1a3d6ea267adacdd6e1fb37aee41515291dbf241ba9a21f96a1e10df48cb6514

Analysis

user interaction
yes
max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Grand Theft Auto Vtorrent_9977.exe
Size 574KB
Sample260728-gp2reafd36
SHA256 1a3d6ea267adacdd6e1fb37aee41515291dbf241ba9a21f96a1e10df48cb6514
MD5 8d42547051a8d3c842032d44e9a3607f
SHA1 044eb19d87043e58e0bfbdd0af0a5b0aa43b2971
SHA512 cd4e69fc8fe63e626919feba5972d2504e6fab16555df7ff144b0d27b4ea2827cdb25b72e82a9868da9856882ba25b22191e392a8f2bb11117da667eb3dbca54
SSDEEP 6144:BVKoPTErnpiQNxZiZx4j8D+iUbiBmBqW2HzZCtQfjbu9nCAsjGY/KnIKZOg+8GHl:BVKzrpiQNWZx4j8D+iUbmmc067k78
TLSH
T108C4182ABAB4CC26D17D05B14DE596F9F0B67D088C1D367B32987FBE4ABB146C80161C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
22	1536	Grand Theft Auto Vtorrent_9977.exe
35	5380	newsInst.exe
39	5380	newsInst.exe

Executes dropped EXE 4 IoCs

pid	Process
5380	newsInst.exe
4452	newsInst.exe
1732	anySignB.exe
3816	anySignB.exe

Loads dropped DLL 1 IoCs

pid	Process
5380	newsInst.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows TAnySign = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\newsInst.exe\""	newsInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\anySignB = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\anySignB.exe\""	newsInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\anySignB = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\anySignB.exe\""	anySignB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Faceutil = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Grand Theft Auto Vtorrent_9977.exe\""	Grand Theft Auto Vtorrent_9977.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Faceutil = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Grand Theft Auto Vtorrent_9977.exe\""	Grand Theft Auto Vtorrent_9977.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Grand Theft Auto Vtorrent_9977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newsInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newsInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anySignB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Grand Theft Auto Vtorrent_9977.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Grand Theft Auto Vtorrent_9977.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	Grand Theft Auto Vtorrent_9977.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Grand Theft Auto Vtorrent_9977.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	Grand Theft Auto Vtorrent_9977.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	firefox.exe
Token: SeDebugPrivilege	6124	firefox.exe
Token: SeBackupPrivilege	6008	svchost.exe
Token: SeRestorePrivilege	6008	svchost.exe
Token: SeSecurityPrivilege	6008	svchost.exe
Token: SeTakeOwnershipPrivilege	6008	svchost.exe
Token: 35	6008	svchost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
1536	Grand Theft Auto Vtorrent_9977.exe
1536	Grand Theft Auto Vtorrent_9977.exe
2472	Grand Theft Auto Vtorrent_9977.exe
2472	Grand Theft Auto Vtorrent_9977.exe
2472	Grand Theft Auto Vtorrent_9977.exe
1536	Grand Theft Auto Vtorrent_9977.exe
4924	OpenWith.exe
5380	newsInst.exe
5380	newsInst.exe
1100	OpenWith.exe
4452	newsInst.exe
2032	OpenWith.exe
1732	anySignB.exe
1732	anySignB.exe
3816	anySignB.exe
5380	newsInst.exe
5136	OpenWith.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 5380	1536	Grand Theft Auto Vtorrent_9977.exe	94
PID 1100 wrote to memory of 3336	1100	OpenWith.exe	98
PID 5380 wrote to memory of 1732	5380	newsInst.exe	102
PID 5136 wrote to memory of 4112	5136	OpenWith.exe	106
PID 4112 wrote to memory of 6124	4112	firefox.exe	107
PID 4112 wrote to memory of 6124	4112	firefox.exe	107
PID 6124 wrote to memory of 2472	6124	firefox.exe	108
PID 6124 wrote to memory of 2472	6124	firefox.exe	108
PID 6124 wrote to memory of 2472	6124	firefox.exe	108
PID 6124 wrote to memory of 5372	6124	firefox.exe	109
PID 6124 wrote to memory of 5372	6124	firefox.exe	109
PID 6124 wrote to memory of 5372	6124	firefox.exe	109
PID 6124 wrote to memory of 5372	6124	firefox.exe	109
PID 6124 wrote to memory of 2584	6124	firefox.exe	110
PID 6124 wrote to memory of 2584	6124	firefox.exe	110
PID 6124 wrote to memory of 2584	6124	firefox.exe	110
PID 6124 wrote to memory of 2584	6124	firefox.exe	110
PID 6124 wrote to memory of 1096	6124	firefox.exe	111
PID 6124 wrote to memory of 1096	6124	firefox.exe	111
PID 6124 wrote to memory of 1096	6124	firefox.exe	111
PID 6124 wrote to memory of 4592	6124	firefox.exe	112
PID 6124 wrote to memory of 4592	6124	firefox.exe	112
PID 6124 wrote to memory of 4592	6124	firefox.exe	112
PID 6124 wrote to memory of 4592	6124	firefox.exe	112
PID 6124 wrote to memory of 5944	6124	firefox.exe	113
PID 6124 wrote to memory of 5944	6124	firefox.exe	113
PID 6124 wrote to memory of 5944	6124	firefox.exe	113
PID 6124 wrote to memory of 5944	6124	firefox.exe	113
PID 6124 wrote to memory of 5604	6124	firefox.exe	114
PID 6124 wrote to memory of 5604	6124	firefox.exe	114
PID 6124 wrote to memory of 5604	6124	firefox.exe	114
PID 6124 wrote to memory of 5604	6124	firefox.exe	114
PID 6124 wrote to memory of 2736	6124	firefox.exe	115
PID 6124 wrote to memory of 2736	6124	firefox.exe	115
PID 6124 wrote to memory of 2736	6124	firefox.exe	115
PID 6124 wrote to memory of 2736	6124	firefox.exe	115
PID 6124 wrote to memory of 1280	6124	firefox.exe	116
PID 6124 wrote to memory of 1280	6124	firefox.exe	116
PID 6124 wrote to memory of 1280	6124	firefox.exe	116
PID 6124 wrote to memory of 1280	6124	firefox.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Grand Theft Auto Vtorrent_9977.exe
"C:\Users\Admin\AppData\Local\Temp\Grand Theft Auto Vtorrent_9977.exe"
1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\Temp\newsInst.exe
  "C:\Users\Admin\AppData\Local\Temp\newsInst.exe" /S
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Users\Admin\AppData\Local\Temp\anySignB.exe
    "C:\Users\Admin\AppData\Local\Temp\anySignB.exe" /S
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1732

C:\Users\Admin\AppData\Local\Temp\Grand Theft Auto Vtorrent_9977.exe
"C:\Users\Admin\AppData\Local\Temp\Grand Theft Auto Vtorrent_9977.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Grand Theft Auto V.torrent
  2⤵
  - Modifies registry class
  PID:3336

C:\Users\Admin\AppData\Local\Temp\newsInst.exe
"C:\Users\Admin\AppData\Local\Temp\newsInst.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2032

C:\Users\Admin\AppData\Local\Temp\anySignB.exe
"C:\Users\Admin\AppData\Local\Temp\anySignB.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\Grand Theft Auto V.torrent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\Grand Theft Auto V.torrent"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {d821c763-f099-4b01-8f91-dd7062f3f932} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {ddfc0c28-652d-4de9-882b-1287617267a3} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:5372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 27274 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {686d8433-38bb-432c-9069-f9ea1a7bd29c} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27274 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4148 -initialChannelId {21335c79-bdfd-4b07-ae8c-b34368a69205} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4476 -prefsLen 34773 -prefMapHandle 4480 -prefMapSize 270279 -jsInitHandle 4484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4492 -initialChannelId {104e3cc3-42a6-42fd-9394-1553bf80410e} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4980 -prefsLen 35010 -prefMapHandle 4984 -prefMapSize 270279 -ipcHandle 2764 -initialChannelId {c330c544-04a4-44b5-b320-562f4529f9a1} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5416 -prefsLen 32952 -prefMapHandle 4880 -prefMapSize 270279 -jsInitHandle 3044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {61381820-eba8-4a81-a732-707d15ad6912} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32952 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 3040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {da20c2a9-5861-4456-b96c-bfb6497de7bd} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2736
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5720 -prefsLen 32952 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 5728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5736 -initialChannelId {fe69330c-5c9f-482b-91ca-67370f5059b2} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

1BA618CE6674F5131EBFF555AE9E4251

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA618CE6674F5131EBFF555AE9E4251
Size 34KB
SHA256 12158e20e81c0185b707a233eb8a7c6b1749bd667c7bc6f34452ed32f2572339
MD5 65288fac2dc2a41d7fcefc6f3c54f5e4
SHA1 6fda7293b36936cc8b6fe7fd86d6eabacc7e7bbd
SHA512 c07c2938d4797d55962853ac7fd8d2fa5a6544c28db7356c330885575af40501004007cd320d1c498fcc5171e64a4898bfe787303c144356f6be60d2a7c2ba44
SSDEEP 768:57yhedtgo352Fm8euefMcKoQeG1oNtVUgMCYXTO36WXXle6GoMwx:5yAgo352zzefIoTUgMLXTuhHx
TLSH
T13AF22DA89C37B9659D078F5D8DEECB8666F213D41EC2922E0E307E409F12A97FB57040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

9BC173FC99082ADF0434734EF1BF0512

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9BC173FC99082ADF0434734EF1BF0512
Size 31KB
SHA256 8e5bde1118ab47d63e8dcc3e8c69c105a3e94b5003725e756c66662b63e3f83c
MD5 a00de28a9df6f37eddc0072e87f5f485
SHA1 759fbbfd8fc36b809e5669acb1ce72c8f6cb9ad9
SHA512 7ec14adcc3f4c0b4f4ddeaddd50c708534944a88b2814d72761ae20332db1cf096a7de551d54eb8a013c3a6ffef9b3fbec7bd766705c87c74d51df879b1217bf
SSDEEP 768:8z7Q0ccn7YXhz+XubYoeesK8FIhXzdPPr7XWI5/LBIJGkAEH:i5ccmKXhhcRSJRAs
TLSH
T178E21AA89C37B9A1AC078F558DDEDAC652F613D51DC282AE1E307E70AC13A97FB17044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A4B8DD7E9D7CA446113841925D8A9394

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A4B8DD7E9D7CA446113841925D8A9394
Size 34KB
SHA256 373719ce9d3a259829adcdea92a5532fe78c31d32164101c0ccc4ac1ab3c2d7a
MD5 5ab7781966a1fb474d2659856e9d9d22
SHA1 87d7e5036db0d555e1d29f8c5d839e83b5de8571
SHA512 ad4ca35c3429dc2d7e72fc2ae89fddfb21a0aa012a681e48b205ac5b7e868f0ee25ae5199ee5e2c3be18625bde3549e528990219ba84a6e782a31ecfae24f6f4
SSDEEP 768:KuKlqKCUfVzJVNa+DlVL8EXKq7T2nV2a8a1qLmJI1a:KvVCszXNrLzXrLmu8
TLSH
T198F23DA89C37FD659D378F65CEAEDA7656E602DD1D42822E0E307E509C13A97EB33040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 27328177922dca6ba9feb758ba6c5e94a6824852e95fe03fad8c682b8822a54d
MD5 891705f05541dcff6a01d2eea5f937d6
SHA1 b27d152f84546d7ded4b0333662295bd3af17aa3
SHA512 3b6e10146192fce628d1aa8c2eded18fcbfc484f78602731b66dc8e732789a32bc0ae879e18e13ce9248fec9a9b33c039d27adbecc0d677bde267fbc1061118d
TLSH
T17AC08C2C1EA20A16F2A8437C02C13D439B218101E3418F051AF23A89C996B162C78C2A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 04b57342e7888778ec4f67cd937eac850129eeba1d8c6aa2a40f540895296710
MD5 4ad0597745c6f2b3c0395ef4ad862ecc
SHA1 7f8376c7aef7ad5a722f3c9f91e27827cebdbfb2
SHA512 1050c00d3cea5d19cc66b6d4e80faaea8e85a8dacc321b14f59ffcbf0c68065724755fc4cd719048d4c7f451455feaa4349291218a7728bdd3bb8ead274a1166
TLSH
T12AC08C1C4A624606F2E4437D02C12D439B60C420F3458F0116F26A08CD11F942C74C28
MD5 SHA1 SHA512 TLSH

Submit Download

1BA618CE6674F5131EBFF555AE9E4251

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA618CE6674F5131EBFF555AE9E4251
Size 246B
SHA256 a0f0e92e99c00a2b85733cd8b736a715cc34a706bbcd3f5966b761530c00bbc2
MD5 764b98b4bdbba6f1018f3f028e1a3280
SHA1 45a1dc107368e8ac416c5112353f8fd7c68735ed
SHA512 5b7749f12576a13ecc1145af9dc87a8707a6346b5719c59564a678f2065b113db2b7ea44720779763130ac1b2b36ee29d80e52e7a45e02ab46d4e7c0e63a0576
TLSH
T129D0224C23E20312F8298B7B88200302DF24AC10A9D0170A0FB2510C2C2AE82ACB1C0C
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 6fde9fa14e5fa75f84d694b83afc84c78f7a69f67a8741ec39f7f7701c18a705
MD5 2f811c670750d757ca3a7cb0a36037de
SHA1 fac1164002de10ce5040244cc5ad01fe9e190b86
SHA512 b5b4d812f354615cd1300198a7b92a922260acb2350750cb9bfbbb8acf7b9527ea39d3fe4f84b10b7b1d161c6f8fbae9ced9f85b56cbcbc6f9e0760feb5d087e
TLSH
T153C08C181BA20A06E2EC0BBE22D02A839A14D001F3818F0A163E2A488C10B281C30C1D
MD5 SHA1 SHA512 TLSH

Submit Download

9BC173FC99082ADF0434734EF1BF0512

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9BC173FC99082ADF0434734EF1BF0512
Size 246B
SHA256 135c726f50996ccaf81b04c5a9de13887786910e979ffcedf0acd04aa2655080
MD5 d9dd1154768591d71336bdb76520a3cc
SHA1 6bab4a383d47e522891a29616993ffeaf915d80a
SHA512 9186d412f60830c7770626519f9c7ff6d13d4ffdf9d0b380d114fffae79f1d9f2e10cc222fa6f1c370d732df0b0e112835ec3eccacaf939bca1b47aded5a67d3
TLSH
T12CD0222823EE0222F0744232DCF402435D60334CE1823B8D1BA702CDCC2EB0208F0C4E
MD5 SHA1 SHA512 TLSH

Submit Download

A4B8DD7E9D7CA446113841925D8A9394

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A4B8DD7E9D7CA446113841925D8A9394
Size 246B
SHA256 88c4d14f75c309f7989a3e6a43096069c7fec06993ef4af649d0e1c3ab162077
MD5 624d70ace33ec0ebbe32a6e2e79c5fe5
SHA1 f119e7e97de9af13b2e49a3e6a05d8ed1437d5ed
SHA512 9f7c0ef63e6b0828247cfcbc2fbdbe457a9385378c3f6659e26861df7f4b31b56f07fdd081099061932a539f959d7b420a3baf9c664c545adaede185d1a4fe42
TLSH
T172D0223C0F610332F176D23539E006A0FB443218F1D14B080FA380C9CC1F70258A0C0C
MD5 SHA1 SHA512 TLSH

Submit Download

anySignB[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K3CCLSRG\anySignB[1].exe
Size 2.0MB
SHA256 47222755cd78efa8ef4a15d6c1ade1286a1aebc707e8add8fcf3e8dab599777f
MD5 b3d35b7a21ed48ad39830956cacdd0ab
SHA1 8bb892b508c71ad3d043171d6c13a387296436c2
SHA512 792af523a999aeff38fb603c40ef495c06307aa5d1e81e9b980ed28369534e775ce5ee1d936142db55f0c63bc0b96ffcf52095115d2aa458fbb6318ef8cc7eb5
SSDEEP 49152:C/6855Ihc/o7kSlDhTY0wg85KTRMglP+0bbzqhign:C/BqS/oISdhTY1aTRMglP/bzqhi2
TLSH
T1A1A56D21795078BAC1D30D31790AF379F1BDE5F00B3945C35394AA18292D792BB26EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

frameC[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K3CCLSRG\frameC[1].htm
Size 12B
SHA256 713ecdcd3b37a2b11487d8fb01344281c0265fa42c8eb2fba2f8571902ddff6a
MD5 fa830d931af000e5799e3e2546f294f4
SHA1 9fbc13fe32b674947227a34c6cfa810797dad18b
SHA512 ed4ffb17ee215bbef6fde3e1ea0c61127d11ae56d21510d8e2b6443c21bfe94ad3e302f66ba5245556a7d20495233f00aa66b4a11f3429fa12b06a574e5a3340
MD5 SHA1 SHA512

Submit Download

frameUB[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q9JKSWFP\frameUB[1].htm
Size 88B
SHA256 8aa2deba072a582d4b333e151c8c82251c1e5af7d49abb3b8eec64caf41b0f21
MD5 91969bcf8e3f8529265add2c59e274f1
SHA1 7ec0b1e8215c0dc9afc2f5e36ccec1b92491ea45
SHA512 054a8ef29f9098232633c6cb4e196a1e06250fe896584a3654c3b285a62580784ebcacff23240787916cf1cd4aa0e6e0339d4c567b3b37e388bd4c6d100ddb3f
TLSH
T11BB012172499184135E2601A3868125D8291266101100063196506C194019D43144101
MD5 SHA1 SHA512 TLSH

Submit Download

44BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\44BE.tmp
Size 76B
SHA256 f9519a817f8f7f29b0f92b6c27b738f17f3d19ddf0570c35153cd10cdb07b756
MD5 36155df13d5a411c69438780303a3a05
SHA1 5a01897cc607a75a5eb42fd61a9651d10257fc4a
SHA512 8a372e89578bbb8764b762f84de805d7d0cffd33cedf87747ab5de525a5a45bc4ec7e9bf2a1b4f455482264bc9445cc6ad7399f704eca3ac87549e78109fb0b0
TLSH
T160A0222322FB2C20B2F3C0228C3022AC0BA83232080080220CF30BCAE2028E83080082
MD5 SHA1 SHA512 TLSH

Submit Download

44F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\44F0.tmp
Size 261B
SHA256 3a7b18b8be9beea84e20080ce0905b77da48dbd044897dec66d62d63a82dc53e
MD5 7c4814474cedae1ede31b10a10d2184d
SHA1 a733e89499884700ef7b2ae54c6297578cef3eb0
SHA512 3afe2b8511463f202e39ef66117a8de408e424754381fcb141908ee00fbe80748f83b6e63776a8b09c410be1be6ea580ddfbe06672797ef0d4d8c2abdfce86a9
TLSH
T186D0A77BD0BE7198935B4B41ED0A4034A11755EE38C27F8145444FCF655D1A612D571C
MD5 SHA1 SHA512 TLSH

Submit Download

A743.tmp

Path C:\Users\Admin\AppData\Local\Temp\A743.tmp
Size 60B
SHA256 dade480853b0ed8afd800b3d4f23921abcc567a84204b0e7dd511e5d971ad7e9
MD5 6fa0c729bb343addba93f430f975fefd
SHA1 c52c1c95458d75a0203c9bc22fa7f32a97c1c9dc
SHA512 402902ee31d150b05e7afaeccbb8ec3df54d41d91308c71edbb65039ea5d735feb04a1792439c60a9a2c0e5c60f1928431f662ea4529a946ea264beb01d489e8
TLSH
T16FA0028042C34E091E6ED4714165CBB0555747E189A4068F067E474210560A05978CD4
MD5 SHA1 SHA512 TLSH

Submit Download

A876.tmp

Path C:\Users\Admin\AppData\Local\Temp\A876.tmp
Size 14B
SHA256 6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012
MD5 cd5a4d3fdd5bffc16bf959ef75cf37bc
SHA1 33bf88d5b82df3723d5863c7d23445e345828904
SHA512 8d244ed4b6f754c887a9f020e714660493fdf8238cd0ee213a834d78ae3f9dc492b5893a3544ac1489ced1ff04cf0d34539b8da9c24994a09116598209354ee0
MD5 SHA1 SHA512

Submit Download

B7DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\B7DE.tmp
Size 419B
SHA256 6668ec6c12bee1f62d54f9488b2ec2dc65d3ca5676f2ec6e3ba06f763d959efc
MD5 b81e7889884fdb32a5fbeecd0ef7a1ab
SHA1 330bd8a4f0a9dd4eb035a2aded8e4c1d753f2eec
SHA512 6ce1ef9bdf168eff25aa7f0ccc71fa06175bf0911619e756a5e06064a2a4d8c05e9749213491615c4faf7fce0f671c1c9466898816ce7753ac6c96a1699790e8
TLSH
T11DE0AB706E7411417B5B19B745B3264D3EE44016AE171281B3AB5C21923A2F0391AED4
MD5 SHA1 SHA512 TLSH

Submit Download

BFCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\BFCE.tmp
Size 11B
SHA256 2740c4d63121e897bfd8a219ff559099da8f564625872b1aa74fea9942dbe60e
MD5 441a9c4af7672f4ef53da6f53ccfe9ba
SHA1 b907765178695a8b73711bbfcec500dbfd36c22f
SHA512 a7e6b542963ae940bb4763b38088bdd4c58b5b13d813be5e88228fc41ab0b39d5251e60db3c439b66419d652c7a157713362ecfdf9d2b872b038c4eeefdaf92b
MD5 SHA1 SHA512

Submit Download

C107.tmp

Path C:\Users\Admin\AppData\Local\Temp\C107.tmp
Size 1B
SHA256 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a
MD5 a87ff679a2f3e71d9181a67b7542122c
SHA1 1b6453892473a467d07372d45eb05abc2031647a
SHA512 a321d8b405e3ef2604959847b36d171eebebc4a8941dc70a4784935a4fca5d5813de84dfa049f06549aa61b20848c1633ce81b675286ea8fb53db240d831c568
MD5 SHA1 SHA512

Submit Download

E6EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\E6EB.tmp
Size 2B
SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
MD5 444bcb3a3fcf8389296c49467f27e1d6
SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA512 9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570
MD5 SHA1 SHA512

Submit Download

netcfg.dll

Path C:\Users\Admin\AppData\Local\Temp\netcfg.dll
Size 3.5MB
SHA256 8e623de2e2cc0d122874fd2733601aa865721845f6575a48d74862133073b5f1
MD5 a9b66c1efdaccce5d809aede3ccc98b9
SHA1 5e26166659da7d18877be65d1d9d9b2f4b20d367
SHA512 a8912cce31282974606cda5a0c13426d9fede02fc874991cc05976151204417e76668ef02d3b1d70afcb72b60a3c899058f533ccaeae3856bef4075d776ddebe
SSDEEP 98304:Yk4hfGAJUk8bMFIRKztvBqFhmxoIACiE7FLOAkGkzdnEVomFHKnPH9:J4lUkt7xoIACi6FLOyomFHKnPH9
TLSH
T11B06C025BD4E807ED05ED1314959A6B8F1BEFC70173603CB9190F73DA9366824A84EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newsInst.exe

Path C:\Users\Admin\AppData\Local\Temp\newsInst.exe
Size 2.0MB
SHA256 f10c7589045aed05217c6abe3610e64a37419185b94a417968c4eea2de39b4a6
MD5 b6144c027acb14cdf6900391f76b84a6
SHA1 191dc6be91e1ad2b87055678a58adab6e428249a
SHA512 c0db6622c5920117e77448fdec4b2817ee2cf9aaa43b03810fd0f10dd395ad1d821e094bb5053e276b1f7d9fcdbaf45ac6c2df7358266347222bbdf859b675e7
SSDEEP 49152:4H0Y9eGRHfezof3VraZovbnnX3LvD/t1SUDcCdtvM:4HHjlfezg3NaZoDX3LvD/t1SUDcUt0
TLSH
T123A55B29F6504866D1630F31BD08F77CF1BDA6680B3941C3B394AA38EA774C29625D6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f7a4ea25199a7c9edfb04c3b3e32ce614406a61a5a0f6831fb606853610d181c
MD5 a0cfb2fb930e6c7b124716975e023c4d
SHA1 4f3eade2e0678a8f0410763a398057a7c22060a3
SHA512 a82bd0e86ddf5a879ea5371eed28fe2f55b7448fe4a907ff740417173ebe0fbded27a3ff291c61d0c7c53a5d6808b6f6481ef8f5dd3b11753732061f5a47c1a7
SSDEEP 192:/Ov5zbo7tmAyjX+bo2G1d66JoztdzgCl6mc0dz:wboRmAyjX2gd66Joz/zgC1jd
TLSH
T1CCF12268EA29463BC408427BDCA61F414F3A384B985E3F1531ED644C2D572DE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 00297accea1fe7769575824e11b2f1ee6e5b0001cae7a859342bfe2c480bee2d
MD5 9d1dbde30cc97fb32526fe9dde94cc4c
SHA1 721d082dcf33c860f03d063e488f0d91f81c4a23
SHA512 dfa56b44edc31dc63086ded1bdeaf4392fac4dbd601481cf5ab3a49c42745982a9737af7770cd4a0cff5210fb60fe96dbedff61e0430f8055bc4a8684cc270e2
SSDEEP 96:dtVKE2FcFBmFjF5/dd66JoztdzgClKtmc0d/Ul+HSdF95/7bkW6ArcEAHAyUR6dU:7o2e1d66JoztdzgCl6mc0d7Ov5zbo8bF
TLSH
T131C1DD28E639563BC408423BCCB61F410E36384B989E3F2531ED64482D5B2DE7B8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 36e8fb03f908aad0aefc61376737bcec4edb77314736d7b1a8dee6c557991941
MD5 f1493c484e6223e276827071f121de05
SHA1 cb004e972076ad638b765fc644b839f1d771688a
SHA512 b31647dbaf9378421a1eec2da5814071d62bb090ccc300d869b67a584e4aae9ea2c481664de72151e6ce7f746164cf9968d15cf4554f952b1179f6d65a87014e
SSDEEP 192:7o2e1d66JoztdzgCl6mc0dDOv5zbo7bZmAyjX+o:M24d66Joz/zgC1jmbo3ZmAyjJ
TLSH
T121E11168EA29863BC408427BDCA61F414F3A384B984E3F19319D644C2D572DE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6b252f58bf3f7dbe588bc9fe58d74d450c147a4a8db088a30dd69203499b8ce1
MD5 31535bfd7324a751b3e8cdd1dd964738
SHA1 4ef5df68596e78e47453c74a0e46f2ce4d15ddac
SHA512 65ee88be664803b8abe70e085d92171f7d402dbc053c76b990f59a3ef3a7a10bd4165fef2c3d9a0752a08b94593125c9849449e66f2a6077d548c45b0fb2ca9f
TLSH
T1DA21289C3DF84D6A9CC7E3987C91028F57598A0744872D474E02EE8DCE95ADA326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

4d1df601-ee5a-49cc-8462-4bfce048f3f5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\4d1df601-ee5a-49cc-8462-4bfce048f3f5
Size 883B
SHA256 bbc67c6df893cc8dc9a01ea42bdddd877b889da28aa3a9f903c1fa66fa297db7
MD5 953b48dd080e9b3a95ef2f051c3959d9
SHA1 08c9797ce7da413adf526f37148ee51c78b4531a
SHA512 2645f752ae48efadb4d72c02f23b9164337403ec21b7cb3ccbd77104ee30251962e42a6a7a2b598dd3d58a98107990a50260d384a29ead21d7743d4166047e19
TLSH
T13C11C0409539B972CC28D24B88967B43DBE9B82380C655143DE19E140EBE51FEB9A247
MD5 SHA1 SHA512 TLSH

Submit Download

5525d3bf-e106-4d4d-b9a4-c238efd9adff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5525d3bf-e106-4d4d-b9a4-c238efd9adff
Size 734B
SHA256 4c2693a94320e0d43941018a9edf36b3c2314a4cb9347ab49933891cfd5dd2ff
MD5 cc6c8a283ad17e3b19a012596985bae1
SHA1 cf90dddc072cc9f95401dfc5b7b0bf517ffae4b0
SHA512 64d2cc38de93d6a0b5580da202e552c6215ceb668a67ed183c306861a6aeba7a35ee9e2345b891c483374ffdf6abbaa169d0147e3e6048a2dde6b626a24d58c0
TLSH
T1C601DCA18922B532DC78D74DC96A3B4AD2E5A832D0C600256EE489180EFF12FD66270B
MD5 SHA1 SHA512 TLSH

Submit Download

72f9dd52-41e5-4357-a3b0-8e46fb93e4f8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\72f9dd52-41e5-4357-a3b0-8e46fb93e4f8
Size 235B
SHA256 967317ed6f4909a71d127882008a800cb0be6d6b05d55017ab2909ca9c324c06
MD5 622783df8b296b8cdec8538520dc94be
SHA1 8d0c7bdcdb480bb767b60d83af7a8c82f5a482aa
SHA512 187249fe4686bfdb1adb3d056d4f5e429a7e2468ba9bebb3a79a0a5c90e6149bbec132147d3c0348d0e37c4d9da4c47c487526b1b9ca78e2645217756946acfa
TLSH
T1F2D097A034A8B31E08100F0BB4F029C670868C3314A1585086698574EAFEDCC0161886
MD5 SHA1 SHA512 TLSH

Submit Download

74f571c6-b8f6-4c95-954b-e6a63a087dcb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\74f571c6-b8f6-4c95-954b-e6a63a087dcb
Size 2KB
SHA256 1e325414876197ffc153c4e507ab4b5d54277d4b6f4faaaf6f6e1c1d5e671e1a
MD5 3068a0d46f7903858dd3170b74ab1c34
SHA1 0793887792e28020b552e197e3213f48a00ffb1b
SHA512 d19f149b9d0a8d1229c28c1a32d156c3822e18aaf2fd978b590620c7c9f4c2e9c8634555badb34edb1a01d11764c44db8511565448650391143d1162ef946d32
TLSH
T1A341825C387C5C769CDAF94D94A333CE9324DA4300C218532E62EE0C8EE679E776A527
MD5 SHA1 SHA512 TLSH

Submit Download

96777601-7e9a-4695-922e-a081b8451d78

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\96777601-7e9a-4695-922e-a081b8451d78
Size 16KB
SHA256 f9ed8c0e56c0ede69a49ad75b52b6f2e31de2a1dcc8f4d3e134e2ec6c33c4a65
MD5 8c023d064c7d5e70acd68cd50efc1eec
SHA1 9d8190c2f9c36adcc6b172b014f05ad2e37b51c6
SHA512 a82128c58e5b2898a34d77ed671b046f8fc06d8ae91bb00c5f62a2b71b54e6b7977386b92c33df2bd3dbc17f9a0603a9519b4b8f15eb449a9ff5f84a76dac2f0
SSDEEP 192:ZH52E8zEMu1ewBub119A2R6u12ABt6BXDWi0uaopL1SzxCuioKQTEu/Jm+NyJ:V52E8huEwE/4u/Q1SlNioKQgkNs
TLSH
T19472EA56682055BA8591E368D4FC7FC7E2F538CF4C019FCA9BE4BD0869DE06E112788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1644607-8af7-4528-b54e-c406b3daa14a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\f1644607-8af7-4528-b54e-c406b3daa14a
Size 235B
SHA256 b2d6b2248369ed19c5d02c3e0b33e06a35072bc6353667e0f13537ecf49a0c6a
MD5 2ba00b9e9e401e73c3748bc566c668b6
SHA1 94d07d58b039c69f660fafcc077c4de3a5fb9a83
SHA512 fb50df7b4384e6ff062de37c6b32c1476ea9ecbb55c22b6c3bb831c5a1700f0b1a6e7bebd08a715454cd0963f21576cfedecc3f2d5211fad832057c1bea38129
TLSH
T1FFD09780248CB39E08548F47F0E129CA31844C331074A820955219748BB9DC74213806
MD5 SHA1 SHA512 TLSH

Submit Download

f47a5fd5-c930-4a56-abdf-82c6b3e508ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\f47a5fd5-c930-4a56-abdf-82c6b3e508ec
Size 886B
SHA256 b54b430f14a4c7b0fd0d6cd09a46b7b80a4520e7a117e729f333e7f79dfc4db4
MD5 c9fa4192e1e9eec42a52671c433784d0
SHA1 5772f258241deb17c42b601a6a0a140f45df5d65
SHA512 773ad73412e98b6ad011027ea7786c863f6d39acbdcbdb00095135e54989624b642181bae7c3d17240107d7c60610138f4498cb59654530ad01a3a6e2aad4d14
TLSH
T1241100408A35B972CC28D24BC9A27B838BE47413C0C619147DA15B180EEF52FABAB347
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 6KB
SHA256 1aeadf8f92289381cea2e57efc795db75fd450062c12779035bc58c384ffd01e
MD5 d0de38fb333fa3a3ef1117e407867260
SHA1 069335c281b7e6e1a31aa036d1caeda11e6de0c3
SHA512 b9819919e824538ff18e1a372c3ab60285e66bd27975599f85b8970aba051f1c437a831bb4104317ffd23f463882ed56c906a7b0485501ef4d66bc751d1c5645
SSDEEP 96:xHdUTUZqGqofyrB1zSuRSSlcdv9jRHnUHgYETBw88u8L4cn7yTM:P0RofyrBvRSSZgYeBw887
TLSH
T197E11F7894088B7F74B677ACAC648C316AB2413BB7BF68D710B58485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 411711f15a03a97d4270c2af7e70095b1f17a570e0950b7f541d8ac2a647b3ab
MD5 2197ebfe2b292d5eb098d5332f6973a7
SHA1 2804b660abac2321b21daa342a621e8b73af8858
SHA512 ffdbe9fb21c2cea9588e99110bb818f6984ae2d5366badb28c853526a9fa542aaf66b62b4477bc70d13a0c75e7b3023d87306a5b1742ecea70496dd18bcc3157
SSDEEP 96:xHdUTUZqGqofyP21zS0SSlcdv9jFnUHgYETBw88u8L4cn7yTM:P0RofyP2RSS9gYeBw887
TLSH
T10BE1207890088B7F74B677ACAC648C316AB2017BBBBF68C710B54485054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 e2ab0b15438db91eb2a067744886e0248e6062944f5b146110f9eeee4fea5e01
MD5 22edb3b72e38a1f76c7d2ad7e1005d75
SHA1 e1172c5092ae6f7f67f7a1364f1b205e2a0e72bd
SHA512 89b263a6112cc52e4eea8bae08ac623237f7d6893d65b029959ed69f5c71b2de6e7aef64767c4949437971ff13f4be2f5a45c7b9b4828051c4c53ecd8d7d9778
SSDEEP 49152:cMcEwBxG7+CIUYSLibqMTxK+o/ktCpogcK:FcHmibH1Kj/ktCpogn
TLSH
T1F24629E860D1A257F3814033724993EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Grand Theft Auto V.torrent

Path C:\Users\Admin\Desktop\Grand Theft Auto V.torrent
Size 330KB
SHA256 5066b807a9c982de62dc9ea32886bd561852463ae25bf4ad373c6f5b20dc6a87
MD5 73340875d3730c45f5db65fe293f4310
SHA1 4110611d8b9baaf9724e7f0d055d7d1e6de4f5f9
SHA512 3b75f952bc3ff0d2da803dc1bd9118189c7486de7e8aa3230b0f267ac4e06d87d5791769322a78de1488a68bf37dffb831d154801d371e964d5ee86f65ebe2e9
SSDEEP 6144:II6IqtJOsOVXX1dU4rc+m/guQ0b1INPdKfuzUkJmOI47cGMd8KeKdbsqoDXgWQob:IQqtsVXXsT+mIu/41cuzxgO8jNeIqDX3
TLSH
T1687412BE4B3600D0943697B7E19552571729E27A1837FFB29823DE4CEEC8B0150E686E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads