a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Size 5.9MB
Sample260810-ee2bsa1aje
SHA256 a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7
MD5 c774d5974de582179c34963c36752c02
SHA1 c5ea7995fb4caf689b3445b1a786bb9ee95b4807
SHA512 68e452cb351f32bdc4ebfeff1e3c423a5f2b02bcf5af18f9adafa65431d1fb7235b5e3acc7ee93638283657dff528954b9c97a9504287da1ada9adf804855b4a
SSDEEP 98304:XrojEhNYLL8Al52eIP4bO18frP3wbzWFimaI7dlo4:5PYX8AlgGgbzWFimaI7dl
TLSH
T142568C51BE8D8176D90B113247299F6A102EBD28773465D3B2B43E7EEC323C16D3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence phishing spyware stealer

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe /onboot"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Low Rights	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "221"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
Token: SeDebugPrivilege	1016	firefox.exe
Token: SeDebugPrivilege	1016	firefox.exe
Token: SeDebugPrivilege	1016	firefox.exe
Token: SeDebugPrivilege	1016	firefox.exe
Token: SeDebugPrivilege	1016	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1016	firefox.exe
1016	firefox.exe
1016	firefox.exe
1016	firefox.exe
1016	firefox.exe
1016	firefox.exe
1016	firefox.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1016	firefox.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 4924	1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	84
PID 1812 wrote to memory of 2424	1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	89
PID 2424 wrote to memory of 1016	2424	firefox.exe	90
PID 2424 wrote to memory of 1016	2424	firefox.exe	90
PID 1016 wrote to memory of 3816	1016	firefox.exe	91
PID 1016 wrote to memory of 3816	1016	firefox.exe	91
PID 1016 wrote to memory of 3816	1016	firefox.exe	91
PID 1016 wrote to memory of 2960	1016	firefox.exe	93
PID 1016 wrote to memory of 2960	1016	firefox.exe	93
PID 1016 wrote to memory of 2960	1016	firefox.exe	93
PID 1016 wrote to memory of 2960	1016	firefox.exe	93
PID 1016 wrote to memory of 4968	1016	firefox.exe	95
PID 1016 wrote to memory of 4968	1016	firefox.exe	95
PID 1016 wrote to memory of 4968	1016	firefox.exe	95
PID 1016 wrote to memory of 4968	1016	firefox.exe	95
PID 1016 wrote to memory of 3468	1016	firefox.exe	96
PID 1016 wrote to memory of 3468	1016	firefox.exe	96
PID 1016 wrote to memory of 3468	1016	firefox.exe	96
PID 1016 wrote to memory of 3612	1016	firefox.exe	98
PID 1016 wrote to memory of 3612	1016	firefox.exe	98
PID 1016 wrote to memory of 3612	1016	firefox.exe	98
PID 1016 wrote to memory of 3612	1016	firefox.exe	98
PID 1016 wrote to memory of 5412	1016	firefox.exe	100
PID 1016 wrote to memory of 5412	1016	firefox.exe	100
PID 1016 wrote to memory of 5412	1016	firefox.exe	100
PID 1016 wrote to memory of 5412	1016	firefox.exe	100
PID 1016 wrote to memory of 5492	1016	firefox.exe	101
PID 1016 wrote to memory of 5492	1016	firefox.exe	101
PID 1016 wrote to memory of 5492	1016	firefox.exe	101
PID 1016 wrote to memory of 5492	1016	firefox.exe	101
PID 1016 wrote to memory of 5504	1016	firefox.exe	102
PID 1016 wrote to memory of 5504	1016	firefox.exe	102
PID 1016 wrote to memory of 5504	1016	firefox.exe	102
PID 1016 wrote to memory of 5504	1016	firefox.exe	102
PID 1016 wrote to memory of 5536	1016	firefox.exe	103
PID 1016 wrote to memory of 5536	1016	firefox.exe	103
PID 1016 wrote to memory of 5536	1016	firefox.exe	103
PID 1016 wrote to memory of 5536	1016	firefox.exe	103
PID 1016 wrote to memory of 5688	1016	firefox.exe	104
PID 1016 wrote to memory of 5688	1016	firefox.exe	104
PID 1016 wrote to memory of 5688	1016	firefox.exe	104
PID 1016 wrote to memory of 5688	1016	firefox.exe	104
PID 1812 wrote to memory of 1128	1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	110
PID 1812 wrote to memory of 2436	1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	111
PID 1812 wrote to memory of 2880	1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	112
PID 1812 wrote to memory of 4836	1812	a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe
"C:\Users\Admin\AppData\Local\Temp\a68212c4fcee6736adcbe6c4902af79f7e3821582b1d60a327d397a8862235a7.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {1818a16c-81ab-407d-92a7-01f9f6e60a5e} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3816
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {3885dd77-e3b2-4f1f-b8f7-5c54d6fe54c4} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3516 -prefsLen 25164 -prefMapHandle 3520 -prefMapSize 270279 -jsInitHandle 3524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3532 -initialChannelId {89fb77a2-fb89-4f7f-8241-b2c7023b36a4} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3716 -prefsLen 27276 -prefMapHandle 3720 -prefMapSize 270279 -ipcHandle 3800 -initialChannelId {ddcc16fd-dae6-47b4-9b63-160e8f90f581} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34775 -prefMapHandle 4424 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {6759e890-8e7a-4bc1-8697-17a71ad5ebf2} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4976 -prefsLen 35012 -prefMapHandle 4972 -prefMapSize 270279 -ipcHandle 4740 -initialChannelId {781b3c62-5d30-4571-ba2c-13fc78e72d8f} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5412
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32952 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {79f0982c-9a84-40cd-a398-52efdde9b760} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32952 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {12b3eb34-0bae-427d-af8c-5bf19d73fd58} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {7fd2663f-a8c6-4568-9eec-f16ece901f7c} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {0c107d7b-5fe5-431e-beb0-08a199b9e57a} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5688
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1128
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 1d89b2b1bb9cf61bddfd35df79ccede03c72a9b9e1b94f87aa82f5587873f869
MD5 fdbb45c8266266c1692a22f486e3a6cf
SHA1 a2fb471a77f3c497e67ee6d82102c99b47a47397
SHA512 ac20bde940e45d975714d6a1fd06ef3e24cf801f64cc1c54da8b9280cb39d89a9ed31f1fa900ad55f5d4d27582bfcfc883a7f0fa39ba4de01f594c710e23ded3
SSDEEP 384:HwCe7iO024YNDL84KKDL849B7SOEAd9KVRaAcP+AWRMAuwMM:QqZYNDL8lKDL8CB7S/AmVAf+hRM3wMM
TLSH
T12A728E399F013CAC1997C0E8C5F892998C18B6A7DFE6806D21683D0DC7D89A9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 dadff73476f18fe212dc4ef728ea5d8d6f1fe17cdac77ba8f1b40545f06d64a8
MD5 a9526b806e8624ed29fd30a21aa25a2c
SHA1 54d693d1bfda19fd432d11ebdf29060316795ae6
SHA512 7969645bafd072d409bd9cb75d9e03a239e5e2d5b25d012eb4422d7ab837ec1662b47e4015ede8206a216d97391353c32063f38a60ee3e375f1bef3f9c1a250a
SSDEEP 384:HXkRyiO024Y+DL84KKDL849B7SOEAd9KVRaAcP+AWRMAP:3mZY+DL8lKDL8CB7S/AmVAf+hRMG
TLSH
T16D727D3D4F003CAC25A7C0ECC5B992AA4D18B7A7DEE6C06D21583D0DC69896AB5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 6259a898018dce19d7d2e1114830d090f0fa837543773fbd768f3ff820af6c18
MD5 e2efe349c6c99fe549eee6202a864838
SHA1 5410e3c2f5f8018238dcb87236d0200314198ed8
SHA512 038b2ae206a59a05dcccb9d63e7730cbf9e591a722501f3bfc98cdd624088923e84f06d7650231df6a9520e2d8622f3a2e74651ffc6af7da025a0f0c58880fd9
SSDEEP 1536:jTrliJN5QTDDEg9JlavqrdOQcqB5GKBgdCVUsU8zB6dDANqPeIgLfwzUq2u8W0Xm:j3lNlavqVlPUWwCNqY2Qno
TLSH
T178A3BFF6DFA2C93C65FFD01D6AD2843EFD262404B3A73009C9636720A1C5BB87679649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84b04043-8620-45a9-88d3-850f2e5c2b2f.zip

Path C:\Users\Admin\AppData\Local\Temp\84b04043-8620-45a9-88d3-850f2e5c2b2f.zip
Size 3.8MB
SHA256 0c21f80ad1b3796c49429949e6a3d52cbe9c3b5b4c317690a749d80076396d0c
MD5 2d6fbb131e74f2bdbcc6e31d29b4a611
SHA1 8d7f58b2786c678f2502e83642b70183d80f64b3
SHA512 b3e43f1fa9c6dcd683c39cb32662e00753979618425cde33119510b8dd1e39b2e9ec29fcfe56fc9a8d4615e71d4412688d2f8cf1e2ee2b460a4c82d756d5e874
SSDEEP 49152:VdfjDwQTlRDkFv8OkaeyRNcFXJpaufQGndS+m+Zg/eBmMadCQ9zrqy0RHQmkAHY6:Dfje8DTM0JpzsQZg/umMk9J4NHYUlo0
TLSH
T12006E075D65C3609C98F83BEB50C2FC3984C4FBE8C54A96F6A6A97715CA31E63BC4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 535957dd15c49bbaed03df5d04f1df91d5f9860a924f968b3441801441073947
MD5 a633a8f54aa0178dadbceaed94b91209
SHA1 fd6798bc658761df3a4f35aac7a64c6b4cabb5fb
SHA512 7d310c7eac9dbcadbecbf5f35e0493be316955681afc399426c372e6399b69cbfa6199d0708dc84be5e0ea1c2e0e0fc3e7505a451d7b344ccf7023daf1a92b2c
TLSH
T1D861C958F628863FE445413ACC961B412F347453A8AE7F2A35AC604D1E5B3CDBACE17D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 63bb2d275fdb7bb17afbb19a562c9d8b30e4e4c0cf107679caca5f44856ad7c6
MD5 9e61cc8e7a3c6c771eaac30fbb8cce0d
SHA1 2edb58e69072480edfc663f44130040adc8e2573
SHA512 ef76f2308bcd98abc8a31cab35763d674c667c7efe8c469852d8be5773f139e787a89625f11db6331970b0e4bfeecab1268bfa35f8b72e8eff1925389ac21203
SSDEEP 192:v1d66JozGzgCl6mc0dxOv5zboZjbCWyj1/c:9d66JozGzgC1jsboZjbCWyjG
TLSH
T186E10F64EA28863FC405023BCDA52F410F3A399BAC4E3F1935DD65082C5A2DE7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 c856bb1283a6f22075a2d013a6047e2405cf79c3e9e777748dea8eb7f3969bfe
MD5 3efa4179f49b1153d44b6392b8df7226
SHA1 4144078237ad15b99f5154dd383c59bb87e0e6b0
SHA512 e72e3e4737231818f3817fc160a26c760a594415acef11d11f0e5980f29901f148b55d8010f3bcb8409910e11128b0c215fc46fdbaa2d9f3ea7656044326630e
SSDEEP 768:RTDJEYOu5KVcD0Gcmhu+vyK+c/p01RbxbSbfbJXH:VOu5WUvyi3
TLSH
T120D20184FB2E913FC41512BBDCA51B142F79B88658192F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 74d40e790470024ab0938a0523860250fcd9f5b65a4be1ee92627d5c9b0c550a
MD5 cb6908b61f5b51f9991172364f4772b2
SHA1 973fec3c221aafe9032c2c6e4707c0025ed89588
SHA512 ee5e4615196cf7c7dfff1fbd8bb8998fbc859f6177292b1605e4bea4923d8512ead8739c37fd27b40ee6fa17dacdb95a8965c6705ced674a9060b584c5026348
SSDEEP 768:6EMTD4Ou5KVcD0Gcmhu+vyK+c/p01RbxbSbfbJXH:JOu5WUvyi3
TLSH
T194D21184FB2E913FC41512BBDCA51B142F79B88658192F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 d95706ab891ca5af038535242393207ea5b6eaf8c92d3b18e5e768c9fe223fee
MD5 e07f11748d10dc4a1ba0dcd303940e55
SHA1 b81d99e47bdb059f9ad9e261c223b6a0aaf011f1
SHA512 60edbb4d865ffaa0634ccb98af410b2a4699dc32755a36b9481558217fab5feda61c0c05192c40ca4394281e72062b8b002e5c0ebba19e27bc4a9bb1e606b9bc
SSDEEP 768:dOu5KVcD0Gcmhu+vyK+c/p01RbxbSbfbJXxEMTDf:dOu5WUvyiH
TLSH
T10AD21184FB2E913FC41512BBDCA51B142F79B88658192F9B3A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c21a837091edc08525d89ba9148cd4ac86d5bacdb424445707bff72a8c02872b
MD5 0ef3f1bba4b4930b1f775cb271cdc0a7
SHA1 0cdd1188f6eab1bad7c2faa8cd5c7c701b9d7830
SHA512 0abf678083cb8e86233827796422b54f79e74aa361a5f3afc372b8caddac8b55b34549f8115a5ce0ee61fba6e69c0568e223234698ced790bd0d5c9bd1f694e9
SSDEEP 192:v1d66JozGzgCl6mc0dXOv5zboPOjZCWyj1/c:9d66JozGzgC1jqboWjZCWyjG
TLSH
T19BE10F64EA28867FC405027BCDA52B410F3A398B9C4E3F1935DD65182C5B2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3fd4865e61788090c27d4a0d5afc9c2037e2dd018fee19d7c48995dff35c0d3f
MD5 6407ae61addb3e93deb18ef873911650
SHA1 a12c50b8e9533cc6e71837e2a4a2b1f391fb9d7e
SHA512 0178a1082b9092d384f19c2606bc3ddc5986be8e18288cb614907482557e3d7d03498c6680df71e43bc22c61a06699c24c2aae7c6f9ebcaf6be5087a3e46324e
TLSH
T1BE217C5C39B98DBA6CC7EAAC7581128E53154E4B04871C438E12EE8DCEC9ADD326A53D
MD5 SHA1 SHA512 TLSH

Submit Download

02b0fc2d-f572-4f74-8bee-aacec98a5d46

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\02b0fc2d-f572-4f74-8bee-aacec98a5d46
Size 235B
SHA256 2e5dc84318cddced131a0f64ef8e0c5ea0b71372914e3c724349b989ae40a044
MD5 140851b4e1d040657da81e4ba933564b
SHA1 8783862bd6903ee6cbfe1660f2114d8ae6fb11c4
SHA512 8a7c5520a2be3a0597e77bae50b0069d4bf1ae497893cfa929d0c10b46ad37948f545bddc21864496c23a865bf63019a020cb2a747b85a414cc6b75cc69660e4
TLSH
T1C5D097D02898736D08100F0AF0E0BEC730A88C3314705920C9A048788AFDDC901D2C1B
MD5 SHA1 SHA512 TLSH

Submit Download

310adae6-257d-4182-858a-254b16d105a5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\310adae6-257d-4182-858a-254b16d105a5
Size 15KB
SHA256 a69028fc32828b9e2cb8bab9d77c20ca254898aa29b456c476294c80986c1956
MD5 509862953758e7266ad12235d4ce20b7
SHA1 d393257b34659afe706bd0c524e0fb11ee668bdb
SHA512 e7c62f19464fc2ba62fe9c1678e186187b27e760735c385592b679e13c7fb072ea33d7c8332c20dc100837579775a1cc430f88cab038e705d249a049fa4fe4cf
SSDEEP 192:6LEpIS7EEieUOQatjEnDLNmt2AXaRmBRuVaa1/Hg8vdczx6Lh367SgIt9S:s5LNU2AX6mWIOgial6N367Sg/
TLSH
T14C72B7565820457A8251E36898FCBFC3E6F638CF4C019FCA9BE47E086DDE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

324a3cf8-c2fe-443d-837f-d894c4320f59

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\324a3cf8-c2fe-443d-837f-d894c4320f59
Size 2KB
SHA256 aaf8c11ddcb21d84502ef01e3cd01d6652503938c7057a02edb2b4105e3b9d5f
MD5 664e2741306742e0a767590d392f3d0a
SHA1 cce2f306a2f3b6343f89107315d852551574f7f0
SHA512 917536d6c6ec83c45ff6927f06e3b721f0415b1e9b4f0e68e854642952488cdc79277b492a33aa0f14998920640207d7c6ced34dba355a7cf72f771d88fc7a26
TLSH
T1BF41205875784CB68DDBE28DD582238E97B08A0210C628832EA1DF4C8CD6799336B52B
MD5 SHA1 SHA512 TLSH

Submit Download

74a77cfe-a349-4d3d-a0b7-bd09b29de62c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\74a77cfe-a349-4d3d-a0b7-bd09b29de62c
Size 886B
SHA256 54e4d2bfd1e7ad6a7eecc67190e6fbe1f308476e1f5cd0f5ab669cc3961208f5
MD5 ba6ff44b3c80214b0cd9086d67bd277c
SHA1 976b44deb7a08506e2670d3a84c8674bd91079ac
SHA512 903de7bb4446eb96ca467da16010a5c6121ad313a6f9a4ce199f1ad3983ee10b409af325dfbb2d8c67815a413897f2dfdfb1fbdfaa78dd33517e7593db82607c
TLSH
T1171104819A34B5F2CD6AD247D99077538EF5712390C905187EA01B180CFE50EA3A770B
MD5 SHA1 SHA512 TLSH

Submit Download

7bc3f601-ab37-4a90-b662-c0175c2c2ec6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\7bc3f601-ab37-4a90-b662-c0175c2c2ec6
Size 883B
SHA256 cb05f8b04a5e0ca0b1da36d141de4dad8c89fa38f0c391141b447bee6854c68c
MD5 7ccf5fc41c496b1b41f8a8d6b0195451
SHA1 069cc6788215777c82d1f203975b658ce2afb432
SHA512 d5974ada201ef7a93bca81e803f5f9b9f474b079cbfc7053e73d18cff1115171db4efae75b2f168478a423c7d72256ffe92d673a0a592215f50d326db5985c4b
TLSH
T10A112341E634F5B3CD69934BDA5577528FF86533D0CA50183DA15B180CBE61DA3A730B
MD5 SHA1 SHA512 TLSH

Submit Download

b6fa8551-4ee4-4d1a-a97e-03ed765be54d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\b6fa8551-4ee4-4d1a-a97e-03ed765be54d
Size 235B
SHA256 346e5de99808ad4e558e8e99a1c647976bc84f409c4fe34eb7b5e58cc8db78cb
MD5 e1485782063a24f0b405c80bd5a7970d
SHA1 64705317b3656aa42569ed32a806328ba22b8618
SHA512 f6f8a9caef36c03c0102085d1f7013138ceea96323164fda68a1f04d6d82dc28a8271e07674e1e73d97bded209d2446cdfcd12c2072d28b86a4b858ef5faaa85
TLSH
T1F1D097C02C98A31C08180F17B0A0BAD370484C3310B06C109952663899BDEDA0262826
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
Size 16KB
SHA256 87074c05c6348e073b86529bfa4a858ffd3600f7382bbb1d1234204e5e576150
MD5 b047411ff9cae95dda6484a70952a7d9
SHA1 7c4748e9912da0fc57b71fcdc2a895577dcae824
SHA512 45ac0153f63b63e19ef60ca2384a9f5eca2985034b2225028e3ad210fb38ba84ef44f3257baaa4ad91464e0585942e6dbb14b4afb1fc99d2add479f8639b4f8d
SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4Hy54hA:NI4PRflXV4H6Ct4p4H4E4Q4C4S
TLSH
T10072421545048EB8298FA79BAA367D01C37D473B60845C78F4DD8FC842FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 7KB
SHA256 ecb1cde87ec7eef1482fb98ecc4b949e8f22e9ad0d54dcc6b6a3de1b37d62df4
MD5 038ffbb8243a816c39356894ddb5f1d2
SHA1 7b78b64b909f8a850b2403d4d68a08c40ed59fe7
SHA512 4e4488ea5e0988e58f64c48a3a0050bb614c2a0a812ab4ebbcddf6a28e3990ee1b33b8d018bf2838a4ce1b40ffcffae32eb4b3531237d6ef4476ddfd2578c1b3
SSDEEP 96:xHglTUPDqGqnfCnGObzS6SSladv9jwn3H8RgBw88Z8L4cnFsC:yyORnfCnGkSS782Bw888
TLSH
T136F1FD789004CB7F74B6766CAC6888719AB2023BB7BF6CC651B554C8454CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 9KB
SHA256 e3910f7f5c277bd9c218a5be80c150a8ab1ba19baa197e81943387113ab0185d
MD5 4d5b4a81aae1679a34b31e0d48a87c84
SHA1 5a7342fd1e6a2c4b31d933f16d4ec7f5f07ba51c
SHA512 486e38cc812496cd30b59fcca201f5ef8f70fcfc247d982a0033c5261a48b188b721db7888e4c63c9939ab89e41ace1de34bfa2453c06a857225564911b8bb28
SSDEEP 96:xH7lTUPDqGqnfCnGObzS6SSladv9jwn3H8Rw2HOBw88qhQSWb8L4cnFsC:xyORnfCnGkSS78XOBw88fSWi
TLSH
T19212FC385004CB7F64B7366DBC2849719AA2023BB6BF6CC706B954C5454CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 8a9bfdef33387b83169c431b8ba74e1b377c95a9df28317561b875853e19d93f
MD5 15dc8ccfc93d1052b396130cc490b3b0
SHA1 08e5e4388beb506492af739b518a0108f82f7ee0
SHA512 81c7aefb732710408862570191b550b3b6204668cd48188cd0401bc942c4f5b64403c0f4367dc362d61a0108c0c5a0107144bde239078b34e0abd75e5628551b
SSDEEP 96:xHgUTUPDqGqnfLnG1zS6SSladv9jwn3H8RNBw88n8L4cnFpC:yfORnfLnGDSS78HBw885
TLSH
T1CAE10F789508CFBF64B6776CAC6888719AB2013BB7BF68C650B554C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 86639cde85910cf9e803f871bb7ecc9c4c6997592f90e6da54fe097cabd99de7
MD5 4c4fb860fba16a67a46c7b3db2eb7632
SHA1 80b34e08465d7d2015d6447c854771b807997737
SHA512 cda718e1c1e8cff5069309d223c55912604e1dfb354705c0d4fffbdf542808d13135f987de9607dfca965e2c8012ba2a5d689868e76eb589369769072f9c86a7
SSDEEP 96:xHgUTUPDqGqnfLLy1zSjGSSladv9jqn3H8RNBw88n8L4cnFpC:yfORnfLLyyGSSF8HBw885
TLSH
T1B7E121789408CBBF64B6776CAC648871AAB2013B77BF68C750B554C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 f2d810d8833d908bcf41c17c356c75e2f720ead14a56157e61d17bad774e58bc
MD5 f7c0d3d26971ffaed2134e0fdfa4aaca
SHA1 99ce882e94bcea1f572df9ab5ab377ff5cd28a42
SHA512 bf49d0a5f3720391c373dacd16832a073f65c47998fac3d1cc95f81243d74d2d2fff82b3fa026b5f51abf327fc1358a87072dd1b970691d186995584d9aa69ed
SSDEEP 96:xHgUTUPDqGqnfLnGObzS6SSladv9jwn3H8RNBw88n8L4cnFpC:yfORnfLnGkSS78HBw885
TLSH
T10EE10F7895088BBF64B6776CAC6888719AB2013BB7BF68C750B554C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 617686cdb10bd103562ff4ec1d45ceeafe35d079313d528a16a4f20a0e514cc1
MD5 89e33dcbcd5bb5cb82d28b3622526afb
SHA1 3a067223f73c87f2c7f5fdc7f7c7860f91c18b73
SHA512 3420d15928c83710a970f23c2aabe8eea7526d8cfede2985f7342c7d072ba38989bbf1fb7853439ce05dfc2fa8d11b1d8d7bbceb3b9a131f3333c1df6428de11
SSDEEP 96:e6fRNXXqANAQeW9jILA0NjoB8kMJttn0YJZQB+8:tRUIOnNcB85JttnTZE+8
TLSH
T194916C02361F34B7FE6B858BDE994DE285A4310A548008EC80CF6A56736BB4B785D075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 efaedb9359357c35add9a449c35d43da401669729917b1fe299382a70fc5df02
MD5 2cb1f3da25095e0a1fd302f65b81b7b4
SHA1 cbea903679b71c4137ff0397420eca75333a1a1f
SHA512 6b11fc1880f28741c41697dbe0f450083ea10539d6ab1785038c7ec1e315329aed1a1381f523ac8d4c028d5bfc53ecb0925f4640077ac25de79d40a8a1b29620
SSDEEP 49152:LDmghu2i5lUX25aJoyFeaKvgmRBbFOYDg/Kf:3mQu2i56X2+DeaKvgm8/6
TLSH
T1682639E860D1A257F3814073A64553EB21FFD00C6037DE084BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 12.0MB
SHA256 02b9885de972e57ce7ddd0b6786f8ca929173d957430f1f03ea28b5bc4a17d0a
MD5 497536abc24a20c010a5a439773676ca
SHA1 4df1e3b743db1a18bb5497931919d89c0cb3563d
SHA512 1674cff6cc6242b93ef885493bf07c6507960c9ee97d50245bd54fcfa95d8ec44152ebe8630b080f4870b52702209128941d3d706e9e36cc600764c0f69f0de2
SSDEEP 49152:Yqb450D04TpWbMBDnOxJLMwugC9px1ZUTYGVj1tP+XAfdBZfFXjsgMLSmSwLqB/E:Ys4iDTTpWbMBokZMzjjxDZE
TLSH
T13BC6279770E4DA92EE0186B6F31F438F357BC1CC24C6849815B87A68991769BFE2F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads