6bfbb56169968fa990370473cf59620f4c8a18e0f5500491f6e5b62b4f11f3b0

Resubmissions

02/08/2026, 03:43

260802-d96z3stemc9

02/08/2026, 03:40

260802-d8hk4atejd9

02/08/2026, 03:39

260802-d72btatdqh9

Analysis

user interaction
yes
max time kernel
195s
max time network
195s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rat.exe
Size 227KB
Sample260802-d96z3stemc
SHA256 6bfbb56169968fa990370473cf59620f4c8a18e0f5500491f6e5b62b4f11f3b0
MD5 652728a30606900657c00b30103c881c
SHA1 20c3c9e16e79372734b48b15300ad9b77d3082ed
SHA512 4d69c51667d6dce170b2e6b3d718d35be8361ea54ccb84dbd780144a4f7572dfe2cddfa32157e5997c0f0df5ddab7ab7894857482be52718ddb392dc28026864
SSDEEP 3072:Lpi3g6BaFKesUif3AshS2FqVEvM7UFkbLT7lckOXROYHAlUSZsW:Aw1KesJ3Asx4IFHAlUSZsW
TLSH
T17F34172B77970CFCC623C07A82A6D7716431F8240324AE6F5794DB336E61D945FAB928
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	OneDriveStandaloneUpdater.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	rat.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	OneDriveStandaloneUpdater.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	salinewin1.5.exe

Disables Task Manager via registry modification
defense_evasion

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	rat.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	OneDriveStandaloneUpdater.exe

Executes dropped EXE 3 IoCs

pid	Process
4220	OneDriveStandaloneUpdater.exe
5040	OneDriveStandaloneUpdater.exe
5396	OneDriveStandaloneUpdater.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveStandaloneUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe\" /background"	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveStandaloneUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe\" /background"	rat.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
30	raw.githubusercontent.com
112	raw.githubusercontent.com
124	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin1.5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\salinewin1.5.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	492	firefox.exe
Token: SeDebugPrivilege	492	firefox.exe
Token: SeDebugPrivilege	492	firefox.exe
Token: 33	2432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2432	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1096	rat.exe
5040	OneDriveStandaloneUpdater.exe
492	firefox.exe
4644	MiniSearchHost.exe
492	firefox.exe
492	firefox.exe
492	firefox.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4220	1096	rat.exe	79
PID 5040 wrote to memory of 5396	5040	OneDriveStandaloneUpdater.exe	82
PID 4592 wrote to memory of 492	4592	firefox.exe	84
PID 4592 wrote to memory of 492	4592	firefox.exe	84
PID 492 wrote to memory of 3932	492	firefox.exe	85
PID 492 wrote to memory of 3932	492	firefox.exe	85
PID 492 wrote to memory of 3932	492	firefox.exe	85
PID 492 wrote to memory of 5600	492	firefox.exe	86
PID 492 wrote to memory of 5600	492	firefox.exe	86
PID 492 wrote to memory of 5600	492	firefox.exe	86
PID 492 wrote to memory of 5600	492	firefox.exe	86
PID 492 wrote to memory of 2960	492	firefox.exe	87
PID 492 wrote to memory of 2960	492	firefox.exe	87
PID 492 wrote to memory of 2960	492	firefox.exe	87
PID 492 wrote to memory of 2960	492	firefox.exe	87
PID 492 wrote to memory of 3256	492	firefox.exe	88
PID 492 wrote to memory of 3256	492	firefox.exe	88
PID 492 wrote to memory of 3256	492	firefox.exe	88
PID 492 wrote to memory of 708	492	firefox.exe	89
PID 492 wrote to memory of 708	492	firefox.exe	89
PID 492 wrote to memory of 708	492	firefox.exe	89
PID 492 wrote to memory of 708	492	firefox.exe	89
PID 492 wrote to memory of 752	492	firefox.exe	90
PID 492 wrote to memory of 752	492	firefox.exe	90
PID 492 wrote to memory of 752	492	firefox.exe	90
PID 492 wrote to memory of 752	492	firefox.exe	90
PID 492 wrote to memory of 1340	492	firefox.exe	92
PID 492 wrote to memory of 1340	492	firefox.exe	92
PID 492 wrote to memory of 1340	492	firefox.exe	92
PID 492 wrote to memory of 1340	492	firefox.exe	92
PID 492 wrote to memory of 3732	492	firefox.exe	93
PID 492 wrote to memory of 3732	492	firefox.exe	93
PID 492 wrote to memory of 3732	492	firefox.exe	93
PID 492 wrote to memory of 3732	492	firefox.exe	93
PID 492 wrote to memory of 2796	492	firefox.exe	94
PID 492 wrote to memory of 2796	492	firefox.exe	94
PID 492 wrote to memory of 2796	492	firefox.exe	94
PID 492 wrote to memory of 2796	492	firefox.exe	94
PID 492 wrote to memory of 1792	492	firefox.exe	95
PID 492 wrote to memory of 1792	492	firefox.exe	95
PID 492 wrote to memory of 1792	492	firefox.exe	95
PID 492 wrote to memory of 1792	492	firefox.exe	95
PID 492 wrote to memory of 4472	492	firefox.exe	96
PID 492 wrote to memory of 4472	492	firefox.exe	96
PID 492 wrote to memory of 4472	492	firefox.exe	96
PID 492 wrote to memory of 4472	492	firefox.exe	96
PID 492 wrote to memory of 5868	492	firefox.exe	97
PID 492 wrote to memory of 5868	492	firefox.exe	97
PID 492 wrote to memory of 5868	492	firefox.exe	97
PID 492 wrote to memory of 5868	492	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rat.exe
"C:\Users\Admin\AppData\Local\Temp\rat.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe" --guard 1096
  2⤵
  - Executes dropped EXE
  PID:4220

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe" /background
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe" --guard 5040
  2⤵
  - Executes dropped EXE
  PID:5396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27097 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {5a200e76-571a-4ffd-94d3-b00200b3a538} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {d9249a57-8555-40fd-939d-aacf5097155f} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27274 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {73d62217-5cc8-4a80-932f-6c5977a02db2} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27274 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {c139970f-127b-4267-aacb-6fba4446b170} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4480 -prefsLen 34773 -prefMapHandle 4484 -prefMapSize 270279 -jsInitHandle 4488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3208 -initialChannelId {c8db929b-2247-4b7f-9241-33a1eaea9770} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4872 -prefsLen 34929 -prefMapHandle 4876 -prefMapSize 270279 -ipcHandle 4888 -initialChannelId {3ec19885-2be1-4e02-8349-03a028055107} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 32900 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {9caf2b7d-fe11-4a15-81e0-596c48a045be} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32952 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {5412c151-8921-4741-949d-7641d9313324} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {46cd5302-0775-4df5-9e12-1c113fc7125b} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6204 -prefsLen 33071 -prefMapHandle 6208 -prefMapSize 270279 -jsInitHandle 6212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6156 -initialChannelId {e2e82f04-780d-4056-aa86-68bbef96104d} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6636 -prefsLen 33671 -prefMapHandle 6640 -prefMapSize 270279 -jsInitHandle 6644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6648 -initialChannelId {c4676b00-e324-4472-8b1b-2209a3e245c0} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6840 -prefsLen 33671 -prefMapHandle 6844 -prefMapSize 270279 -jsInitHandle 6848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6856 -initialChannelId {2bf73b0a-2ad8-4fca-923d-7463fbc8d2cb} -parentPid 492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5868

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1456

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:6012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 227KB
SHA256 6bfbb56169968fa990370473cf59620f4c8a18e0f5500491f6e5b62b4f11f3b0
MD5 652728a30606900657c00b30103c881c
SHA1 20c3c9e16e79372734b48b15300ad9b77d3082ed
SHA512 4d69c51667d6dce170b2e6b3d718d35be8361ea54ccb84dbd780144a4f7572dfe2cddfa32157e5997c0f0df5ddab7ab7894857482be52718ddb392dc28026864
SSDEEP 3072:Lpi3g6BaFKesUif3AshS2FqVEvM7UFkbLT7lckOXROYHAlUSZsW:Aw1KesJ3Asx4IFHAlUSZsW
TLSH
T17F34172B77970CFCC623C07A82A6D7716431F8240324AE6F5794DB336E61D945FAB928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 75b463e9da19344c60ba90049c83edd269a51134165f2cbb1d3883b045e243c2
MD5 422e357cdf15058ccf0f500e9b74ab3f
SHA1 4fefc72383d90a3b1179e7a26dc280172847bdc6
SHA512 2b9876b0600a551179a403e860af6820956c02ac3f44706d66c6f07851de75513fd22143543adcd410650cd3058f2dba76add2782d421d50c4e887763f28052c
SSDEEP 384:HwCe7iO024YIDL84KKDL849B7SOEAd9KVRaAcP+AWRMACqB:QqZYIDL8lKDL8CB7S/AmVAf+hRMVqB
TLSH
T178729E7D9F413CAC19A7C0E8C0B842D94C19B6A3DFE6806D21683D0DC798A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 abc8915ea21a5e6965080e1aa7d8456f3a89b435609602855066aba905dd3fe9
MD5 0bb8a1501d88c988e65fddffad72e8a4
SHA1 2656d3cb6efb0e211c535071e4783a7754a5e05c
SHA512 0ae2501c244291292bc84f98ee166e4e712b1cf3263a512ac5426cdf6b3498bc67161985a01923b149ca49c77e6168953c336ddd7b0f60dd3ce8e16b2f63ffce
SSDEEP 384:kuJWJzVca12krtuVm+SglBOVjeQ8RJo3hghFUjUXPW35PIm59+GDa50HIsYAVocU:j+zVcWrPl8RJYhgTUjUXP6t9+GDa50Ho
TLSH
T1DFA24D743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\AlternateServices.bin
Size 22KB
SHA256 1b678ddde2f4a11717a85876bd09910d1b3daa6b25877a48cdb524c81939df85
MD5 0cc301b7d8fe6bc029ebe7c3365d58b0
SHA1 ff79313f1deba78baf4cc1b6fd6efa95eac90a8b
SHA512 161570d6b28e1b29514d6b278d40bc4eda9375b9e0737b14fe57602f71a5d544e1d7004c5ba8cdfabd56862b65eec8b8383a20aec502e9014a534ef4698e0295
SSDEEP 96:8+8WumylFlBnYI56wNRSM/pU8mK3yx2Pgp84G+cjyuZPby8tPSo4LOrk4c:TvQ522okZZTFtK
TLSH
T1F9A299F37FB164A2F5638FB054A9705C9C330339986E9684C60494EB0786AD5E17FBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\AlternateServices.bin
Size 10KB
SHA256 bef38d1893b832512a26cf64417b57a7b3839813c15d3ab5ec3b9479c20a0f5b
MD5 2ba5b5ba11072a3f8501688f31909cd1
SHA1 58f05aeefdaf8dfde13766f6c0b6d66bc123d5be
SHA512 badf5fa44d3ab82cee7369cfb3de410889bf2dee0665c6c1ac1ec96d365d53f7bdde2ccd522ee897bac46b0bdae83735fcbd04bb713ee3675703e9c281e4bd47
SSDEEP 24:puhMZh21991D49xmPU9B6Pw9lsP09Vv0PT5q9F55A5tPE9FAP:Y3Fy62m6UWBidI569mI
TLSH
T1C822AAE36F71A462F0A28FB08059714C9C330365896E9588C64494FB16C2ADAA13EFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 189d4fbe54e3b363c2502ba5c7f177510b2f14a54afbc45054aeca459077f4a9
MD5 4cd30b0ac038029dbb8f2f6d3611a9bc
SHA1 17e702206316573ceb834e0eada387e00ca8d7b7
SHA512 7bcb9cb4faffe42ad5b6762a4457bb6a8d782baf45a6590edb74060b109138c28824c4827fb37ac99901b90073229c8cf43ba443c06762c3aea0e63ac48a6641
SSDEEP 192:doOv5zboYZJgyjm2Ur1d66Joz0dzgCl6mc0d:dTboYZJgyjSpd66JozQzgC1j
TLSH
T102E10DA4F628867BC449427BCCA61B454F35389AD84F3F15319C740C2C872DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8c0ae2b24169b2cf29dea20d604d4db6c8e86a890d9c69d3bfc2617e75d19edf
MD5 45caebf147f7393d14b8b9394862d34e
SHA1 ce7af4588e7cc85af3e3b7e445304bf087833fd2
SHA512 d5ee8dcba9c16dad7014ce7c5588a7988bc04b78986369c4f871098618d8d930bf1dbaf9c78f840b0ec503d45ee9ebe497ff50914c0e49f76f87b733f4df9ee2
SSDEEP 192:4r1d66Joz0dzgCl6mc0ddoOv5zboHBZJgyjm2:4pd66JozQzgC1jLTbohZJgyj
TLSH
T18DE1FCA4F628867BC409427BCCA61B454F75389AD84F3F29359C750C2D472DE3A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e5c837ab496fd418dbe8107ede519b791f2c0b7a38a7c25d53c8402344f44bdf
MD5 6b733f17ce9f565c79464196c8e003d4
SHA1 aaffc52966d0a67e0eac4566af87659917ee5965
SHA512 7293ff416e93c7ae24ac19f290d70a37182840df334e71ca8180aad52e4332b980fe8cfc2b22750f5cacbe28ff24c495641d94dab97b5b2921e7d8d11dd49e71
TLSH
T13D213A5C39B84D2AACCBE3987441028E67564E4B49871D434D12EF8DCDC19D9326A83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\events\events
Size 4KB
SHA256 998ada5d82f90f184ccd96693a0622082de730a91eb031c2339699ef9a45b82d
MD5 7dfd4d8ba4dff54d6a54874800307297
SHA1 84015c5c6d8c2b183a790ccfe55193f4aa6d0e4c
SHA512 ecaf582e9d28de24c05a6897f944f173a35b8276c1edbd1bb4283a3e0bafa68e13938097fa1695d9b5dc99ffccb78cffaa44cd96f1abcbd5fe180cc138220c26
SSDEEP 96:i8oNpsM56KoH4edEbdJlMTdenmwdRmkbR:idfEllEpnMp/EBbR
TLSH
T149A1EF1C75B90C7E2DDBD39CB48102CE97D9470394CB2D874C87EE49CD85A9A325E468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d352708-eeba-4fe9-aa63-45a5208173bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\0d352708-eeba-4fe9-aa63-45a5208173bc
Size 235B
SHA256 0fefff1600751bbb7d4cb7f4e5cc63ec7f607a9cee77c9748e4193d876c0b26d
MD5 fd18bef871af59d130713208102dbf54
SHA1 0a189b867c14c4fdf7b2d25fe288aa0e962645dc
SHA512 beb5bcc9c33fab36f04f8dec346cfb1cd4be36f381ce7b87dbb5c90319fb9bff9dc876f798432088f2850f31f8b7375dc4abadead8e2825b09d8453edf7367fb
TLSH
T149D0978034A87B1C08081F0FB0A068D631548C3760A4A810C9A141349FF89C841A2C0F
MD5 SHA1 SHA512 TLSH

Submit Download

256e77b0-49c0-43e7-88b4-f45173e85ad2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\256e77b0-49c0-43e7-88b4-f45173e85ad2
Size 883B
SHA256 6a4eb8b654b42bcb45d53ed7c3d293edbf8b9e5354681ac90ed8098155e6ebd2
MD5 ddebeac599934ae9ccd5c57f9011cd01
SHA1 7e19df5efa5f3950feabfe2199de829ce873ec11
SHA512 4b418b34340351d6ff12f0488b58d595e2fb11e74c23496adfd31c4ac88ecde5081dea09dad4364f642a1348b2b9a39dcf884a9452d67bd89c665df2e1e7a5b4
TLSH
T114110081A630F9B2CC3DC24F8A923B034BF47523C0CB44107E619A180DAB91E635670F
MD5 SHA1 SHA512 TLSH

Submit Download

64679e2d-563d-476f-adf4-b0b45a395567

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\64679e2d-563d-476f-adf4-b0b45a395567
Size 2KB
SHA256 e1abccede853e60a6ed34fd9f6feee14ab27ad0ac838b169d7aa8c456bbfd48b
MD5 6c1d444c5b6ac09f477ac2005d9f9429
SHA1 41e26f5b49c44e98bb133ef99d6e2ed981c651de
SHA512 afa43b4a3c203f669d838bc52821bbf1f7811f8719a8eccc94c0c88fd1f765a7f8b5238d44cc595427b27ccea02f531cdb9e6e79b8336d2c8002798a4c7cac83
TLSH
T16541109C39789DB65CAAE59DE092364E57A08A0300C61C437D61EF0C8C96699336A57B
MD5 SHA1 SHA512 TLSH

Submit Download

ad90fa6b-80bd-4b82-9827-6ef3d13fec55

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\ad90fa6b-80bd-4b82-9827-6ef3d13fec55
Size 886B
SHA256 9cab13e8be0d534527b25cba64cca5f57b4e6ebc11398864aa4fd9fa7571c07b
MD5 33c3b562ae79a58a157209ccef9e21c8
SHA1 02870610fab7a00bdb23392ab96804bb4c3925f2
SHA512 a56277a97816aa280d11d1cedd34ee27503a642a13e9d96c31dbe304ec1783c636231022432263b581c6e276600b1696e4913c99521ad87dd9d809716e845f93
TLSH
T1041100909670B6B2CC6DC24F89E17B4346E43023C0CB49147D605B181DEB51E67AA70F
MD5 SHA1 SHA512 TLSH

Submit Download

d0f8d3d4-35fd-4ffb-92fb-0f52c59d3df2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\d0f8d3d4-35fd-4ffb-92fb-0f52c59d3df2
Size 2KB
SHA256 5e877f1eda5a43ebf055c94cab4de85155caf6736e9dd51333291cb5c0ccca2a
MD5 10e3f3b7e2552b7a06bced8ee714a8c4
SHA1 14298f3a9daa2dbcd2ad0ab7477e5ed8ee2a6130
SHA512 3051297c78e0e366a3b841b8002ed70c40249c052d412dcf8e57dfdcaedcaa840308d95e22c1651cae7446881efa8fe5791569dd6edda7c115b41d6dd211665c
TLSH
T1AE5195669160D8BAC87DA31BDD213B838BF3140B408F190E9EECAF0A257FC0E9355649
MD5 SHA1 SHA512 TLSH

Submit Download

dbf637bd-d7e6-46fb-b995-d1d02754df89

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\dbf637bd-d7e6-46fb-b995-d1d02754df89
Size 235B
SHA256 1974108ed8b2e51cb7ea594b0b0e93d21705c87130a5eec0f26c3fc485457dcc
MD5 9266d8fc7434db29e294c1550e92d5c7
SHA1 557bc72403b61ce75e08c748524138546bd2565a
SHA512 86267950f54304c22a39f834300d7d0c47a5b92e38f487abaa1a2891d627b9cbc39534622d624d98453a34f8c02f0a31778375bf6ae64e99a0a562aa0686c377
TLSH
T168D09780249C272D4C180F07B0A078CA30A84D3314B09850CA900674A9BBDC8471191B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\extensions.json
Size 16KB
SHA256 eed7372b34358c39d68e149b47a47524874fd442a344efbc952007507dba2153
MD5 a4132b6397fac613b2113aedb719f807
SHA1 f56b91c3febb5086aea0cfef85d60b2798ac0ba0
SHA512 93b15d5441e53b3cc63845f776fc496a42f2306e75907b4aa62ba7a7ae0b5e185a68f7d04dfb4a28960ee736b51c00fd788a020bc175444953eed490687a33cd
SSDEEP 384:2kI4vrUmldvUg8dhWC94zf96olL4HuL4PfL4HhL4H5L4HKU4hD:ZI4DRf8BX/4p6W40474Z4R4n4x
TLSH
T10D72521545049EB8294FA79BAA367E02C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
Size 6KB
SHA256 869f5df5f23e68c3db59682c4a81ddc19cb51f5e4d018638037623fec9dc97de
MD5 28678b21f5f4535e6df4db361a9fd9b0
SHA1 9e24ecce75795c873be820b6ada35759ff657f21
SHA512 50072b8b74b10f56f1d0041b397ec832335fb68130f0bed4494dc0af9f6d665a264ec1d828c837bc7c9383787d9e12c6461b5ebaba5300240e99c6e2b6434a39
SSDEEP 96:xHPu5UTURy4qGqjyfDfRENC1zShUHOSSlQdv9jwntH+xiIgBw88H8L4cnKV1HBm:1u5hyTR2frRENCDuSSD+xi/Bw88vk
TLSH
T14BE11F789508CB7F74B6776CAC688C716AB2013BBBBF68D210B95484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
Size 8KB
SHA256 5fb54811cf823363e95e91ee71f14ffbbf73a7eef4f90233a0785abce4813efd
MD5 6a4f6b603e95e3347013dacbc68a418d
SHA1 089b2e2c4b2d040ed4e33bfe2b41b987d3ea1ad2
SHA512 28ab377bfefffcab6b9ae473536c0cca84e6a5c5416d4f0c08cc93ee76836ce7e99aca7e87836d554937e2c123ef78dd4c44b4dddd7410b351055860ec7db9a6
SSDEEP 96:xHPu5hYtEIA7TURy4qGqjyfmZRENCNbzShUHOSSlQdv9jwntWRJKxiIW5iBw88P2:1u5yyTR2foRENCPuSSKRQxi+Bw88VU
TLSH
T1CD02FF786104CF7F68B6766CBC6449716AB2023BBABFA8D310B954C5054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 6KB
SHA256 fd26640034f255eab622c548150c0a85c9c3b7074268d8d7fb0cbe49b53a1908
MD5 fa83b613392fc415ddfe2467bb97ba69
SHA1 75a66a8f66d98da6f3e058ebf021bf73a5212863
SHA512 5214d2193ab813afa7cacdd502449f0b314f4b9f1555dfcaa5757b5917cb84ba394a2559385d4ed34bbcc688a663855f37f73bd2512e5c9cbc8574017701219d
SSDEEP 96:xHPu5UTURy4qGqjyfDfsX41zSGeSSlQdv9jo7+ntH+xiIgBw88H8L4cnKV1HBm:1u5hyTR2frg4zeSSM+xi/Bw88vk
TLSH
T143E11E789508CF6F74B677ACAC688C716AB2013BB7BF68D610B95484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 7KB
SHA256 652db8ed0685d62987fa96823dcf15dcb583cc18b6042828cde3881d47b52b6c
MD5 70f51c835d9f0229c6e43d473485332a
SHA1 66cf84c37078c0568611f1eef8d620fbdf4afbef
SHA512 70bf2aafa45844d45a81faeb676e1819233ba8122793d32e2b1bc50b39873d487d4c9a0ce5f0c2f70af079e4d3cb2a6df93cc3551e2f04fce4afafb5775fd075
SSDEEP 96:xHPu5UTURy4qGqjyfDfRENCNbzShUHOSSlQdv9jwntH+xiIgBw88H8L4cnKV1HBV:1u5hyTR2frRENCPuSSD+xi/Bw88vL
TLSH
T1CBE10F7895088B7F78B6776CAC6888716AB2013BBBBF68D350B554C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 7KB
SHA256 8d51973456902386322fa6cc39928e4da640a23feed30d2b070809cf9dd3f9f5
MD5 4d62e3e6e6a6115a891e4bb9aa2d40af
SHA1 4da8c81a418ca295e5200cb4861bf18f42bd0b46
SHA512 5a3832d19f9bdad03b1a3459441b0e7aecf08b08d4b0584d4ea3c0b86559e2f748286db835c4d38cb6fe7a9148b2d653e9878d088d986191025f446473ec05a2
SSDEEP 96:xHPu5UTURy4qGqjyfDfRENCObzShUHOSSlQdv9jwntH+xiIgBw88H8L4cnKV1HBV:1u5hyTR2frRENCouSSD+xi/Bw88vL
TLSH
T1E9E10F7895088B7F78B6776CAC6888716AB2013BBBBF68D350B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 05727bd038e1558c3f69f8dc7fcdbbe24c989fea20d726d992212a629e137f3a
MD5 bd52f55b7f697c0b2a6ad2f6bbb48e5f
SHA1 0d5ab5a1ad9042f44ef5b135b6b7ec1cd3000f67
SHA512 1cfebb706304293a686fab729d716709eab1739d6e1c7941f940c304caadff16548c3ea4d2b87b65d56b0c6fdca2ba7b4145e452a6f07f7422d863aa6ae42315
TLSH
T12C21C683DC3E2EF9BA909150E0DE4FA2EB8D3030487198B081ADAE0565ED14E7746128
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3061ac77c67511e091823523872ee93ec9f9f0ddc288f20cc19b27fa54b8685f
MD5 ab4276bcf62c631e772c44ff8855cc0d
SHA1 f49398a9cbbd75d85e6e86495f3e87ef07d5b88a
SHA512 b0f8993eea9376a8e82203ddb4ba7cde0b8a20f5d6b1e8e90cf1e4b03eba7a2162202c704b1604743eb9e9760eeed373244cf7d53622ea67a9b72a45deb2f6e1
TLSH
T15431B887ED1F14B2F646E0DAD4C86F56B7F5505441699CF0C699BB005A6C2433779288
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 c9455626561e728072cc91e1aa42962fd14b9bbb62053ea7a05f39719ee4e5b2
MD5 44145f219ff8073635b2f5f50ba7ebfc
SHA1 0b8551bbed5afbeb229bdfbac40e3e67330b172c
SHA512 5bdd4ec5342587effb90084e46b30a9327a22c84605157288d5c0e0980bb1fba5ebee6c0cd543909dcf97d81a59b1cbff86604635ffdc32b01c0a51f98976ca8
SSDEEP 96:d2k7pjDy9jyyHnDJZaMK+cnu1ypSx2OiI58YkkLmaVa17aZg:dzny92663XlX658YkkLzc
TLSH
T13BB18E2BF91EA8B31635F8A594DDBE0C6792742996B808C4CF6C773580563482F2D3BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 97d3c89ae8c2bd6ec58c6862418aaccc559c181f97fcb361f86c5767625cc3c1
MD5 730996aeb561f95c0a9f0836f91dbf5d
SHA1 055602de56a2ee2d47c06c6ffa5b921ba03c4d72
SHA512 f96d6d82f6b2ed647e80e735ab2cbcb90a39da636399af64736cd6ff67b918d71cc1fd1b92c466ec6016762441d159c07b2e55cebad34fc74151a59f56f7a93b
SSDEEP 96:72k7pjDy9jyyHnDJZaMK+cnuz+SuWowXa87Sx2OiIE5LaVa17jvdy:7zny92663XI+uaWX6E5OWg
TLSH
T12AC16D6BF81BB4F34736F4A594DDBD0C5395682895B918C4CF297778905520C2F2D3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.jsonlz4
Size 5KB
SHA256 14d136cfc76f8f6cc6afa2fa2a5fdb94d6cc338c90b77a72f6041616bb4876e9
MD5 185a486aab741bf8e014e174a7ca18dc
SHA1 2f2637dd8d6a4c0001407c6f3970e5b5ba1feae4
SHA512 4edf4c5394a6e1773e57ba7328c37c4bc91f473899edee23927c473c8a6de9266b0b07c7dcadb8312108c2b4849185136ac0c0a16d67bb5ef684ca1694b6da34
SSDEEP 96:w2k7pjDy9jyyHnDJZaT4+sEy+zgLiuWMh0fvSx2OiI0cLaVa17j/dy:wzny9266Vy+zgLifvX60cOWQ
TLSH
T14DC18C6BF82AA8A35636F815E4DDBD0CA3896C15A1B51DC4CF297B68441520C1F2E3BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 c4d937972f0f96f39da0c88935f6277039fec365a102aa6d31c68ac5dd1c0ae2
MD5 abe2ce6fc5b1d1f8866060bc031c0c10
SHA1 a5efc45100fd41f7cd79a2945927273db90f5c36
SHA512 be0487814378e3812364335b211e6f714a828a23977757dae874b471fbb007712aed28ffc2049efa6eeb2ac84b305ede9b0ce8758f40428fad1ec03a03004844
SSDEEP 49152:6LBLyXaeUT6QC5zYY5UQJ5TXAvJFJXH0lXSIOqJldn/KiTHTBBfYvG4Aen7UiX3n:QFAenAiX3/mBoh6I
TLSH
T1D3665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 88d59a46f7b560ec2c302a7f74f59bf1c662b6ccd0af4cfdc99d89cb5606272c
MD5 0f9355bb5bc8e736747a2c0dd670b90b
SHA1 10810963b06aba22c1a5d6361d49ebd3dd4305a2
SHA512 3492ffb60719847664f5e2dfccfc40a312c4f6c41f2d4f0deca852adf11e49494382be9a1a29e5a0ac8088edf19ab62360375fdfac26f0e10d567ef2b5521919
SSDEEP 49152:OXq3QWjgmKR7bgYYvUufGwF1+B9/3YlJ4oWt:Gq3QWjghPufGS1+//3YBWt
TLSH
T101163AF824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 910058294874e6aefa1415ef916f19ca44599b5cb277d3f1a4d2e0c18badb73c
MD5 a51dc5a3c25bc2daf903f3f78e318d2c
SHA1 be71f26468753ef3212849a7bee3fe1e903894c5
SHA512 5efd41f7bf4bed119af8bb69db22c9900f49a1f3c34a3bb6a15e2c18692248b908b9200b2c225b101b153c36261c883b692eecfc5ffed186ae1459c7417efa5a
SSDEEP 49152:KXg3QAjgjKR7bWvYLeF/GwF1+BXtKRzJ4oCtA:6g3QAjgmyF/GS1+1tKRfCtA
TLSH
T1491639F824D1A257F3818037668563EB21AFD00C6477DD444BE966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2gRUFodF.zip.part

Path C:\Users\Admin\Downloads\2gRUFodF.zip.part
Size 202KB
SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
MD5 065a26b3f9570081f54201dad1bdc0e2
SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
TLSH
T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-1165-0x00007FF663650000-0x00007FF66368F000-memory.dmp

Download

memory/1096-756-0x00007FF663650000-0x00007FF66368F000-memory.dmp

Download

memory/1096-1001-0x00007FF663650000-0x00007FF66368F000-memory.dmp

Download

memory/1096-421-0x00007FF663650000-0x00007FF66368F000-memory.dmp

Download

memory/1096-7-0x00007FF663650000-0x00007FF66368F000-memory.dmp

Download

memory/1096-0-0x00007FF663650000-0x00007FF66368F000-memory.dmp

Download

memory/1096-1169-0x00007FF663650000-0x00007FF66368F000-memory.dmp

Download

memory/1096-1155-0x00007FF663650000-0x00007FF66368F000-memory.dmp

Download

memory/4220-8-0x00007FF6F5560000-0x00007FF6F559F000-memory.dmp

Download

memory/5040-13-0x00007FF6F5560000-0x00007FF6F559F000-memory.dmp

Download

memory/5040-1154-0x00007FF6F5560000-0x00007FF6F559F000-memory.dmp

Download

memory/5040-1174-0x00007FF6F5560000-0x00007FF6F559F000-memory.dmp

Download

memory/5040-515-0x00007FF6F5560000-0x00007FF6F559F000-memory.dmp

Download

memory/5040-9-0x00007FF6F5560000-0x00007FF6F559F000-memory.dmp

Download

memory/5396-15-0x00007FF6F5560000-0x00007FF6F559F000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads