bc65acbf7e21d8f83af870976c0394546335d9c2fcc1bfcda59b4bfa0073b764

Analysis

user interaction
yes
max time kernel
175s
max time network
173s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PDFCore8.dll
Size 3.9MB
Sample260803-lty9asff28
SHA256 bc65acbf7e21d8f83af870976c0394546335d9c2fcc1bfcda59b4bfa0073b764
MD5 7649f3b36cb9f961b5b08c4abe6ea3c3
SHA1 d8174ab0ce1db8e154680391152a5f4fc7f688f8
SHA512 3a01fb6dd7327852b6d76f408d7a80c47f18d8b20ed38d7e499b442bf9c186756a58bcd867d29cc5ad256f4327835b6d9ecdbb7ed08ec9ba1ea7ec4c60503912
SSDEEP 98304:b2xliJQ4DUrfgJuVUwpZfUCcabgWShASbyAdEOzutKVlnfSzPyi7:b2xIQTBQabgWShnbyAdzzvVlnfs/
TLSH
T18816D0123D8042E7E42A1370564EB7BDF2BDB7B80BE784C7E6D0E64829724867126D97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4628	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5868	OpenWith.exe
4224	OpenWith.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
7160	OpenWith.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 3060	668	rundll32.exe	89
PID 3060 wrote to memory of 4416	3060	rundll32.exe	90
PID 4224 wrote to memory of 4300	4224	OpenWith.exe	97
PID 4300 wrote to memory of 1240	4300	firefox.exe	98
PID 4300 wrote to memory of 1240	4300	firefox.exe	98
PID 1240 wrote to memory of 4404	1240	firefox.exe	99
PID 1240 wrote to memory of 4404	1240	firefox.exe	99
PID 1240 wrote to memory of 4404	1240	firefox.exe	99
PID 1240 wrote to memory of 4716	1240	firefox.exe	100
PID 1240 wrote to memory of 4716	1240	firefox.exe	100
PID 1240 wrote to memory of 4716	1240	firefox.exe	100
PID 1240 wrote to memory of 4716	1240	firefox.exe	100
PID 1240 wrote to memory of 1044	1240	firefox.exe	101
PID 1240 wrote to memory of 1044	1240	firefox.exe	101
PID 1240 wrote to memory of 1044	1240	firefox.exe	101
PID 1240 wrote to memory of 1044	1240	firefox.exe	101
PID 1240 wrote to memory of 2396	1240	firefox.exe	102
PID 1240 wrote to memory of 2396	1240	firefox.exe	102
PID 1240 wrote to memory of 2396	1240	firefox.exe	102
PID 1240 wrote to memory of 5952	1240	firefox.exe	103
PID 1240 wrote to memory of 5952	1240	firefox.exe	103
PID 1240 wrote to memory of 5952	1240	firefox.exe	103
PID 1240 wrote to memory of 5952	1240	firefox.exe	103
PID 1240 wrote to memory of 6240	1240	firefox.exe	104
PID 1240 wrote to memory of 6240	1240	firefox.exe	104
PID 1240 wrote to memory of 6240	1240	firefox.exe	104
PID 1240 wrote to memory of 6240	1240	firefox.exe	104
PID 1240 wrote to memory of 6268	1240	firefox.exe	105
PID 1240 wrote to memory of 6268	1240	firefox.exe	105
PID 1240 wrote to memory of 6268	1240	firefox.exe	105
PID 1240 wrote to memory of 6268	1240	firefox.exe	105
PID 1240 wrote to memory of 6276	1240	firefox.exe	106
PID 1240 wrote to memory of 6276	1240	firefox.exe	106
PID 1240 wrote to memory of 6276	1240	firefox.exe	106
PID 1240 wrote to memory of 6276	1240	firefox.exe	106
PID 1240 wrote to memory of 6288	1240	firefox.exe	107
PID 1240 wrote to memory of 6288	1240	firefox.exe	107
PID 1240 wrote to memory of 6288	1240	firefox.exe	107
PID 1240 wrote to memory of 6288	1240	firefox.exe	107
PID 7160 wrote to memory of 4628	7160	OpenWith.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PDFCore8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PDFCore8.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\PDFCore8.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\PDFCore8.dll
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27098 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {4d42c2b7-00ce-4444-8057-c5265e7a3373} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {55816348-bcb4-4ccd-b4ce-78660c6425e1} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:4716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 27323 -prefMapHandle 3956 -prefMapSize 270279 -jsInitHandle 3960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3972 -initialChannelId {5654dab7-6474-4f4d-ac0a-8882e04da8ff} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4136 -prefsLen 27323 -prefMapHandle 4140 -prefMapSize 270279 -ipcHandle 4148 -initialChannelId {a986a66c-f9da-4bb2-86b9-6b164d6e94cd} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2396
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3212 -prefsLen 34822 -prefMapHandle 3060 -prefMapSize 270279 -jsInitHandle 3064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3208 -initialChannelId {d196f2d6-58ed-4f9d-aa55-64bcd140596e} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5268 -prefsLen 35010 -prefMapHandle 5272 -prefMapSize 270279 -ipcHandle 5276 -initialChannelId {e3a3521e-5075-4146-b6f7-97926f0e8335} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:6240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32900 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {5015a98b-204b-4321-bd65-05380af8bffd} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5500 -prefsLen 32952 -prefMapHandle 5504 -prefMapSize 270279 -jsInitHandle 5508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {1345cf78-a6cb-427e-bfaf-c225b140034d} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 32952 -prefMapHandle 5864 -prefMapSize 270279 -jsInitHandle 5868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5876 -initialChannelId {928a9811-b41a-4639-8e2f-24bca5cc837d} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7160
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\PDFCore8.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4628

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 441f0dce5535f1fc575bfd0e450190360ca287b023d898731833269faa21ed69
MD5 a67c0a034624e98c380e4a7f98c75e3a
SHA1 78ac97a2891e622b5c3b2d6147bd99c2fd6867bc
SHA512 c11138210b727b61d58f75c58b280f155aad25d5a906af756069819622ea5aa02e853c90f01e1a1ba62ca071aec1ac9a8adb6a15c2354d08af93fb4636d73cde
SSDEEP 192:r31d66JoztdzgCl6mc0dmOv5zbo74Zjyyjuyh:5d66Joz/zgC1jDbocZjyyjf
TLSH
T173E11D69E629863FC408027BDCA51B110F39385ADC4F3F19759C650C2D9B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e748908acd180ff95ceef498021e9cdf88e77b41082d5270b6f41ce034031fce
MD5 77a79c3f0942de2051a13c5a678e0065
SHA1 9b224d0e6b631c8c1295aeada1898e4363b55280
SHA512 3e9838f3de5d58e03b07ba84851d223c0104287126d5161d5476d75e165a311e4b792c61e2fc22437732fada803b8f8087108eb15b720c16f691fcba82fa308b
TLSH
T16921005C39B84EAE9DC7F37C7445128E67554E0704471C874D12EF8DCE82AE9326943D
MD5 SHA1 SHA512 TLSH

Submit Download

116df5e8-73e4-4c36-b250-6ea798957349

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\116df5e8-73e4-4c36-b250-6ea798957349
Size 15KB
SHA256 06315620b5f44ea4b6444452373361f766e2659938e2fa6e74607a9e0e0c2783
MD5 5a1bcdad58da767a3d017ffcc9f71c86
SHA1 298cf8f2c620002bc0a528005bb6705a3428ebec
SHA512 9372bb321b68a4a01db825cd3fdde76f99cb6aa677af508c2de0aacfc72c33af39c51f4a6c3ded2208e47ec91eb3c82d9d6fab840cb31f517bf7bbcf246c636b
SSDEEP 192:YoEpqCy6zx75LU2rKUbxaZe3VKoaUxck7dyC96g1Cg+98GBuglV5J9exPZ:ypqb6l75L9rKgxFKz7oAVNeD
TLSH
T1D462D84A6420597E8651E368D8EC7FC3E2F618CF8C019FCA9BE47E0859EE05E5127D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2292b744-1d97-4c81-9593-6c0314d45aba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\2292b744-1d97-4c81-9593-6c0314d45aba
Size 235B
SHA256 0f7a1ea1f500c05d4c1551eb310c81d82145d20726414d48b989b37107042754
MD5 167a65395747ce8fe7dc19128ce91c7f
SHA1 8a1899f5a45091b325f6600ddcd479a7a9b29cc2
SHA512 c646bffa8556446e8b8b5d1e55777b29da9ea36f8a1a19036360ad1fa6c396db8899c4d05d2d93e9138ff4c46d82d661f679fdccb341d081aa7b1089368243f2
TLSH
T1E6D0978068886B6C08140F0BB0A06AC371858C3324E09821D662407889FAAC80192C4B
MD5 SHA1 SHA512 TLSH

Submit Download

24911505-d4e5-4838-ab44-df973e05f2c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\24911505-d4e5-4838-ab44-df973e05f2c4
Size 883B
SHA256 eb0a38a7800c2f2195ed6ab57c9e6e564a571eb20017dd8ae70b3a0fbbe3d4b9
MD5 2b5c80763e23ac8f0dc7b3ffb2eabbb5
SHA1 a080ccb8460977821a6d5b912fd0aa7d9b163672
SHA512 1278d181cb617f20e4402c55c71c685284973bb8257046202ad84bbd8855e2c091966c4741a468b8aad4b9b252531cb3f3d0f60453a14e8f837b2a36f730985c
TLSH
T18E11D041A3207AB1CC38914B84A537124BE86423C0CA90147DA05E044FFB61E9796647
MD5 SHA1 SHA512 TLSH

Submit Download

5a6da1ea-48d5-40a9-96db-24e6bde15a6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\5a6da1ea-48d5-40a9-96db-24e6bde15a6a
Size 235B
SHA256 b87340c60f0392dbba417a97faf1279ba33e52f0875e5e101a840441192373dd
MD5 7fd1c6f348d87ce78660ade987084128
SHA1 f5b7ac0d5551858849d04bdcf76cc56a1ff5f169
SHA512 ea4cd1e0017528b3def888b4701d2e7036b3f38a75ed6b82c236d501ee73ddc3ff23c4a808317cac2247c8a61cb1fd26a13ff6a5946f00c13bff7e1d7eee9cae
TLSH
T1A6D0978018D8333C88140F53F0A02AC330844C3310B8A820E95A43B4CDBA9D40261926
MD5 SHA1 SHA512 TLSH

Submit Download

ad84a18b-ce7c-4b95-9e41-668531087f82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\ad84a18b-ce7c-4b95-9e41-668531087f82
Size 2KB
SHA256 97bf4dc6f712f64260a1da7210f16fd599bd65589ea17038113e7ba1443e41e1
MD5 286ec029c5e0221ff1648b1720e1e13c
SHA1 50c86dad430c3a43430c62c1ae5402b261000e1e
SHA512 7e89ff3d6e5976daac5fe8e30ad1c335b173dc51eb427fab34e5da365351942ea626196cc10e32ea81342c6551b339dce02f0fd4b560d42e377452e8dff8e215
TLSH
T12441646C35745DB798EAF14D9091328A43E08A53508728433E45EF0CCEE776E636B52B
MD5 SHA1 SHA512 TLSH

Submit Download

fc36d0bc-2038-45c0-8262-353941b2c045

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\fc36d0bc-2038-45c0-8262-353941b2c045
Size 886B
SHA256 4f42f61141d430115e95188841dbaf8ae695644c50249662781a528ec215ff20
MD5 87b0e9b3e322758343a7a0b5047de38a
SHA1 77b7d1c90f8706971e5867e5d4b7e70e2c849a36
SHA512 7b45c32c5bd2cb98e91541e786db7fc45f28270026f969273462778e98f217d21f27d148f1e0d4fa8e211ffc1f3bef4557d6649dd01843dde272d1ba38cf92e0
TLSH
T1B41100818321BAB28C78D24B84D077028BE47023C0CB19187E906F184EFF61E9B66B07
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 6KB
SHA256 360fe0bd2d35f2e999590197666066620a9f32932e59c94d126bb5fcb3ebe085
MD5 a12c51400e46c59200aa69703483a3c9
SHA1 9a4638e8261725ab938a5570d88f97d79f8d2c91
SHA512 64e8c93d96c6cb4f112f75efc57fd4830d64d7f3fc59e0eaa2e8c9d9847988b97d2124a5562e220f5d4ba4067db34515e2552b07b9e0e19b860e5095855aa946
SSDEEP 96:xHtUTUPqGqTfWVM1zSaSSlQdv9jHnnH1Bw88u8L4cnyFa:byRTfWVM3SSG1Bw88B
TLSH
T154E10F7890088F7F74B6766CAC688C316AB2017BBBBF68D650B954C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 6KB
SHA256 2dfd74cbf9942acdb6e801bd2888d60999dc63159ecdea150d3f0b1eae3b3834
MD5 8ed38fb67da8e170d5ae5b4f760c29cf
SHA1 38518988d306b34f444f95422862e727fa04263c
SHA512 6e9fa231749c4517440a540061a9e4b65dad6656a9ba5dda754480803139273b803e65454c1aad9844f8578672b7ce7b29a18ffd907a181fcbccceddbe04251a
SSDEEP 96:xHtUTUCPqGqTfW10ObzSBsSSlQdv9jSnnH1Bw8Ou8L4cnyXa:bSCRTfW10zsSSj1Bw8O3
TLSH
T137E1FF7890088B7F68B6767CAC688C316AB2017BBBBF68D650B554C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 6KB
SHA256 db4e1931bb157ec641fa6847d37f977aad10a01585d693a08066c7d96fdb827a
MD5 15b20753b7b12614400835c64de62506
SHA1 0287bc0b8121bc60ada452d48c9e4f82eb12f0e4
SHA512 dda498d123914b6b2f5bf1b7f254072bc2f5b35df139fe5769f8ee4ed6353708e7fb6ffbd6f5d04ec86da237d3585e076e28591b13cdc651d55f04ca36546c57
SSDEEP 96:xHtUTUCPqGqTfW101zSBsSSlQdv9jSnnH1Bw88u8L4cnyFa:bSCRTfW10EsSSj1Bw88B
TLSH
T10EE1FE7890088B7F74B6777CAC688C316AB2013BBBBF68D650B55484055CF3846F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 6KB
SHA256 7e9a947bc0ac634f4b8b14b9c32646fa673e890011f6845e9b5f14b88f1b33d4
MD5 0bcf4c4a60211213a5fd33b4bc573b6b
SHA1 1d76ddcfe0b41a4f451729dffad080b9884918e6
SHA512 2273adc5bdab0ff902633f6b7b23355d0691001ca297d5746c68b7df8488b97754c1485570b17b0db201ade01f8014652063f2be347a989f81dfade3d1af1f63
SSDEEP 96:xHtUTUPqGqTfW101zSBsSSlQdv9jHnnH1Bw88u8L4cnyFa:byRTfW10EsSSG1Bw88B
TLSH
T1C3E1FE7890088B7F74B6767CAC688C316AB2013BBBBF68D650B55484055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

PDFCore8.dll

Path C:\Users\Admin\Downloads\PDFCore8.dll
Size 3.9MB
SHA256 bc65acbf7e21d8f83af870976c0394546335d9c2fcc1bfcda59b4bfa0073b764
MD5 7649f3b36cb9f961b5b08c4abe6ea3c3
SHA1 d8174ab0ce1db8e154680391152a5f4fc7f688f8
SHA512 3a01fb6dd7327852b6d76f408d7a80c47f18d8b20ed38d7e499b442bf9c186756a58bcd867d29cc5ad256f4327835b6d9ecdbb7ed08ec9ba1ea7ec4c60503912
SSDEEP 98304:b2xliJQ4DUrfgJuVUwpZfUCcabgWShASbyAdEOzutKVlnfSzPyi7:b2xIQTBQabgWShnbyAdzzvVlnfs/
TLSH
T18816D0123D8042E7E42A1370564EB7BDF2BDB7B80BE784C7E6D0E64829724867126D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads