e0c8b46e18c30538edc65d3dab63ffc4f494f59f97c42a43a5c9dd848a091718

Analysis

user interaction
yes
max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno.pyc
Size 131KB
Sample260801-tt1fcsdd68
SHA256 e0c8b46e18c30538edc65d3dab63ffc4f494f59f97c42a43a5c9dd848a091718
MD5 220ea8a0d64a841242fa95dc35008bc0
SHA1 6dd4c10a7ce517f913e6a76365a131c5f09eea51
SHA512 f39f3224ee3a9ebe2bc4c86020bf2aace3578378468ee4e2a581f1402112e988abcfb196e67f1db0a23828885129fb06f99fa54f24e336af0f5e64cf5c11e340
SSDEEP 3072:rwQlAWgKrJ3EgzljF8qLjd2rM/8rWCufPibE0NSSaNJcvcz/d:jGWFlFdWM/7PiA0S/cUp
TLSH
T134D312784FBA2727E146CDBB32C7A4045FE3A971148528D346890D0F019B756F6AB367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2440	cmd.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\pyc_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\pyc_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pyc	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\pyc_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\pyc_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\pyc_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3612	firefox.exe
Token: SeDebugPrivilege	3612	firefox.exe
Token: SeDebugPrivilege	3612	firefox.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3436	OpenWith.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3268	3436	OpenWith.exe	91
PID 3268 wrote to memory of 3612	3268	firefox.exe	92
PID 3268 wrote to memory of 3612	3268	firefox.exe	92
PID 3612 wrote to memory of 4672	3612	firefox.exe	93
PID 3612 wrote to memory of 4672	3612	firefox.exe	93
PID 3612 wrote to memory of 4672	3612	firefox.exe	93
PID 3612 wrote to memory of 1248	3612	firefox.exe	95
PID 3612 wrote to memory of 1248	3612	firefox.exe	95
PID 3612 wrote to memory of 1248	3612	firefox.exe	95
PID 3612 wrote to memory of 1248	3612	firefox.exe	95
PID 3612 wrote to memory of 2100	3612	firefox.exe	96
PID 3612 wrote to memory of 2100	3612	firefox.exe	96
PID 3612 wrote to memory of 2100	3612	firefox.exe	96
PID 3612 wrote to memory of 2100	3612	firefox.exe	96
PID 3612 wrote to memory of 5524	3612	firefox.exe	97
PID 3612 wrote to memory of 5524	3612	firefox.exe	97
PID 3612 wrote to memory of 5524	3612	firefox.exe	97
PID 3612 wrote to memory of 2072	3612	firefox.exe	98
PID 3612 wrote to memory of 2072	3612	firefox.exe	98
PID 3612 wrote to memory of 2072	3612	firefox.exe	98
PID 3612 wrote to memory of 2072	3612	firefox.exe	98
PID 3612 wrote to memory of 4616	3612	firefox.exe	100
PID 3612 wrote to memory of 4616	3612	firefox.exe	100
PID 3612 wrote to memory of 4616	3612	firefox.exe	100
PID 3612 wrote to memory of 4616	3612	firefox.exe	100
PID 3612 wrote to memory of 1652	3612	firefox.exe	101
PID 3612 wrote to memory of 1652	3612	firefox.exe	101
PID 3612 wrote to memory of 1652	3612	firefox.exe	101
PID 3612 wrote to memory of 1652	3612	firefox.exe	101
PID 3612 wrote to memory of 5172	3612	firefox.exe	102
PID 3612 wrote to memory of 5172	3612	firefox.exe	102
PID 3612 wrote to memory of 5172	3612	firefox.exe	102
PID 3612 wrote to memory of 5172	3612	firefox.exe	102
PID 3612 wrote to memory of 4436	3612	firefox.exe	103
PID 3612 wrote to memory of 4436	3612	firefox.exe	103
PID 3612 wrote to memory of 4436	3612	firefox.exe	103
PID 3612 wrote to memory of 4436	3612	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xeno.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Xeno.pyc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Xeno.pyc
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {cb241cb5-9ffc-4366-b28f-5d2094d9e958} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4672
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {d2b9b578-9610-4799-b385-2b148284b139} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 27274 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {190732b6-56b2-457d-8776-66988de24440} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27274 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4124 -initialChannelId {53edb712-fe3c-4603-9baa-26eef3b052c4} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4508 -prefsLen 34773 -prefMapHandle 4512 -prefMapSize 270279 -jsInitHandle 4516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4524 -initialChannelId {5f62c74a-afbf-4f66-aee4-44eb680aad07} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5288 -prefsLen 35010 -prefMapHandle 5292 -prefMapSize 270279 -ipcHandle 5300 -initialChannelId {518772a3-01f3-4e71-b5b7-65b0f0c928d2} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4616
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2776 -prefsLen 32952 -prefMapHandle 2780 -prefMapSize 270279 -jsInitHandle 2784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2760 -initialChannelId {2e8423a9-221a-40bc-9650-719e82dd6496} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2848 -prefsLen 32952 -prefMapHandle 1632 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5788 -initialChannelId {571f7316-a634-4450-8034-fd4121444dc3} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6000 -prefsLen 32952 -prefMapHandle 6004 -prefMapSize 270279 -jsInitHandle 6008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6016 -initialChannelId {b667347a-27b6-4030-9d19-545abac52d1d} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8194d31d1b061f068fee4484fbebefd96ab3c52a8ef25c43da11a2a27c6aa8de
MD5 5edbb79261fb8be49023b0570dd6d8fd
SHA1 b37ee5e65f3280e58415213a122aef6bd5b2a0d7
SHA512 542ade472a7ed0df499f2f60831890fa3f879c723bab13004efd2effe7f8b03fc6fada634fb2eb579b988ccf67e62edb6b4f1092e16546b73074c3127c7c17da
SSDEEP 192:3Hr+TK6T1d66JoztdzgCl6mc0dUOv5zbo75IZJnyjLi:Ed66Joz/zgC1jlboOZJnyj
TLSH
T12EE10CA4E629863FC408027BDCA61B414F39398BD84E3F1975DC650C2D572DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d199452e8bb89846ac322d7b5be3986b032a101b09a025ac4d4e7f2ceca16b0b
MD5 e57b9ee4a864f626ef2f17ae16969656
SHA1 52b8de3d16386d95cbc27ec63e525ac559653232
SHA512 3a28cca764d6ed1e2dac3e228c7585740d095a6777f1315459314087743f84fdd11b36889f5a761ffb27597201801b18a67f59ab7fd8ffb3ad62f7636ca0b6f5
TLSH
T196216D4C79B84D5A99CBE398B851028EA3554E0B88471C430D02EF8CCDD2BD9316E53C
MD5 SHA1 SHA512 TLSH

Submit Download

5d0bed3f-978d-42f8-b215-35ed1ff779bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\5d0bed3f-978d-42f8-b215-35ed1ff779bc
Size 886B
SHA256 4456992c11fdff4c8a442ab6b2a8d9507fd847e458c6e4aba55f53deaa3d2438
MD5 6de79115879d53c5a4e43c2213003a82
SHA1 11f5728579aa90b1db2f24b8d5200e3ae8face86
SHA512 4c12b3882608828bd262d4a113adfb8c7976996bf009e41a72475c39bc5c5c19f8ed4decfafbdb6e0bb7411e559dd4866e682fd1de246372bdddfd035831fae8
TLSH
T130112380C6B6B672CC28D39FD9E5B7438BE4751384C709047DA49B0C4DBA15F67AB607
MD5 SHA1 SHA512 TLSH

Submit Download

85d9d646-c9a2-4a7d-ace6-96902f1e9f59

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\85d9d646-c9a2-4a7d-ace6-96902f1e9f59
Size 883B
SHA256 2ce3d62641e778aa87a8ed51fac23fd808fb3da1061ce64dcc5a4c2c9475e54e
MD5 4b7bda27232ef0671d253ee1e0f42bd0
SHA1 56d3bdbc104123a80b76b17a8aca0ec84323d5c8
SHA512 616ab266f9f683665f6ddb604ca0be38b77355c069295920c248ee3f37f3cb68e2ee4602af93bb432f417d25080acb7aa04c94bfe028b895e8f4835d9394ddf5
TLSH
T171112340D636B972CC38D34BC9A57712CFE8B41380CA55043CE19E084E7E65FA76B647
MD5 SHA1 SHA512 TLSH

Submit Download

8e28f33b-6ebf-4f0b-a71c-b0cd35e1cb39

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\8e28f33b-6ebf-4f0b-a71c-b0cd35e1cb39
Size 2KB
SHA256 77e9fc33a7767b649e65b31bf01b0e81c665dedf1e526b5e54459121f012dbd1
MD5 52b986e4694f18a4c34a1d09c1373672
SHA1 45a344c2b54e9ac889664517b905a5ac32176c24
SHA512 00f0acd5ddb2a24ae27cb8484ab0a157245c8023f9104e87ad641d5cfd9525b9bab42562470b3fc350590bbbcd43558f7543e2b1d2dfe4fa85d19690b48b4d73
TLSH
T14E41205C79784D768C8AF15D9492338EDBA09A0344872C832D91EF4CCE9679E336B42F
MD5 SHA1 SHA512 TLSH

Submit Download

ac4e8117-be62-4d22-a871-587d5b823442

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\ac4e8117-be62-4d22-a871-587d5b823442
Size 235B
SHA256 d20783850182b4ad8605ab004ca55bb039556a5d402c564a34e3dbfa7ec1a1d1
MD5 379d7c3df2ec66d1f8296257f36e392f
SHA1 6a8bdca34d1bdc61e0a6682fba8102f7823726e7
SHA512 17c5e4d8bc6559ee6bf5b941bd8ef01fba03a2ff939864958a0e73d5a0afb6ac7ce9bd9b058676b3809b1630e32ab0e7d8504b7fb3b9e3770c0bee14b9003f8f
TLSH
T166D0A7951C98676D48144F07F0B169C670554C3354A8986099F186799AF9EC54261926
MD5 SHA1 SHA512 TLSH

Submit Download

b64b65c5-5cb8-4e0e-822a-a04f568bb1f5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\b64b65c5-5cb8-4e0e-822a-a04f568bb1f5
Size 16KB
SHA256 bba6fddb88767be9c37ad3fc8538806a3ce030a4f97e52e28d3ddc65ed5a84dc
MD5 59cd5478927e294936f763edbf1868ea
SHA1 908ddd015187a3c4e2bc678451adc115e5c3c1cd
SHA512 edbb51f943c9c843e58034bfc7c60c6e7e08f46e0c64b6f4d607b6c9b902603a2db92b9aad282e7ab50c5a75b38f3d08c3d9def3fa8cee5fb8cd4adda102a773
SSDEEP 192:L/gEMcBOFmaI21G/4qJIW8hA53g2jyeOrvxk6fpXREoxllyvBZ8DG2RxzC5AkV1m:HCI3/4V9Spe3y5ZEGCxm5AkV1in
TLSH
T1DE72EB56686056BF8251E3A9D4FC7FC3E2F528CF4C019FCA9BE0BD0859DA06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3c39371-244d-4e68-a719-3e20febdd8b3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\f3c39371-244d-4e68-a719-3e20febdd8b3
Size 235B
SHA256 c2844901d04a94e7de70b1b09cc573e33fb0e6f9d84863b22684ddabd27e441e
MD5 c89bd301d2e2e317b593113e3ccd11ff
SHA1 339ecde7dbbbd871370fe6075549a8e550a99bb8
SHA512 70fb1ed3699837a3d6ff7ffa40792d533622fd01816e57805fda7fdb03c28fdf23d389e34032936ea0f201ca4168526335294434c47630fef6a7284888925a85
TLSH
T1FED097A018A86B1D0C141F47B0A138DA31894C3314A89C10D961447889B9FE862BA917
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 cf6e86ebe906249293fc64b1057e1b3663a8669e48a82dd43768eb003f2b7883
MD5 1a76db64d4444dbfefec73d172b64711
SHA1 afb763913ab3eca4881d633d40046dde1dda3d0e
SHA512 e1f15fce31ff660afcf04fdafae31141be70a9f2de3d2cdfa8c7c2d3d98aa4151f4db37b64584df0f0e22146192c4a4525b6cea59591ecb9de020417241b0481
SSDEEP 96:xHpUTUJPqGqPf2B131zSljSSlvdv9j1n+cHjCa/Bw88u8L4cnAVWb:v5CRPf2B134jSSxj7/Bw88q+
TLSH
T180E1007894088FAF64B6777CAC688831AAB2013BBBBF68C350B95485055CF7441F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 1e9b706f681c9cf0ba88cb9c5e4724aeebe81474a533d642fd21dd2c3143a9a1
MD5 42273b01df0d8af4d45beaba2e12df8e
SHA1 9bd5573a0644729d58624bf407ca9506592d8b95
SHA512 4f65c575e663c76344cb806b04d2f500917b27f1e6b00b551857dbed3e6b02141af7c8007ebda939b100c2fde1f9c646dba79a4f863f37b06c121d9334e0fe3d
SSDEEP 96:xHpUTUWqGqPf2B661zSjLSSlvdv9jWn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B66mLSSuj7/Bw88qU
TLSH
T181E1117890088F7F64B6777CAC688831AAB2013B7BBF28D750B95485015CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 eacae1c53af61d8cfb5e456aa1910d4a2c09a6b3c11c91f11bfbca0a374b4073
MD5 7916d6ca4ed56ef9f8b150540ca312db
SHA1 d5dfa9fa3e16cb5b22d4be3cee9de23b8ca8c43f
SHA512 7f808d3176e7c203a732e898bb132bd6d4b34c863e620ec65b651458efc746a9e973ff95b2caa18ae3fad01cf5a8afa2efb4287c5719ae7a04f6a422a1e07236
SSDEEP 96:xHpUTUWqGqPf2B131zSljSSlvdv9j1n+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B134jSSxj7/Bw88qU
TLSH
T1F3E1107890088F6F74B6777CAC688831AAB2013BBBBF68C350B95485015CF7441F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hbss2B5l.pyc.part

Path C:\Users\Admin\Downloads\Hbss2B5l.pyc.part
Size 131KB
SHA256 e0c8b46e18c30538edc65d3dab63ffc4f494f59f97c42a43a5c9dd848a091718
MD5 220ea8a0d64a841242fa95dc35008bc0
SHA1 6dd4c10a7ce517f913e6a76365a131c5f09eea51
SHA512 f39f3224ee3a9ebe2bc4c86020bf2aace3578378468ee4e2a581f1402112e988abcfb196e67f1db0a23828885129fb06f99fa54f24e336af0f5e64cf5c11e340
SSDEEP 3072:rwQlAWgKrJ3EgzljF8qLjd2rM/8rWCufPibE0NSSaNJcvcz/d:jGWFlFdWM/7PiA0S/cUp
TLSH
T134D312784FBA2727E146CDBB32C7A4045FE3A971148528D346890D0F019B756F6AB367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads