hxxps://github[.]com/Seralyth/Seralyth-Menu/releases/latest/download/Seralyth-Menu[.]dll

Analysis

user interaction
yes
max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Seralyth/Seralyth-Menu/releases/latest/download/Seralyth-Menu.dll
Sample260802-26d2wsyvbx

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	firefox.exe
Token: SeDebugPrivilege	5088	firefox.exe
Token: SeDebugPrivilege	5088	firefox.exe
Token: SeDebugPrivilege	5088	firefox.exe
Token: SeDebugPrivilege	5088	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe
5088	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5088	4336	firefox.exe	85
PID 4336 wrote to memory of 5088	4336	firefox.exe	85
PID 5088 wrote to memory of 2588	5088	firefox.exe	86
PID 5088 wrote to memory of 2588	5088	firefox.exe	86
PID 5088 wrote to memory of 2588	5088	firefox.exe	86
PID 5088 wrote to memory of 4420	5088	firefox.exe	87
PID 5088 wrote to memory of 4420	5088	firefox.exe	87
PID 5088 wrote to memory of 4420	5088	firefox.exe	87
PID 5088 wrote to memory of 4420	5088	firefox.exe	87
PID 5088 wrote to memory of 2140	5088	firefox.exe	88
PID 5088 wrote to memory of 2140	5088	firefox.exe	88
PID 5088 wrote to memory of 2140	5088	firefox.exe	88
PID 5088 wrote to memory of 2140	5088	firefox.exe	88
PID 5088 wrote to memory of 1524	5088	firefox.exe	89
PID 5088 wrote to memory of 1524	5088	firefox.exe	89
PID 5088 wrote to memory of 1524	5088	firefox.exe	89
PID 5088 wrote to memory of 4328	5088	firefox.exe	90
PID 5088 wrote to memory of 4328	5088	firefox.exe	90
PID 5088 wrote to memory of 4328	5088	firefox.exe	90
PID 5088 wrote to memory of 4328	5088	firefox.exe	90
PID 5088 wrote to memory of 3352	5088	firefox.exe	92
PID 5088 wrote to memory of 3352	5088	firefox.exe	92
PID 5088 wrote to memory of 3352	5088	firefox.exe	92
PID 5088 wrote to memory of 3352	5088	firefox.exe	92
PID 5088 wrote to memory of 4048	5088	firefox.exe	93
PID 5088 wrote to memory of 4048	5088	firefox.exe	93
PID 5088 wrote to memory of 4048	5088	firefox.exe	93
PID 5088 wrote to memory of 4048	5088	firefox.exe	93
PID 5088 wrote to memory of 4580	5088	firefox.exe	94
PID 5088 wrote to memory of 4580	5088	firefox.exe	94
PID 5088 wrote to memory of 4580	5088	firefox.exe	94
PID 5088 wrote to memory of 4580	5088	firefox.exe	94
PID 5088 wrote to memory of 2888	5088	firefox.exe	95
PID 5088 wrote to memory of 2888	5088	firefox.exe	95
PID 5088 wrote to memory of 2888	5088	firefox.exe	95
PID 5088 wrote to memory of 2888	5088	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Seralyth/Seralyth-Menu/releases/latest/download/Seralyth-Menu.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Seralyth/Seralyth-Menu/releases/latest/download/Seralyth-Menu.dll
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2040 -prefsLen 27099 -prefMapHandle 2044 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {f06a3a81-3796-449e-9578-b82f3fc6b571} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {58d8fb40-4db3-477f-aaeb-0d390cd1d549} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 25164 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {9837920a-1991-4b90-8a9a-6c481a91cf7e} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27276 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 3908 -initialChannelId {9f71f657-ff66-419c-9d65-282a4496557a} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4372 -prefsLen 34775 -prefMapHandle 4376 -prefMapSize 270279 -jsInitHandle 4380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4344 -initialChannelId {c1c49469-f4d7-4d1a-8e21-9adb3a32a737} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2820 -prefsLen 34905 -prefMapHandle 4964 -prefMapSize 270279 -ipcHandle 4956 -initialChannelId {9feb4319-b9a3-44f1-94bb-914af3898ac4} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32845 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {5189761f-3f1c-4005-a7c5-941325b7f40b} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32845 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {e35bde26-7112-49e2-9cb2-eb4f60065f10} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32845 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {43f8d40a-97b9-4b5d-907c-96f5431006d6} -parentPid 5088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\activity-stream.discovery_stream.json.tmp
Size 75KB
SHA256 c6be71443e975e2037bd07c7325bc629858ea7d3d7b7db9cd38fb48f602a144b
MD5 1c996743ff8b1d1165348ffd9c1ab2da
SHA1 7a1b08219a222bd42244db86e58908f104999e91
SHA512 34724626e7963870ead13bd75bef9e9e2848af01041e3e38001ce4df317d9687e8821dc909b38b0340a41d5868e56dc76660e0164507547e136fe0245b7e9675
SSDEEP 768:5ycSPHX8WkI0j6VwfNt3pc0P8RJZJAaO5JO0osUtdFVpVdV51CKhaZVBCI3YTSuY:4CjJ2SOZJuosUtdFbbzIjxupXa
TLSH
T1D0730AA397A9B1FB1B9127CB2C0B759B63E60189E38501C8ECEDCA1D819D754023A5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 9aab93d835f678d50e90c9508dba8b75dc6cf807d9d8aec144f8040dc81f5c30
MD5 e3da2e8bf3bd9314eac4536f68432637
SHA1 c4371fb8ab493be292f2873283d9b7c8fb62233b
SHA512 716f192890f4f5234e46316085a1e4097ced6abfef8a9bf3a6cc3182356863cf45a9e98841913c0676db952d3ed1cd77af4bd58ae21688cb9ba967d5ba7501aa
TLSH
T1FE61C858F228963FE489413ECC962B402F307456A8AF7F2A35ACA04D1E5B2CD76CD57D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 dfea2c4d274d9bb82906bd808ca73451d4b98b38660b34d6dbdcb5b094792485
MD5 de6836d9818415064f02c88c3287cb80
SHA1 68b77e3c158bf6a95c673f13c136deedc69046ce
SHA512 5d43465a4505545b5a94b09aec8fc0edd8c27d1746daa3e991fdccb3825998d611014822ee4454dc534a6f79efef7f843c0ffbb7c794c43081edb9ff64473f45
SSDEEP 192:Z1d66JozGzgCl6mc0dtOv5zbo4Z+fyjII:Xd66JozGzgC1jYbo4Z+fyj/
TLSH
T19DD1EC68E639513BC809023BCCA61F500F35799A988F3F1972AC641D2C573DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 998dee4a2c114ffadac7626e074ef00ca1e65c5091586d7c5ac21b9219490acb
MD5 573b2544a85ab6cb650774ee63854f09
SHA1 f89fcbf8018a719b21d121f5be95a0db4b134bd4
SHA512 10a1d27916c60dd80a9bf9241bc14a1e8a782c680c7b5406f01668c6e7b8496dfff8b38f071fabf2314c4387f1208b1ed3b93609b3e3d0812708e706f0c6aac3
TLSH
T1F321469C3DB88D6AACCBF3997451028E53558E0714871D434E42EF8DCEA5AD9326A439
MD5 SHA1 SHA512 TLSH

