1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26

Analysis

user interaction
yes
max time kernel
207s
max time network
175s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260722-rlms7aar9v
SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
MD5 eb557c8a6c10e7d92e2955fea2ac788b
SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
TLSH
T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 29 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3316	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	firefox.exe
Token: SeDebugPrivilege	2872	firefox.exe
Token: SeShutdownPrivilege	5392	svchost.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
2872	firefox.exe
3640	SecHealthUI.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 3316	2816	Madium-Bootstrapper.exe	89
PID 3316 wrote to memory of 3456	3316	msedgewebview2.exe	90
PID 3316 wrote to memory of 5504	3316	msedgewebview2.exe	92
PID 3316 wrote to memory of 5504	3316	msedgewebview2.exe	92
PID 3316 wrote to memory of 5504	3316	msedgewebview2.exe	92
PID 3316 wrote to memory of 5504	3316	msedgewebview2.exe	92
PID 3316 wrote to memory of 1112	3316	msedgewebview2.exe	93
PID 3316 wrote to memory of 292	3316	msedgewebview2.exe	94
PID 3316 wrote to memory of 292	3316	msedgewebview2.exe	94
PID 3316 wrote to memory of 292	3316	msedgewebview2.exe	94
PID 3316 wrote to memory of 3300	3316	msedgewebview2.exe	95
PID 3316 wrote to memory of 3300	3316	msedgewebview2.exe	95
PID 3316 wrote to memory of 3300	3316	msedgewebview2.exe	95
PID 3316 wrote to memory of 3300	3316	msedgewebview2.exe	95
PID 3316 wrote to memory of 3300	3316	msedgewebview2.exe	95
PID 4456 wrote to memory of 2872	4456	firefox.exe	99
PID 4456 wrote to memory of 2872	4456	firefox.exe	99
PID 2872 wrote to memory of 5844	2872	firefox.exe	100
PID 2872 wrote to memory of 5844	2872	firefox.exe	100
PID 2872 wrote to memory of 5844	2872	firefox.exe	100
PID 2872 wrote to memory of 5848	2872	firefox.exe	101
PID 2872 wrote to memory of 5848	2872	firefox.exe	101
PID 2872 wrote to memory of 5848	2872	firefox.exe	101
PID 2872 wrote to memory of 5848	2872	firefox.exe	101
PID 2872 wrote to memory of 4848	2872	firefox.exe	102
PID 2872 wrote to memory of 4848	2872	firefox.exe	102
PID 2872 wrote to memory of 4848	2872	firefox.exe	102
PID 2872 wrote to memory of 4848	2872	firefox.exe	102
PID 2872 wrote to memory of 4904	2872	firefox.exe	103
PID 2872 wrote to memory of 4904	2872	firefox.exe	103
PID 2872 wrote to memory of 4904	2872	firefox.exe	103
PID 2872 wrote to memory of 4964	2872	firefox.exe	104
PID 2872 wrote to memory of 4964	2872	firefox.exe	104
PID 2872 wrote to memory of 4964	2872	firefox.exe	104
PID 2872 wrote to memory of 4964	2872	firefox.exe	104
PID 2872 wrote to memory of 3464	2872	firefox.exe	105
PID 2872 wrote to memory of 3464	2872	firefox.exe	105
PID 2872 wrote to memory of 3464	2872	firefox.exe	105
PID 2872 wrote to memory of 3464	2872	firefox.exe	105
PID 2872 wrote to memory of 6156	2872	firefox.exe	106
PID 2872 wrote to memory of 6156	2872	firefox.exe	106
PID 2872 wrote to memory of 6156	2872	firefox.exe	106
PID 2872 wrote to memory of 6156	2872	firefox.exe	106
PID 2872 wrote to memory of 6164	2872	firefox.exe	107
PID 2872 wrote to memory of 6164	2872	firefox.exe	107
PID 2872 wrote to memory of 6164	2872	firefox.exe	107
PID 2872 wrote to memory of 6164	2872	firefox.exe	107
PID 2872 wrote to memory of 6200	2872	firefox.exe	108
PID 2872 wrote to memory of 6200	2872	firefox.exe	108
PID 2872 wrote to memory of 6200	2872	firefox.exe	108
PID 2872 wrote to memory of 6200	2872	firefox.exe	108
PID 2872 wrote to memory of 6016	2872	firefox.exe	109
PID 2872 wrote to memory of 6016	2872	firefox.exe	109
PID 2872 wrote to memory of 6016	2872	firefox.exe	109
PID 2872 wrote to memory of 6016	2872	firefox.exe	109
PID 2872 wrote to memory of 3280	2872	firefox.exe	110
PID 2872 wrote to memory of 3280	2872	firefox.exe	110
PID 2872 wrote to memory of 3280	2872	firefox.exe	110
PID 2872 wrote to memory of 3280	2872	firefox.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2816.4844.12807420633107995231 /pfhostedapp:85e0f72a77b43f703ee72b1479aee3921c0b9b5b
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView /prefetch:4 /pfhostedapp:85e0f72a77b43f703ee72b1479aee3921c0b9b5b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x160,0x188,0x18c,0x16c,0x194,0x7fff17fa5fd8,0x7fff17fa5fe4,0x7fff17fa5ff0
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1856 --field-trial-handle=1860,i,5877014988224214649,17251734664521880555,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:85e0f72a77b43f703ee72b1479aee3921c0b9b5b
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2028 --field-trial-handle=1860,i,5877014988224214649,17251734664521880555,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:85e0f72a77b43f703ee72b1479aee3921c0b9b5b
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2508 --field-trial-handle=1860,i,5877014988224214649,17251734664521880555,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:85e0f72a77b43f703ee72b1479aee3921c0b9b5b
    3⤵
    PID:292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1860,i,5877014988224214649,17251734664521880555,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:85e0f72a77b43f703ee72b1479aee3921c0b9b5b /prefetch:1
    3⤵
    PID:3300

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {afb7f3a4-b13a-4217-be19-3deb58c7d06c} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {603cd35f-67c3-4afd-b203-33f44352109a} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 27274 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {3aa5ea28-0666-432a-b105-78401b852201} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27274 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {6a3dd158-9673-482c-a862-3aecd278e64d} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2764 -prefsLen 34773 -prefMapHandle 2920 -prefMapSize 270279 -jsInitHandle 2924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2768 -initialChannelId {e91dc0a4-8129-4d30-814a-3b4f4793fb6b} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5052 -prefsLen 35010 -prefMapHandle 5056 -prefMapSize 270279 -ipcHandle 5060 -initialChannelId {dcab529a-ad2c-4f2c-a138-be9b415b8f97} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5256 -prefsLen 32952 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {4b20a761-e45f-4092-bbb5-ce2dc155b91f} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5464 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {38bf86e8-acc3-4f1f-953e-eb17d95c89ae} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32952 -prefMapHandle 5620 -prefMapSize 270279 -jsInitHandle 3036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5656 -initialChannelId {abd19a30-17e9-4a78-824e-48e9a109405a} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2860 -prefsLen 35458 -prefMapHandle 2992 -prefMapSize 270279 -jsInitHandle 3180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6592 -initialChannelId {109961b0-984a-4e85-a689-4eee4428a436} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 36845 -prefMapHandle 6724 -prefMapSize 270279 -jsInitHandle 6732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6728 -initialChannelId {280c1fd4-a30e-4e7a-975c-a95c1446890d} -parentPid 2872 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2872" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3280

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2488

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 0395676ac8cdc93d834314809d391ead66f958871da99572b50693e3c5489266
MD5 51457ef32057def26ef8a11c97412ebe
SHA1 af22d2df3682e07c7d222734a0ced0ffb4a95b05
SHA512 f692ea89cafc46e36cf329eb6d066171fffca0cf822c3511900162f3eb0f6d893ce3ff5605c69761729f5788733ee78a9230199f37c09b4e31dd51ca74d0629c
SSDEEP 384:HwCe7iO024Ypdcs3hk2nhfdDE2Ba/rIVy8eiw++w+f:QqZYpdv3hk2nhfS2sDIVy8s+F+f
TLSH
T15D729DBACF516C5D19179985C8AD536ADC15FAABCFF680B60824314AC784726B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 298ec3039acab524c819954c16b5ea160641afdf01e8a765129e4970ed8b725c
MD5 7f2f8c373266bc3468085fa9d1ef7180
SHA1 2f243479a8630cf9c413ae2ddcf7905f336e1b85
SHA512 37200784ab35e59a7dacb32974e7363961867155d5b47d04ddac15edd559c91194128caa3a11254cbb96bfca40cd60dd338ce9700cbe14731bafb87e2bcbe8ad
SSDEEP 384:H9XghOiO024YUdcs3hk2nhfdDE2Ba/rIVy8e1qe:dX+ZYUdv3hk2nhfS2sDIVy88
TLSH
T16A729DBF8F116C5929679585C8AD8379DD05F9ABCBF690A608243449C78472AF0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dcaa76ceeb56660521afc46b3db1f8bcfa1989138623e1601563296e448e9504
MD5 7156ec520e10c44af8bddc74b1fc47e3
SHA1 271b13710f9a3c79cf8d5c6ec632d629b925b71c
SHA512 11fc4b3a734d05789e682460b2fd1a517b4bea321ebcafcf47ce2f9e04d3addf4eb8c228f74ca7e20535e2b076f76ae87a96d2e010b846cb864cd5ebbd384d5f
TLSH
T1BFD02B13F212063ED01030730591E13C2E03B20F60124016F42E876C5A080D74B82CA2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 61e7a41b859832fd4354085f628c058a99f90ae816d4492799d6e7f83ec62d62
MD5 7feba21d853d43ad830642b647e01940
SHA1 b10983e8e324f0a74326d0a59cacda001a8b8c3a
SHA512 2bfc707d2f4b97474bd7e8769d21357774ca18e91e87ab25d67dadcf7978606b678f5156877ab141485b67c731deee69992bd2b3f035442c8004a52607442af8
TLSH
T1DBD0121336030534C01030370852610C1C02D10B80154401B42E866D1B040500B13842
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a83232fb18f9714674248af9b999838128f820bd945e6396c1af9e88d021a29d
MD5 b33e0637b86745abd05f32ed7282b6bb
SHA1 51c10da539d5c359c4180a41ebdb5bc63106c0f3
SHA512 a9e1cf8c847efb08e32affbd2e3da55f4ca1a648f34415a671a34615efb80c174a68e18717aa09fb3409e94c322b015165c69852d9f1274bc4d1e8c22df74f27
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8b51a61f-4f36-4ca2-b580-7567ec1c8b2c.tmp

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Default\8b51a61f-4f36-4ca2-b580-7567ec1c8b2c.tmp
Size 5KB
SHA256 2785fab70f85376c6a2718a05f109f223c6ff308e5740bfbb726452368ba4b8c
MD5 f6f17f1aafbff4fca92eb2ef1ba9c401
SHA1 e19af3fa839b851cd9e39240c4cfaf4e889b8ec8
SHA512 07703fcab2fb52f33bcd4cf982963ba32d861060ff02cb88b23d9c8619e14d369557f9102ab72a611054e70c558db83910c9d49ffc528fa5c85b32caec089ba0
SSDEEP 96:stb/dYbTWb9ZBkRo5h16ZZs7/x+6MhmuecmjeMK+gaI8XM1C7K:stj2QBoo+sV+Fij84g6K
TLSH
T158C1A6065E64697B4CC7E108BB3A7A03E2F9603275D11E58EBF8461C04EB5DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a475b.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Default\Network\Network Persistent State~RFe5a475b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Local State
Size 2KB
SHA256 6d333e9c75e3e6d69200629f5452f49edc1b9c26c98adc1931f5095f6c30f8a4
MD5 bedee3cbc32fb2af0fc7e960e7798031
SHA1 7959ecc95626c97b10bbf76f803afbaafb187600
SHA512 8d753ccf7f5dd0cd5d253b1ce7d89883d309c086dfb5811d04907a64414b5c47bd11400da99509bce279b0cb414b59e9bd4dd7e0a92c7c42ce5f260b84e70831
TLSH
T160518273A8905E3789F29608BB867F63DE6542A6FA522F51A6DD070C01CB64C2397C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Local State
Size 3KB
SHA256 3f8912a89fdced7f970d5dace5cbb033b3a6af01c95ea08b7e3cfa68de92223c
MD5 f4809e39fca8246c615947867efc705a
SHA1 19b673fa6e617202c5399da466c1fccdd4b83bd5
SHA512 9123a9d388c5e2b3bf6192ad9a14944806d9d5af52c6806877b9a11d9a2061e67509405b64c6ce1214d3685713fc7d0be05efb25394e4b65435766071dd46a25
TLSH
T12F71747BA9A099374DF29509BA862B16E7954127F9827F95E5EC0B0C01C728C1392C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Local State
Size 15KB
SHA256 5344f93f39368b1f76c86e43c9a0dc6a0c70a8e6725c2950236db216ef045902
MD5 90e59b43a5ca3f87b00a7b7b3acfe9f4
SHA1 755f4eb885ea8f38feba29b4236c71719bc09f6c
SHA512 ab777fc33b968f39cdc13542c880c523b284bc7f0db3a32999a565cdda755bc71f66e63615c040b1ac337ecd79f649d704ec80ab2f3e617727ede98508a21a31
SSDEEP 384:lsrv+89zHqlDNP9oid6NBSuiuoKnIckuNa:yrv+4UNbd0V5nIruNa
TLSH
T13A72AF33E478AB339DF29905B58A7E077B7851A7A6C24FA4E89D0B8C418B0D92347D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59aa8e.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{808B67BA-6DF1-4214-8852-51B9F057B289}\wv2\EBWebView\Local State~RFe59aa8e.TMP
Size 1KB
SHA256 31d868b8c01cd79f50ce866b3307e9632746cb3bffdaeccc512331a6bf231041
MD5 d4fe8bb328e10889c74b42dfbecd1188
SHA1 ab93ab856c57fb9d203fa26fd436fdb90311fc56
SHA512 6924a61e31fba9d2cf46b372daffdd853db562eae1dd67aa51918678b2cfa5790cd196674c43ae1e01f090b14b41b72af022f3e00a7c70fe6633d2b1f2347527
TLSH
T17B3160B295D01E339CA1610A7742BBA79E6101BBA2428F44B1DD870C12DB18C67ABD33
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\AlternateServices.bin
Size 7KB
SHA256 8d2e8b6c7d7cd4aa326d9162813665baa77c3d00c1ca04790b3e4f05d3fa8153
MD5 84aebae8961755c836227ebaf0e1659b
SHA1 8deedf92f7f7c904e8593734ef1ddd2ce9691470
SHA512 b55ca275f51f2fc8e4bf21ba5889737ebc3d206036e80876765284f78913a565c4bc476d0c5384ed6c674667f600d46cac5664310d34e0183b07e3c8de9609a8
SSDEEP 12:MUQphMQSQebLOpjlzOpKpgdXNIFnc3eFVISc3ew/IXjnc3eVf6I7c3ew/OXApjnx:nuhMZd+lzW92/Vdfw/GGB
TLSH
T1C1F134F35A72B022F4310FF1584A3A58EC3B062D5875D8C48B94F2DB0581BEAE02EF08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bc12bc668dc77878a2d0ba0694e0a26a7ccd26e673ecebc2636d5626a68f28ea
MD5 20d06e89db59833e12c0d0a5da6a1e2a
SHA1 6b929c5e7a70464dfc429cbfc07c159a5161d2e9
SHA512 c4776ae9ed2712d4802f58229ed30808e9dc171a90609a63b8b044cb072593f0a2df8cb530a5091e90facbdd870f41df0abc865439afaf41ee19199ff4298924
SSDEEP 192:gI1d66JoztdzgCl6mc0dDxYOv5zbo7JZQ2kyjH2iY:Td66Joz/zgC1jJxjbo9ZQ2kyjHi
TLSH
T183E11068E628863FC408127BCCA51F514F36388A988E3F1935DD75482D972DE3ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6e735885fa98e32f7245f26791138b8fdff1fc2cd3064ff3ae4ba420d8e4c34c
MD5 2642b6a137fd16ef55f540d620c6fae9
SHA1 09f3b14eb5e6f00a626ee75d5d94aa8e7b460d5e
SHA512 7068d9b29e7be59a614a23563c23e893c1b964b87fbf2b1524abcc77f06357b2e45918f035a285257e5d991bfe23932eb3529c537d1b46924640efabe14d89c0
SSDEEP 192:VxYOv5zbo7MQ2kyjH2icK1d66JoztdzgCl6mc0dz:VxjbowQ2kyjH/d66Joz/zgC1jd
TLSH
T184F12168E639863FC408127BCCA51F514F36388A988E3F1535EC64482D972DE7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ae5bd57e2a91f33c88748676a590d9e7e97aa7625d3a9259dd2a939cb6eb250b
MD5 3af5800c4335a8775b3691d4815cc5a7
SHA1 f172104716a5c4ce7f8311133fe4f177314f93ee
SHA512 926adcfb7a906ed69b1fdac7b0b4e2e37a2991e30860c14ad2a6ef3e7dba6e071052987640ff5040085397af9d0ca92f032e068420b4636980710f2ac1e8997b
TLSH
T18C219A8CB9F85D6BA887F29C745116CE53194E0A59936C430D12FF8CCEC1ED9316A839
MD5 SHA1 SHA512 TLSH

Submit Download

26af8fd7-f9c8-451e-8839-42b850806fcf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\26af8fd7-f9c8-451e-8839-42b850806fcf
Size 886B
SHA256 b71ee798996cf3c2e955e427e432ea447140eb7004cf7fb7d09b4a6dcb366e93
MD5 1c80c5f450976dcc3153cd29fcbbc7a5
SHA1 f590b77e3ace37f19c83bde2db92f95b5b6239a5
SHA512 19b383035d774cd825024582ac069417114ab16e6e8ddc623fb818cafdec2b9b91ba79553bc5b69f48609b8504f5940aa0a623857a6233daeec03ca9e988399f
TLSH
T1AC112380853979B2CC3CD14794E17B528BE4B423C0C669143DE05B084EFA52F57AB707
MD5 SHA1 SHA512 TLSH

Submit Download

32f90968-6b6d-4eea-add2-731daa3646e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\32f90968-6b6d-4eea-add2-731daa3646e2
Size 16KB
SHA256 c6f788d0e5b64521c580d64e28e6ff01c0eb5f297f04deb5ceb89796abd8b465
MD5 d83a3b68e363552800a3d303ba2a0f6d
SHA1 3f5f0c48d133c2f10b7152e60717fabdf6e17e3d
SHA512 b2228292c00ec48d55a532085bcfe263ca9dd7ac4dea6b8e892cd8a82dc74a431a77abc524eeeeccd3b8f95937086f8ecd7c15af92991df2fc2e7e309edb4abd
SSDEEP 192:X6csuwg6YCUNiJkDftGd1c7KEURsOcl8GYO5wBOUIZ1pL6JiGJ07hRtSzWYmQe02:6Kp8GYO5wcLmJgRtSyYmQe0owPwH
TLSH
T15372D9562860457A8251E36994FCBFC7E5F528CF4C419FCE9BE07E086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

341ba4d1-a75b-40d9-9a99-aeb8b6d4c182

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\341ba4d1-a75b-40d9-9a99-aeb8b6d4c182
Size 235B
SHA256 e5c0710026c32bfac44e4d42bc9cce70d331ff12256f124c95c99a165d44a180
MD5 8a21dd3b54cb415266e90eb165a99b3f
SHA1 8a3601887cfa3f0d42483d562e43b3bf89981b39
SHA512 d1686e6bee3a3d7f10b53eb751a3330cae223047db588bc41ee4926ebd3e54ce8cf2f80e22bb73d1c41dc4f6008a7a491b789634b372e4f2e02041631c7a1127
TLSH
T1D5D09788A4ECA72C08200F27F2E0B9C2328C8C33206058209A511635A9BADC8A25281F
MD5 SHA1 SHA512 TLSH

Submit Download

b6cf9d59-bbdd-44ae-9e1a-a08f69d28846

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\b6cf9d59-bbdd-44ae-9e1a-a08f69d28846
Size 2KB
SHA256 2bdae783267fd41cb9f4f8914cf2d8f6c31f88034d4ee3d1ba69127029f33a95
MD5 7a0b8180c9b637f3f0f262d3256d83b3
SHA1 e04de87b0715a1217e645720f2049bd9c1ff1990
SHA512 480c697a3eb3b16bc4e3c0902c59b1ae4bbd431829d9a927c5cc6f4ea014449ea733138c7071b8d5678eff48c29a5af0e970a04c7d755fa7ac8d2de9205284ef
TLSH
T10341235C35B85C769CDEF25D9082368EA3A4994314C628C32D91EF0CCE9669E336B42B
MD5 SHA1 SHA512 TLSH

Submit Download

dce26a1c-f123-4e08-b980-a8c7ccb3d8b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\dce26a1c-f123-4e08-b980-a8c7ccb3d8b8
Size 883B
SHA256 e53063685e09a805af8e2de1674680e0068d80deb70bfce8cfa150e63fd59f4e
MD5 92198a3a64469d8f6fe86570b934f772
SHA1 2097bc044edbcf9c265de271c3af388694693411
SHA512 5274c13e20ab66a1a9c682bc2cac75efc9566b678aac4a3a0795fce0966a8ef6791a12b5349e5c6e7d3bf9d523b822a6fec1aec8bdea0bef6e2c8da6a5dc0c17
TLSH
T1F2112384913479F2CC6C910F84957B1687F4B91380CA94243DF19E080FBE52F976B607
MD5 SHA1 SHA512 TLSH

Submit Download

ef548558-07b9-4dad-92f9-d90986c558e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\datareporting\glean\pending_pings\ef548558-07b9-4dad-92f9-d90986c558e0
Size 235B
SHA256 a6093e8f30e009cdd86bea3f989f19ef30db391f3eebd62c912cb4d7a268e937
MD5 03f42bf3e6c5238010948ed746b9d7b2
SHA1 f7cc0f5a3379f54ac22a3c58853654d34c38b51a
SHA512 ea944936cb2736db37b2abcfef0d34ef10012a48d5ce5ba6283218b1c0dde8ae9ef3426c85c84d91c1f86936dfa74760b1b580828abd952a0f3c8b6e06ed2d7b
TLSH
T11CD09790289C63AC0C020F03B0A4A9EA308A4C3B20B45810C5900174ADF8AC912A280B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\extensions.json
Size 16KB
SHA256 2ee241af6f1ce707084d8d73fbb68af0f2b90296643bd0a4c9f2ce519e83dd71
MD5 1b55069dfef87bc3040c2ea2a578de9c
SHA1 55e88aab8bc56bbfb3e51fc64de63cef4cf5b200
SHA512 49f0952fecc53d5f6ececd132f60eaa0d60f5aed9fcdbd8cad9dba415de7b359b5f98e3898c70157098de7c47756dac3097bb412ead7a9e38d940f0f568fd129
SSDEEP 384:WkI4vBUmldvnX8dhWD94zC96oPL4HXL4P2L4H/L4HZ7L4Hb+4hV:5I4pRfPMXW4y6U47404D4p4C4X
TLSH
T15D72531545148EB8294FA79AAA36BE01C37D473B70845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\prefs-1.js
Size 8KB
SHA256 b7bbc431d715afaa6c89830a8e33385a0fcda137d023a78d7923b96910fafbeb
MD5 25cf1b6d13eb8aeae5d916f9c5c55de9
SHA1 8aca68eedae19dfd0702b57660eea60f1a42db46
SHA512 4c81422dd2f959a696812d78971621e6416fcebc05355cbf64b60b55ec3019fdf239308f74c6b59f6fce324abcc5c1395c133ca9013f8a57e2fbf23ddd0ebacd
SSDEEP 192:nZCxeCKz3R87fMVVxfSSwROGipbBw88BUk:dK77ROLjw6k
TLSH
T128021E7C9004DF7F64B277ACAC2489316AA2063BB7BF68D710B95485055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\prefs.js
Size 6KB
SHA256 f6aeb19e3d44c1a6fade9abcd547b1d8b738daa6e09e4f3445ca8858d6189228
MD5 85f9850960da1faf8a98bc39c6488697
SHA1 5c1df99fbd1ae3301984fc3e9afb4aa07f7fb142
SHA512 5579f1cf7aa1e2f9748ec9c0ae3a505bd4c648853ac0947cc898996bd148c45b69a3bf54c6a8121c82240aa12ac3079cdb33911ed78ab997b8faa82060c2cd33
SSDEEP 96:xHZUTUyEqGq87fjyK1zSPNSSlvdv9jTHnsHrGi0SBw88u8L4cnW9zEuU:nC3R87fjyKKNSSUrGiZBw88pz
TLSH
T175E11E7890088B6F64B677ACAC6888316AB2013BB7BF68C750B554C5055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\prefs.js
Size 6KB
SHA256 df38498c41660cfc7d45ac84d4e67a134f84d585bf9d4873346646b43a6e1eed
MD5 8d0ff9a05300844e2222d5030492a0d4
SHA1 0dce9dce64fa1593c2c525e83690f3a6769a13ae
SHA512 a4979bb7501c7b5fa005d51cf4c70f85a3b184c17b70e8343c9af5260719916f8a16abd371ed1e5e9923e3bb05176674aea8884b75f2c8b8d927111df1bd60ef
SSDEEP 96:xHZUTUyEqGq87fjVx1zSJSSlvdv9j+nsHrGi0SBw88u8L4cnW9zEuU:nC3R87fjVxkSS5rGiZBw88pz
TLSH
T15EE11E7890089B6F64B6776CAC6888316AB2053BB7BF68C750B994C5015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 8b2eacdfa06ef334f9888189fa39ffe8d9ec02ca7b2974de607099cd02448064
MD5 9531500991a1e0616ffefca8068c5da7
SHA1 418212f2517dd681c8858d3b55f8d24a90e60bed
SHA512 79914dfc211afe8a357496190fc278dd635f3b9f8b7f25269eff19ea44b0e83d3df455c3f54f1318b4927ed7ea9a5f30f1cce00a568a6a98deb03fe4dc455501
TLSH
T12C21EAE23DB7EDFE7A45A00592D577B5C244389108D0D07178EDA1045B6F15F23AA61C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3cf4546c55b75dbd9370d8431e35afec7bd4ed3e12b66673de0257c673e718fc
MD5 e8828b44fe38d0b131fc6d54e0232446
SHA1 9fb2ee701366d64bcc7bf2baf2bcaf422cd79b45
SHA512 6ab6074db8c9ccd210b49ba5823ddfbb2039121f20f7dcd8277394e0ff4d8ea2360f7f7d1e559ba8b6b0e0116c41438609e76897cccd45ac8eb76fd19fe13ea6
TLSH
T1D921E9C27E7E50BD1AA1C23BA7DF77A5D54A2872CD21B4D3A9FC7000037D11B325A119
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6uwf3l8l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 0990a638d90f7be0aca501be1c869a793f685f49be52a44245b2d4c10e2c3f32
MD5 5e2ce91161387731d212462279c74d53
SHA1 dcc0cd96215408ccc53821842af0c39798196761
SHA512 e67380483e2e8bfb62680abd3398fe4335ec35836428961d9436ec4772a6e27c75b6b4d22dc2e0f6ff54ee6bacfa1beee215704bdba2892ac23055bfab2cbe02
SSDEEP 49152:FfOtOgrHIkRYiiFS5A0Het7oMX3haQxsQqm6UU9/iqIiBIa9mt77NabY464CCUkt:FGZz4Sm0Hu7oexa3
TLSH
T109765CE420E19253F38640B3719993EB20EFC01C6076CF44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3300-107-0x00007FFF39BC0000-0x00007FFF39BC1000-memory.dmp

Download

memory/5504-194-0x000001DF57AB0000-0x000001DF57B83000-memory.dmp

Download

memory/5504-30-0x00007FFF39BC0000-0x00007FFF39BC1000-memory.dmp

Download

memory/5504-195-0x000001DF57BB0000-0x000001DF57CE7000-memory.dmp

Download

memory/5964-1187-0x0000025859460000-0x0000025859585000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads