af4dc66c411962f9
SHA1 0ac2437847450e207951d9d4a8c549c445bbcc59
SHA512 f93299aa9abe68554f86820dc9a8a6fa3c5907e49e6f5fb403341fc43bf090b9f497abfcf77ab038265c9336159304e36845dd9c2d216bd1efeca0b34e1fe5f9
SSDEEP 96:xHSxTU4PqGqKDfU1YObzStWSSlvdv9jtnNeRWRk3EcSqZJgcBw88y78L4cn1V8Ax:cVCRKDfU1YDWSSE8RkUjuBw88fp
TLSH
T10DF11E385008CF7F74B6766CAC244D315A72023BB6BF68D650B99489054CF7442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 7ee7a6cd38146083f3199bf860b89f8f0949d9b4ab61f071adebe6d5a5d94c1f
MD5 3ea49636d0770151e54ed12398f9e1bf
SHA1 b74b0d4b915a6b6f6ae287b33593bcde6071c8c5
SHA512 8b0c0bed7e07ed63e526567cb3b3990f63883c25432cfba150ca88756cdb511bf7dee570b45e79c80a7ec7de19928ba7dd76e85accc96d7418de5c26d50b7d7b
SSDEEP 96:xHSUTU4PqGq1DfG1Y1zStWSSlvdv9jtnNeRHIcSqZJghBw88u8L4cn1VnAx:cICR1DfG1YMWSSE9IjzBw88jM
TLSH
T130E12F7890088FBF74B6776CAC688C316AB2013B7BBF68D650B55488055CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 1495067d15e854f97452213bd5d09d7f56c490b7f8ff751af779e3d718627c20
MD5 421a04d811d8ac201e919eb6901f1bbc
SHA1 237002a0dd066db75642c51b39101494b0c38a1b
SHA512 0b4e5c5a1b4f8212f67b3dec7598492a849762194e80eb76e635bd6e158c58629caf3f0489de0a6397ab41e47e785bb44cd3bf1226b19d97bc41f6abf06fe20d
SSDEEP 96:xHSUTUNqGq1DfG45G1zSLSSlvdv9j9nNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45GSSS49IjzBw88jM
TLSH
T171E1117894088F7F74B6776CAC6888316AB2013BBBBF68D610B554C5054CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 53d5109f9e69b506b79dc287d40be8c23fa239f8ec11cea2dbf35ebb12d6cc4e
MD5 8d9c1e7a12831e6416bfe9d2fe87567f
SHA1 aa843794a3c990f4386ca4b91375896663d4ece9
SHA512 c704a9d19e6b7747ac04e991dc8dd8975c93fa14bc8d07d24c51d528617bea708685cb5b0bae0482f000dfcaec30057a636d698c21d41ce389a5d756611434f0
TLSH
T12421D58B684739E9B701624E58870FB297DA20318EB52CF0D1CC8E8A59A98C9378D509
MD5 SHA1 SHA512 TLSH

Submit Download

QKeyMapper-master.B4OQeREP.zip.part

Path C:\Users\Admin\Downloads\QKeyMapper-master.B4OQeREP.zip.part
Size 38.1MB
SHA256 a84af9ce17a5f2dfd6c47bfa0f38a59f843285399605c8990d1d09173fab7f48
MD5 a6b3e46b96aa134e2f0a88fc36dfbb9e
SHA1 d97ed851e6028f0c50680f59df5c80d015c11dd2
SHA512 7b57d4ca72c6eab6d8a1896e24c4fbcc836f057d6d0755b0ef6574d100e2e854ddd5c143bb22ad875e62e9b1c328da9ee71feb8be308791e1b1d654289450bec
SSDEEP 786432:Tn4r2W26FEXbPLSGSrEKWD8+fFQQtWfMlFtfR9Gmi16HqCeM02o8Y6hOm69q3x6f:T4yWYPmGSIKWD8+irMZRji16HqCp0MYd
TLSH
T135973334C24DFD23C81274BDED442107FFABD0E06149E6225ADEA5BC2C0EA5657B963E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 979ecad2c0bff135f13b4ebbb55c702b9eab12741c5643623eb248b22f6d0bc4
MD5 ccffda175b925a826520b3f28aebb526
SHA1 d0277949debe984879da6d09fb619d33e41af94f
SHA512 7ff0ed525e13d2c9cfea05aa4155b6b99bfc513712cff37b760b0e938ff73a33b1aa3ff1e2dc5980a1a4093a9c95f6e98e3370c1ce4b3a2f0735de1e55421952
TLSH
T1E861C190C5D1691FE7CF310ACA751085175F98D669E210314E3FBFE9606E2AEE3EB406
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 311ca087088f3be17b4abaa72c2bad77fd7185ebef79e10a4adfbb06d5091763
MD5 f2816c3a0f098a047a966b229af0f8c7
SHA1 e27fd303d6b24de86363f423b4659f45efd80e6a
SHA512 efb0a61e37700f291fd3f5889511c7d84f67abe1f570d73019ff3dfecee02a206f60a27b8bb4743f164a1dc10f1047ed39b20cf8059116673aa4c059f8fbde44
SSDEEP 192:0QSm8S/S3Rzo2RXS7SwEYS3RzoPRBSS3RzoJRdSS3RzoJR1LS8US8DASSS8ZsnSo:0QSm8S/SHS7SwVSRSfSIS8US8DASSS84
TLSH
T148D1C2D0C591691FEBCF300ECA651085179FD8D695E110224E3FAFE6A06A29DE3EB446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download