Submit Download

3216738e-b1ef-4fa1-8a31-26b63c3837d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\3216738e-b1ef-4fa1-8a31-26b63c3837d4
Size 883B
SHA256 5c9fcd4f3065e3c6b30957288b0f1365ce2c1643a5af9d69eb449e98182a7bec
MD5 53ba4e7c2d5cfadc64bdf98e538aca34
SHA1 24f3fd261f8c512a4b6f49f9c4131a1558422047
SHA512 2df7a263048ebd92aaa258951454ff096757279f4b0f109d9a31d9f7e8be64f340f982bd51b212e1875fdba13d3b7c06af57455171077b40644c50a7d9a08913
TLSH
T1C1110441A770B4F2CC6C824F854677028BE8762380C640183EB299240D7D61E637560B
MD5 SHA1 SHA512 TLSH

Submit Download

6232d8a4-4848-4d31-af63-ade6e93f51dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\6232d8a4-4848-4d31-af63-ade6e93f51dd
Size 235B
SHA256 9b5f58d7285cd07aa6db003c33a45ff8aa2db3cc2742667d72bbfea5e17db963
MD5 5558f6f05e9075d6f58836de4dda242b
SHA1 b0d760a1247a770a6496b8d0e92d927a624e2cb0
SHA512 1d7b50f5e2f0359b4be6e268e6e3e89d5c9820bb0f06c3897c5848a73a3a4407f964cc9b1a800c6df6527de875ca9c0aef4996d1b6cb14c8d7cb5af7d5ad1609
TLSH
T134D0978968986BAC8C141F03B0E029C234448C3720B19820D95041399AFA9C8023380B
MD5 SHA1 SHA512 TLSH

Submit Download

8e5a46b5-8f72-42c9-9ce5-23fed9cdc700

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\8e5a46b5-8f72-42c9-9ce5-23fed9cdc700
Size 15KB
SHA256 91718d9b78ddc3b8cceb4399694ed9426ca7ed178886f377d630456985e1b002
MD5 d8f7a4ddcf3a456cf1bd3f51b4a1ac51
SHA1 84ce3f4e501f5933d0a12d428908568dc2611cea
SHA512 8cc62b8c86d9567f730d9b6c7defd783e1f0ad148f680f6958fb7c52b2a24b8cee08dcd1757d9a33f0a1f291a4bce36fb693ffa7e6ec633d2951a21a823004c3
SSDEEP 192:fy1MnCB1EBWTo1DB7YydroY+NRzxKlY5JunUIAmmpDwIC4JCaCDjcVb0Z5L6iVSi:qY73zEKroRNRlKlY5knZdWiVWZS
TLSH
T18E72C956643044BA8291E3A898ECBFC3E5F528CF4C415FCAD7E4BD086DEE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1cd556d-8be8-4ef9-b061-1e3884072c4d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\b1cd556d-8be8-4ef9-b061-1e3884072c4d
Size 886B
SHA256 173bea48a25f128587d6e91516d7946dd69a3ad93d590b8cef8ec7bca7203d3d
MD5 847585ac68688cb6c46cda91dfd3e4a4
SHA1 c84a9121848e31228d925b17c4c6eb055fd20f34
SHA512 587ae0637e9470e843dea2605984b688195f13e6a13fb4a835b77d9740f49ac6a80b081869712aa59bbb2d25690b1ecd1942cd2585db1ea324db7bf2b7f70cfc
TLSH
T1D611238086B0B4B3CCAC92CF89D677468BE4722380C718187D655E2C0DBF62E7766707
MD5 SHA1 SHA512 TLSH

Submit Download

d3b398d3-b3e8-4fef-bf59-717699741fdb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\d3b398d3-b3e8-4fef-bf59-717699741fdb
Size 2KB
SHA256 2bae26817c12d4abe936a7f3beec0ac6a864e1e5c4c25f7101483284e6f56d88
MD5 560ebc3808085dc020470f4a002302d2
SHA1 6a9636963211a5393c0ee361e9dab16a6add9053
SHA512 009cfd6f7d3401da7cfaac70d340cc44b4d9943d5781819ab0677a85ee6272b87988231506d1dcc6bcef3c0752de0af92bcbd9c2e10c50e02a4d5bd695fa5a16
TLSH
T1A641165C36B85CB79DDAE1CDD082334E97A48A4300C61C437D61EE0CDD9A69D337A53A
MD5 SHA1 SHA512 TLSH

Submit Download

f9345bf4-0320-40e1-af66-08ae86bb981c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\f9345bf4-0320-40e1-af66-08ae86bb981c
Size 235B
SHA256 6cb922f0d55c14e2fe5051c29e38de852bde3c93537a47dcc0126de8fa6a3186
MD5 40a9ec27e42f19f366162dddc976417a
SHA1 149986068f04c119da89cd664605edfcb878c1c4
SHA512 2e64ec99d1e933b30bb9ba0fb29e9900f5810d360ed52be5fd51ec008af6dad564d618d868a01a62dd8368da9257212119ea634d3c8171c57155a594df7caaf7
TLSH
T16BD09781A498AB6D09040F1BF0A0ECC23058CC3314E0A810F66144B4AABDFC80162806
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 7KB
SHA256 42915769197921d167a57afaae597f3886707130747da54ed9946a62d02996d2
MD5 efceba8374884a696dc272d1f4bec861
SHA1 7a7f96adfc01795d265be5ac27fddfc9539c22dc
SHA512 8716dbd9b4a4874ebbfed3720b9a86698d7c5f03737abab615a63354086af27a5ad6ddccb699985d490580295f533f31ea5b4d920d86ee92ef198cd56d64a219
SSDEEP 96:xHotTUmqGq6fzQOObzSmSKSSlfdv9j3npRHNWyS9JORiIBw88n8L4cnuFXj:iAR6fzQOwSKSSv9NWBrORiIBw88JF
TLSH
T1A0F11C789408CB6F78B677ADAC6848315AB2023BB6BF5CD710B954C4055CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 874bdeec0a29f03c960a5bb10d7762fca546b33be6c5d1371a8ef729a510371a
MD5 3ea75362d4c17d4d512770dafd32dc43
SHA1 012587a7f33a4d6828051aab5021226f4c4bd7a8
SHA512 cf1c791361371c28db86938a9e2b125511f1933729b2514b6b73d1d7f1e6237db3d99aafb96b644a5344714033a1f4b1e6f970af1320d107a304f9aab45e8b9a
SSDEEP 96:xHrUTUmqGq6fzQO1zSmSKSSlfdv9j3npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzQO3SKSSv9NWBrODBw88Jr
TLSH
T148E120789508CB6F74B677ACAC6888716AB2013BB7BF68C750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 ef86b6baed72706aa11783dfe0fd66f1e84e038b759c5f36b7fc573372fdcc41
MD5 4e40b04923ec56b0f5834c60663ad6a5
SHA1 c5b8d2cea590b820a8bcdbccb9512fe523dd6b03
SHA512 aa29887a18749df67c8f6debdb7461d21d9b424e45798756352b24867f0deea169de68cc24f644146093161c4542b5b94e8895361f9eafea493820542116c9ae
SSDEEP 96:xHrUTUmqGq6fzQOObzSmSKSSlfdv9j3npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzQOwSKSSv9NWBrODBw88Jr
TLSH
T16DE120789508CB6F74B677ACAC6848716AB2013BB7BF68C350B594C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 b524968118e28ffee245123834d70d27c796468123a250ff3c95ce99fc50ec30
MD5 9d230b64aa9584f495477fbedf2e03c3
SHA1 b0a026e0dba54510b7918d9e9944e7a39bd92eba
SHA512 787528382aae674fc2c831f29779959cc586e6dad1da3e8567bd6b56910194ba134c9378c8c27d5514b57935cddd42ae931264a967cb627e69a08c21ef109a93
SSDEEP 96:xHrUTUmqGq6fzUL1zSmSKSSlfdv9j3npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzUL3SKSSv9NWBrODBw88Jr
TLSH
T1D9E12F789508CB6F74B676ACAC6488716AB2013BB7BF68C750B594C4050CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ba2bf6d36f16cadc3604bc2947aff733db97ef6646e7b057fa8e5648b3e074d5
MD5 f4426f9c9ff991c7d03f154de1d904f6
SHA1 6c166706e04a32baff1e24f71ea2530944b8cd9c
SHA512 eea01d9652b46d46a6303f04de2638e98211d7f0884ab802aed764668a6f7469fd3de4a34210ec4b21ec64e394c36c90766530d8a6eaf51e7e2c909d669f3a21
TLSH
T12121B3969D7F6CB22DA8D01AD0CA1FC4C3F180564260ECE08D68A80406EC21F729EB5E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 eb2c001da41eba79b21351f8d8066ae2c4fbe669f0792d1449914f8ca24e1bd8
MD5 9775fa6ff7b9849da9509055028f3a4e
SHA1 f29a7070ff323d0ce5e509c78082b1bfc69a3686
SHA512 88dc8c7686d25ec6bfd74c93d6e080ec5828250dacd55c466156c895f137d0a667558f4405f0d87d8836ce004dbdd1131d5b8050a8923c11aef0cd63c16eaffb
TLSH
T1FF21FB2190EB2CF53CF26116D84A0FD0C35B343984709CF0459D8D0A71DD00B635B725
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads