be5ece4e7ca85595ccbfa061aff9193673264ddf1b95632e3f1eb83c25c0a4cb

Analysis

user interaction
yes
max time kernel
139s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
code.txt
Size 813B
Sample260815-vyb41aem2x
SHA256 be5ece4e7ca85595ccbfa061aff9193673264ddf1b95632e3f1eb83c25c0a4cb
MD5 c2779c9ed9e4f7e6dfffe0fd080f4d8b
SHA1 94c11fc13f128d84aad53ef57763dd633d3cf63e
SHA512 5c9e392612571b056a4d03afdce2f1b9ed615a3320f9c05408b6e722dffe33e70b97db8f8b44595d89663ee6458dffe5ed5753e1b4d4ef608c59e13606ea11d6
TLSH
T1010147ED933F636A7601E70B1830F40EB6978540BA02DAF231AEC7C57B408D22807D6C
MD5 SHA1 SHA512 TLSH

Score

1^/10

persistence ransomware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5144	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	firefox.exe
Token: SeDebugPrivilege	1860	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1860	firefox.exe
1860	firefox.exe
1860	firefox.exe
1860	firefox.exe
1860	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1860	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1860	1068	firefox.exe	91
PID 1068 wrote to memory of 1860	1068	firefox.exe	91
PID 1860 wrote to memory of 2156	1860	firefox.exe	92
PID 1860 wrote to memory of 2156	1860	firefox.exe	92
PID 1860 wrote to memory of 2156	1860	firefox.exe	92
PID 1860 wrote to memory of 2232	1860	firefox.exe	93
PID 1860 wrote to memory of 2232	1860	firefox.exe	93
PID 1860 wrote to memory of 2232	1860	firefox.exe	93
PID 1860 wrote to memory of 2232	1860	firefox.exe	93
PID 1860 wrote to memory of 2792	1860	firefox.exe	94
PID 1860 wrote to memory of 2792	1860	firefox.exe	94
PID 1860 wrote to memory of 2792	1860	firefox.exe	94
PID 1860 wrote to memory of 2792	1860	firefox.exe	94
PID 1860 wrote to memory of 2888	1860	firefox.exe	95
PID 1860 wrote to memory of 2888	1860	firefox.exe	95
PID 1860 wrote to memory of 2888	1860	firefox.exe	95
PID 1860 wrote to memory of 812	1860	firefox.exe	96
PID 1860 wrote to memory of 812	1860	firefox.exe	96
PID 1860 wrote to memory of 812	1860	firefox.exe	96
PID 1860 wrote to memory of 812	1860	firefox.exe	96
PID 1860 wrote to memory of 256	1860	firefox.exe	97
PID 1860 wrote to memory of 256	1860	firefox.exe	97
PID 1860 wrote to memory of 256	1860	firefox.exe	97
PID 1860 wrote to memory of 256	1860	firefox.exe	97
PID 1860 wrote to memory of 5920	1860	firefox.exe	98
PID 1860 wrote to memory of 5920	1860	firefox.exe	98
PID 1860 wrote to memory of 5920	1860	firefox.exe	98
PID 1860 wrote to memory of 5920	1860	firefox.exe	98
PID 1860 wrote to memory of 2812	1860	firefox.exe	99
PID 1860 wrote to memory of 2812	1860	firefox.exe	99
PID 1860 wrote to memory of 2812	1860	firefox.exe	99
PID 1860 wrote to memory of 2812	1860	firefox.exe	99
PID 1860 wrote to memory of 2608	1860	firefox.exe	100
PID 1860 wrote to memory of 2608	1860	firefox.exe	100
PID 1860 wrote to memory of 2608	1860	firefox.exe	100
PID 1860 wrote to memory of 2608	1860	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\code.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {772ad41a-4ccf-4dc8-aafe-77d399f3ab1c} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {3fc05e1c-1567-4805-8148-edfb096df329} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 27323 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {c2204251-6a74-4904-8fb3-528ed57ec370} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27323 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4048 -initialChannelId {fb701ea5-8f6b-467c-b3d0-55b19da57e61} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4520 -prefsLen 34822 -prefMapHandle 4528 -prefMapSize 270279 -jsInitHandle 4532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4540 -initialChannelId {7ce3114f-1dd8-49ba-9c22-3b84166e9d58} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5108 -prefsLen 35010 -prefMapHandle 5112 -prefMapSize 270279 -ipcHandle 3228 -initialChannelId {01dab851-742e-4fa2-90f1-07fc0b60dabe} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3188 -prefsLen 32952 -prefMapHandle 3032 -prefMapSize 270279 -jsInitHandle 3192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4836 -initialChannelId {c6c9353f-afb0-4ece-b733-434f22b4a51a} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4948 -prefsLen 32952 -prefMapHandle 4952 -prefMapSize 270279 -jsInitHandle 4956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1652 -initialChannelId {b3be0b23-11ae-4e31-9d16-d3f96d6b5fdc} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {13230625-a456-4373-ad41-1beb016ed4a2} -parentPid 1860 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1860" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e5d3edcde0051d77378b1ff3ddd8ed99a6ba2c9d6bed71c7f1fffd37c21d3a9b
MD5 9db18b08933ef50b5651fcab2db14877
SHA1 69c83d5293904c397fd3333c2ff6b8c1a7bfb92e
SHA512 86e0f34df85fad270a28ff5df74fbd66cfeee0ce65011e827840e6c0923b46680a323435f90c1f300177b1a17e4936564305572a7a02e34636f3e17e25aa8c8c
SSDEEP 192:AOv5zbo7eZOQyj7MFC41d66JoztdzgCl6mc0dz:rboiZOQyjyd66Joz/zgC1jd
TLSH
T1CAE120A8EA28867FC444027BCCA51F410F36394BD84E3F19759C641D2D5A2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 ef2cea34ee285536825a66e892b71066888cacdeac0ba187f668a52db03c2340
MD5 7291074b2b756b7683f45e5a1f689e3e
SHA1 7ba87805691b8bd093492e503e5cc484c76a8bfc
SHA512 6145eb39d3216c63bd9221016660de335b44efa871421c026e860f827a5d5540515408d10643c9438b62713931bc73ecd777aa4441aeeb750b93eb385eb6d194
SSDEEP 96:JSdF95/7bkW6ArcEOQyUR6Jx2WZzFRtMP2FcKVFB/dd66JoztdzgClKtmc0d/UK:JOv5zbo8bOQyjrxBC41d66JoztdzgClp
TLSH
T117C10C69F638463FC449023BCCA51F100F72394B985E3F19719C641D2D9A2DEBA8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d5c36487403c61c5e1f13d64af8ac7911584486d551c049385c186ae4511bff9
MD5 a181b78325132a6f949a0e8d887ea7bc
SHA1 d1bbea4145e9c158d2b70b23077756d270382ea7
SHA512 0e8938a447d669b7e6fa38ffd65d53671b1aab4ad53a8493dec57c9cfb4740a4f9b4fced2abbc31f8358a3b944517df847f12bf1a63b9ac004caa411841dc3c8
TLSH
T122214FDC3EB88DAAACCBE29C7540038E53954E0704471D835E52FFCCDE91AD9326A438
MD5 SHA1 SHA512 TLSH

Submit Download

0cecf767-72a7-42a5-a70b-02cf9b9a6976

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\0cecf767-72a7-42a5-a70b-02cf9b9a6976
Size 886B
SHA256 e8069bd78dfb5382a29965c52a9ad047bed7a683f44b76742b8e4134ec0f342a
MD5 1052113dfaedf5a64724754f50473b06
SHA1 efa66efe8bdf0784b199e9ece0dc29f8459dd575
SHA512 5c53e81b734174cc130f51836e0e1e5c54b00f4b22d8c87b735b0177c2d7eb0e8db790e07983d354068dccbf9180abcda42c24c354a6023384713dfbc27bdbf2
TLSH
T1BB110082D974B9B1CC69829B88E8B74247E17523C0D618147D949F1C4EFA11AA757B07
MD5 SHA1 SHA512 TLSH

Submit Download

0f762e2b-2076-4c48-973d-c78e06a44944

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\0f762e2b-2076-4c48-973d-c78e06a44944
Size 2KB
SHA256 e3c0761993876ba3c9140eaf1e49aceace3d4ee4e973197e797eca36f7179b53
MD5 874e053423e079c7154e3c121e136a3b
SHA1 d5b5f2a52e3eed3c582fde8d1c8fdea989577c3c
SHA512 02f7ae694918d0b837ae30d61414d1f8ff1f2eaf6f66631c4be83cb08a3ef67abb28bd7cc0f7e06eaed9a61d9738d169b25cac50b4bef22922c5f124f40dcb69
TLSH
T19841335C35785C768CCAE19D9482338E97E18E0344C228832E51EF0C8ED669E736B52F
MD5 SHA1 SHA512 TLSH

Submit Download

391d20a7-4019-4684-8078-1ae4aeba22b9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\391d20a7-4019-4684-8078-1ae4aeba22b9
Size 235B
SHA256 8aef94f9f67ab1ec34d8dd0cbe1be0eec1e51131db7512bf99eda166019bcbf5
MD5 5b827412c2b6aecc981d20f9bd548bbb
SHA1 c0ed23a375b6aa5d31e95ec4409a0c1c7e8ae501
SHA512 7d390123dae8242ebfa33dc5beb8cc305a0111c7b8173fe15a68807da2eeb442fbc1528d618ddf85974fa21d8c7475703029c5aadb4627e0c5a679835736c35f
TLSH
T162D0A78468A8A75D08150F0BB0A479EB31884C3725756860E9A54675AEB9EC5416185B
MD5 SHA1 SHA512 TLSH

Submit Download

6b436e0e-e2d6-4921-a218-decb1805ced4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\6b436e0e-e2d6-4921-a218-decb1805ced4
Size 16KB
SHA256 13bf7be2c41854f912d749c94f2421c6368e69053aeae39f34d0b4170786dc8a
MD5 e39629952e48c4a16fab99927b374c7b
SHA1 e0fac4818f3737dcce48d17ebce1534c047522df
SHA512 1e6434de448a323c48bad00c45f28872c629def98f2f227d068d12ba5c101952c099e759bd3ce4e316bc76296a4eb1737a4dd79b52eaa5687e0634e506cefeeb
SSDEEP 192:xgdukuodjrlBFZu+117guJxtICwh2MmnMuzw+EFsdz51AdRctnnk7tS6NfvziM4n:2MLodjRsS7fzH1nk7tS6NnWM4Dj
TLSH
T1D572A95A6860457A8291E3A8D4FC7FC3E1F538CB4C419FCE8BE47D0869DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

820cd229-47ab-444e-9eef-0ef32f5eb88e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\820cd229-47ab-444e-9eef-0ef32f5eb88e
Size 235B
SHA256 660dd64380518b839dee967b0fa3f1289e72d4de843881f2defd6ebe7f2c4bb5
MD5 28d1ba4511f90a5b0fdbe205aef4affe
SHA1 810fc7ff5ad35b7cd553574e39f362fe62a97762
SHA512 be02a72dbaa32416edc9c8ea9210f7c81c78d8d53bb1cb42861168b897b4fd64d6d2014ca9c28adf7177461df1a9d9015720023b4d5b0e3da58c40b1f6a045de
TLSH
T1A4D097C0189CA72C08001F82B0A07DCA70988C3318F96810DD6305B689FEEC60131807
MD5 SHA1 SHA512 TLSH

Submit Download

e55fad2c-f682-4764-b1d6-509b9e1f2243

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\e55fad2c-f682-4764-b1d6-509b9e1f2243
Size 883B
SHA256 3a9d9bd06891be7c5bb4390836ec07c6f404507745c9e0eb0dbf88772ef7b09f
MD5 6ca97d230a5a5993969d26477752d298
SHA1 41dba804198df729c27249149af1b8b2009e9123
SHA512 76ef32f5d1029790ff9ad52ddc20c38dea3ce0d9ebdac15e1412fe77b8cb769f312f76be75b39054755ecb7e4b4dd108ae0253528d00a9e1a94ab6e303845b04
TLSH
T1F11123C1D534B5F2CC78824B88957B064BF4B923C0C654107DA05E280FBE61BDB67747
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 210c5663c2eb09140695e5f04abb66d424fca63825c9319b4744f68ec6b46fd3
MD5 21e255721595fbcd42f9982d7d03009a
SHA1 583a616525ff0ddf4b1ee73960acc18330f4b614
SHA512 d7602d7816a2facf1b937d0715558ed210552104f9ef30625bb69e204135707b8c10d19f617f5512186e216b648337a0b68b9f0248d1bd1b0f95d02e4d6346d7
SSDEEP 96:xHYUTUmDqGqmfOCs1zSESSlvdv9jznKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOCshSSS5Bkqa7Bw88W
TLSH
T10BE110789508CF7F74B6776CAC6888316AB2013BBBBF28D650B55484055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 2a70496fe058123154b6e9aed60e3b6920073a9140ccd1f90951af7172752dfb
MD5 547fa90934be1ea454161fb6ad9a6a38
SHA1 c4d6c825cb84daa6ccf3871e4b3ac1fddbafd41e
SHA512 ce8d87ea2bb451928c141f9c299d4c596c0396e3752549dc4325e1d0374f48986f80a0a964236204e083424c134cb69fdd9664091baa807f827ec6a0ffc0e662
SSDEEP 96:xHYUTUmDqGqmfO2K/o1zSjSSlvdv9jMnKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfO2K/o+SSh5Bkqa7Bw88W
TLSH
T1A4E13F789508CF7F74B676ACBC6888316AB2013BB7BF28C650B59484055CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 63284e456e008aec7f882ebfe92f78e88cac5a00d8ce6028e42caa0b3c0b49ce
MD5 e8d52a20af52f33aa5addbd8bb2a2999
SHA1 e9fdf375645473443af1f524187a426145e4450b
SHA512 fe158fe7926309242bfe00de12693ae7361a7cb7721af143e0c950f79a3065b58541cee37005641cbbd77776acfb83139f293c546f110084824d64033deb7406
SSDEEP 49152:H8ZvnRPV8+B/XYcl4uE316v0kRCQq7TP:cyAW31IFRCQq7TP
TLSH
T1AB362AF820D1A257F3814033664593EF21EFD00C6037DA085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads