Analysis
- user interaction
yes - max time kernel
130s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
Discord-Username-Checker-main/Checker.py
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Discord-Username-Checker-main/Checker.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Discord-Username-Checker-main/run.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Discord-Username-Checker-main/run.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Discord-Username-Checker-main/Checker.py
- Size 3KB
- Sample260727-rmjg6avarg
- SHA256 e33e66d51d2e18712eb5bd53b376e2fdd90cb50198f8332a42f78c6663b1e361
- MD5 3a13de48fae200df7b2527470f98057b
- SHA1 b601b4d02abfb59a0e2dae869bdac17bc35c0a44
- SHA512 d14d5d43bce1487c5e100f777e02804b5b21d0a458aeb71aab40f9c8388d4af81dd3162c704efe6e37780b7b9a73caae450eb71e6f1d868fc08156e441a50ae1
- TLSH T12B51DCBA1C0261210F71E4AC8CD8904CFB67F11369B83022BEBC46500FB5719AEA49BE
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3048 cmd.exe - Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\NotificationData OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 8c00310000000000e95c7779110050524f4752417e310000740009000400efbe8158443be95c77792e0000004c0400000000010000000000000000004a00000000002c4cb400500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff OpenWith.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 692 firefox.exe Token: SeDebugPrivilege 692 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 692 firefox.exe 692 firefox.exe 692 firefox.exe 692 firefox.exe 692 firefox.exe 692 firefox.exe 692 firefox.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4724 OpenWith.exe 4724 OpenWith.exe 692 firefox.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 4724 wrote to memory of 5088 4724 OpenWith.exe 92 PID 5088 wrote to memory of 692 5088 firefox.exe 93 PID 5088 wrote to memory of 692 5088 firefox.exe 93 PID 692 wrote to memory of 2244 692 firefox.exe 94 PID 692 wrote to memory of 2244 692 firefox.exe 94 PID 692 wrote to memory of 2244 692 firefox.exe 94 PID 692 wrote to memory of 3400 692 firefox.exe 95 PID 692 wrote to memory of 3400 692 firefox.exe 95 PID 692 wrote to memory of 3400 692 firefox.exe 95 PID 692 wrote to memory of 3400 692 firefox.exe 95 PID 692 wrote to memory of 2888 692 firefox.exe 96 PID 692 wrote to memory of 2888 692 firefox.exe 96 PID 692 wrote to memory of 2888 692 firefox.exe 96 PID 692 wrote to memory of 2888 692 firefox.exe 96 PID 692 wrote to memory of 4416 692 firefox.exe 97 PID 692 wrote to memory of 4416 692 firefox.exe 97 PID 692 wrote to memory of 4416 692 firefox.exe 97 PID 692 wrote to memory of 2004 692 firefox.exe 98 PID 692 wrote to memory of 2004 692 firefox.exe 98 PID 692 wrote to memory of 2004 692 firefox.exe 98 PID 692 wrote to memory of 2004 692 firefox.exe 98 PID 692 wrote to memory of 5872 692 firefox.exe 99 PID 692 wrote to memory of 5872 692 firefox.exe 99 PID 692 wrote to memory of 5872 692 firefox.exe 99 PID 692 wrote to memory of 5872 692 firefox.exe 99 PID 692 wrote to memory of 5268 692 firefox.exe 100 PID 692 wrote to memory of 5268 692 firefox.exe 100 PID 692 wrote to memory of 5268 692 firefox.exe 100 PID 692 wrote to memory of 5268 692 firefox.exe 100 PID 692 wrote to memory of 4972 692 firefox.exe 101 PID 692 wrote to memory of 4972 692 firefox.exe 101 PID 692 wrote to memory of 4972 692 firefox.exe 101 PID 692 wrote to memory of 4972 692 firefox.exe 101 PID 692 wrote to memory of 5656 692 firefox.exe 102 PID 692 wrote to memory of 5656 692 firefox.exe 102 PID 692 wrote to memory of 5656 692 firefox.exe 102 PID 692 wrote to memory of 5656 692 firefox.exe 102 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Username-Checker-main\Checker.py1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3048
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Discord-Username-Checker-main\Checker.py"2⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Discord-Username-Checker-main\Checker.py3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27098 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1756 -initialChannelId {a5fb9530-52ac-456e-8bda-bcd862b1e7d0} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:2244
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27134 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {b63cf13d-d353-4ef4-84c3-79ea8f8b9371} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
- Checks processor information in registry
PID:3400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27323 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {95da2db4-00e8-4d40-8ff7-8e7c6dd8ff61} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:2888
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27323 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4088 -initialChannelId {28f62a0e-6a93-4ff8-b464-33b8d2acaa49} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:4416
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34822 -prefMapHandle 4424 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3092 -initialChannelId {4b85c2cd-f88b-47f4-b7d9-e06d8ff9a0b9} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:2004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3016 -prefsLen 35010 -prefMapHandle 4872 -prefMapSize 270279 -ipcHandle 4680 -initialChannelId {91f536f0-8e61-4618-bfeb-3ee652526e6a} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {91d80901-b544-4919-a829-f034abe85b84} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32952 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {063de116-4732-4419-95f7-425606197925} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:4972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {f317b55f-b30a-471c-9f04-b6c1b4d73b8e} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5656
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 8058e887ed82e4bab2b24827fa2213da77e4be4fabde78106a0af43380693f9c
- MD5 447b82cc6b1f5e016c7e9447fefd562f
- SHA1 23ebcbb283b12909696ef0743fe1d0cba9265ea4
- SHA512 1cef6e8628ff5aa6d38a418970146eab4600fe157f2c9dcfa93a5f151a95409a345b853c2ced6de1f3d8eaf2473c3103018f27ff7c544495b31a81d3ae16903c
- SSDEEP 192:btOv5zbo7SZCQyjzxuf1d66JoztdzgCl6mc0dz:bCbomZCQyjgd66Joz/zgC1jd
- TLSH T172D1ECA9E639563FC418023BCCA60F400E35798AA84E3F1931AC641C2D572CE7ADE17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 1c745a53cab2b190d30b0c88bada1bdf20ff328a1637063b3b6e3eca3b168d40
- MD5 995769e5efb9e4c8e7463f1995677ea4
- SHA1 bef3b3f9075bba199fd0442241cbf563a6fbb02b
- SHA512 4fc0a2b889aef229e59e5b71fa42e97a721ca714008a44f4c8f4089d0c0e9567f866cdc79a53588db920e45989f8f847bcbfe9a2d51b507c7e2646c5b73d90ff
- SSDEEP 192:gf1d66JoztdzgCl6mc0dxtOv5zbo7SZCQyjjiY:wd66Joz/zgC1jHCbomZCQyj5
- TLSH T11DE11EA8E628963FC408427BCCA60F454F35388A9C4E3F19359C651C2D5B2DE76DE1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 9c98982bc1aca1aa23bd02b44f50b6d26fce9bf4942ce9ac6887f113daeb34ac
- MD5 ccfdbb93cc400e56ef931a2c20b83a19
- SHA1 d82ee9ab2a58411467696578aec63f05f6ad8d9c
- SHA512 5ca8a4c7311c46b5144d078ef2072cc5f4e7a9dabca67f680b5da8bf0bf421ae892ad2443d0a3b5c57af28e5775fc0fcd1ef6a2b1a56c2d9e6bd2f39c53de763
- SSDEEP 192:UtOv5zbo7SMCQyjzxdf1d66JoztdzgCl6mc0dz:UCbomMCQyjRd66Joz/zgC1jd
- TLSH T189D1FD69F639563FC418423BCCA60F400E75798AA84E3F1931EC641D2D5A2CE7ADD17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 02c6251d61f3d37c626347896f1e9a9bbb6d4bb46411f4930c403df2a8fa41f3
- MD5 a8210d2ed5694e2ac70b9325044a1ed1
- SHA1 2c6966491a475164502bde64d13be06e025f51c9
- SHA512 e198b33f4e49aa6f5ad2ebe61f949c4ca233dfc92a6d0c1886ffd0d4a88c4fecdaddafbc4f59ea3ab8a8c4c8e6dd88ac34abed8bc6da05c48c5e825d7fa8bcb2
- TLSH T1CB217C5CB5B94D6A5CC6F3987481028E57458E0745871D534D13FF8DCD91ADA3269438
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\23ca3488-d683-408d-9797-c29a6143f336
- Size 883B
- SHA256 c1b3a07c1d01af8c07dc794603d81bb117072890857939fa030c92b3e58e0795
- MD5 11552e57064eb3ecf04e301649981474
- SHA1 0bd1d5cfbcfa6f21cd1222c3d176e4781f8a67ec
- SHA512 e7f4a0cdfc9e6f2c4a51d008e532013f9630dd4f65a8dc5cd9f4fd3c3e9d9cc38f1ef5db6e2f682c767673059cad4ed96939be5968bc2236d9f276534975fccf
- TLSH T1511104D2A7347572CD7C924F8595375587F8B82380CA50083DA04E184E7E60FA3E6647
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\27c39393-9b25-44a4-b937-80db72d75493
- Size 15KB
- SHA256 1eb349eec904791a38511601bd6b70cd6da8f404786d2b075746667239aadf7d
- MD5 6669a522fce69adc05dfe1e4c8aae7e2
- SHA1 aa4698ccec9c3a8f01d679b9844e36e71da6d76b
- SHA512 e2700fe8e849efb73aa33ff356b62302a7412264951f73095633a5d53fc01279cdebc2bb59122ad95ec2e0f3b72233d9ba9f9576c580e060045e9d2b9b3decdd
- SSDEEP 192:4PmkXQIqnwKjjO/FUmcNIgPQpRz1bXHvVueyH4ZJHVkHQC+XoRLioYB+1NihL:vD6QPQpRhbXvVuZKNC+XoRexlL
- TLSH T1B362E9666420597B8551E36CD4EC7FC3F6F508CB8C029FCD9BE47D086AEA09E5127847
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\49b6125e-3ddb-43b2-82b2-9b695943320b
- Size 2KB
- SHA256 c24c2d475aa8e561b9bf3c33db98956007b013278ec9cbb820d403cb35a98321
- MD5 af1cfd4be2df6b2cb5e4f89484317b81
- SHA1 71ebe0eb85beded4145f8e59569de8fffaba5d97
- SHA512 47e70eefcf92eb50e3baa1a78c83bdb2aff17fbc76866489e1e5c6de8c3074cbb1ac867508ddc6544b456b137711a26207bf8909a980ec848d1d1fd3a297ccdc
- TLSH T17A4165AC35745D7B8C8AE64D80D3238E9770CE4344C258832D52EF4CCE9635E63BA527
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\a0406b91-dc6c-41bd-b51b-467cb357bc1a
- Size 235B
- SHA256 a46774858d5ed092c3ce42712e69d724854b29b4b8c73e8831acd19af0b179a8
- MD5 9f248ca3cc0e978b844e5dfed09f888e
- SHA1 07d0689a293c38d1c89b0877cf493b5124fec67c
- SHA512 c5eb55356b077b3c67697b88be80a8b27662e7be409a293b48607b6caab882ca7cbdd9391edce47122eddf203dd20873bb1d1cccd470cea0ad86fc2b14e9a9b4
- TLSH T1F9D097842488776D08000F1BB0F02DC330448C33A8A898608AE24574CAB8AC48251857
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\d980ee2b-5d26-4489-9474-70635d92b1cb
- Size 235B
- SHA256 96eb19c5dfb14ec08a0c1894bbdb4b53ec46a02ed4210c6de86dd964e86cb08c
- MD5 8a24fa4dc3a8c3ef268aa5acbc44cfed
- SHA1 f44a7a34264a9f65dabe1c993df43aea7a8648d4
- SHA512 bed53ba9334e0cdd4cebb3daa1da9a741ef883aa14f806b06fb1afaf2a21e0276fa4e539b31ff1e0deba58afa42c014e4cf04b8cd236cff16f1302b345d4e85e
- TLSH T1DFD0978014A86BAD18000F1AB4E06ADA31D84C3310616810D99102788EFDAC44262846
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\fc42b0b2-2566-43a9-ad0f-50f7085baffa
- Size 886B
- SHA256 2980eb35c95f5cdbad4cf31ab66874fd3a7570dbce22b8afc4b5bec6a72e01d2
- MD5 064ab7febb75ec121375f2810da33b0f
- SHA1 794195de06c6a2761a691fe741b9bc8e6b55ba01
- SHA512 80206aceafc58b530fc143479cefac7458a53df8e9888744aa681248c1f9d8ebbcb0b219a6e7b3cd40ba3347dcd72de467069278bc61a75f7388ddeed0c8e26f
- TLSH T1E91100D14635B5B2CC3CA28F85E13B478AF0B56380CA18483DA15F184EAE20FA3F6307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
- Size 6KB
- SHA256 97cc98f6e6506e2df562d75bfdde3b6a9ccfbe79ee118741369bb42196962f24
- MD5 d8c7da3beb7c1249d2537e5b45a39080
- SHA1 aeeee9aa655bc57792789ed3ead66d09b4fbf1d9
- SHA512 aa424b36a1333825f57f3dbbf92f61de6def084aff40f0b79a932e2ade00f967321947f554ad4592b8d94b8921e901acc73df40890a9f1792b6f76e5e93de1f5
- SSDEEP 96:xHGqUTUmK4qGqvfvJFObzSS9uSSlQdv9j4gnoRHmBw88u8L4cnSnL0:oqWKTRvfvJF49uSS959mBw88h
- TLSH T167E11E7891188F6F74B6776CAC6888316A72013B7BBF68D710BA54C4450CF3482F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
- Size 6KB
- SHA256 80a093cb40b4461fd710945dc18a727ba707235d02f56752353a6e6026e54046
- MD5 3cdcf3bb9851927541abdf64a49b4add
- SHA1 0af4506413b69b8d6f2807955e8758887c0f9ab6
- SHA512 33cc9fd6395b840262b78dd06ef0e7368e1d5d1d4ce384b4864092ab372ccd8681d39afb1f62dc94d2f6bb3c0e8cfc25d90bbe74c867c35769eaea848d462d72
- SSDEEP 96:xHGqUTUmK4qGqvfvnX1zS+SSlQdv9j4gnoRHmBw8828L4cnSqoL0:oqWKTRvfvnX7SS959mBw88fZ
- TLSH T1C1E11F7891188F7F74B6776CAC6888716A72013B7BBF68D610B954C4450CF3482F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionCheckpoints.json.tmp
- Size 288B
- SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
- MD5 948a7403e323297c6bb8a5c791b42866
- SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
- SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
- TLSH T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
- MD5 SHA1 SHA512 TLSH