097f72e565ccca18e2ea679fed5ef72f72dbbe7bf61c32d1a4493e41b03f42ec

Analysis

user interaction
yes
max time kernel
28s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader/fix 102.bat
Size 1KB
Sample260817-epc2yahd57
SHA256 097f72e565ccca18e2ea679fed5ef72f72dbbe7bf61c32d1a4493e41b03f42ec
MD5 afe6e6f4a847ae91f4ad707f454105a2
SHA1 640be818f694673dfab99c00a8af6d76eb26300b
SHA512 57d714bcc27ece2d67c2a8cdc38ca18fcbdf870b81431852fbd3eed786f48c2444b347718b557471bee3299f68e4812bf518c13859a655046020b35673515551
TLSH
T1B431ED137CE161A506B2D8C14A761103FB20419F9B45BCEBB4B382782A123D0B7FF58D
MD5 SHA1 SHA512 TLSH

Score

4^/10

execution persistence privilege_escalation

Malware Config

Signatures

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4404	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4932	cmd.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2136	ipconfig.exe
384	ipconfig.exe
1564	ipconfig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	firefox.exe
Token: SeDebugPrivilege	1740	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1740	firefox.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 988	4932	cmd.exe	88
PID 988 wrote to memory of 3364	988	net.exe	89
PID 4932 wrote to memory of 2136	4932	cmd.exe	90
PID 4932 wrote to memory of 384	4932	cmd.exe	91
PID 4932 wrote to memory of 1564	4932	cmd.exe	92
PID 4932 wrote to memory of 4184	4932	cmd.exe	93
PID 4932 wrote to memory of 3488	4932	cmd.exe	94
PID 4932 wrote to memory of 4100	4932	cmd.exe	95
PID 4932 wrote to memory of 4444	4932	cmd.exe	96
PID 4932 wrote to memory of 4988	4932	cmd.exe	97
PID 4932 wrote to memory of 4404	4932	cmd.exe	98
PID 3800 wrote to memory of 1740	3800	firefox.exe	102
PID 3800 wrote to memory of 1740	3800	firefox.exe	102
PID 1740 wrote to memory of 4580	1740	firefox.exe	103
PID 1740 wrote to memory of 4580	1740	firefox.exe	103
PID 1740 wrote to memory of 4580	1740	firefox.exe	103
PID 1740 wrote to memory of 4676	1740	firefox.exe	104
PID 1740 wrote to memory of 4676	1740	firefox.exe	104
PID 1740 wrote to memory of 4676	1740	firefox.exe	104
PID 1740 wrote to memory of 4676	1740	firefox.exe	104
PID 1740 wrote to memory of 2572	1740	firefox.exe	105
PID 1740 wrote to memory of 2572	1740	firefox.exe	105
PID 1740 wrote to memory of 2572	1740	firefox.exe	105
PID 1740 wrote to memory of 2572	1740	firefox.exe	105
PID 1740 wrote to memory of 3076	1740	firefox.exe	106
PID 1740 wrote to memory of 3076	1740	firefox.exe	106
PID 1740 wrote to memory of 3076	1740	firefox.exe	106
PID 1740 wrote to memory of 3528	1740	firefox.exe	107
PID 1740 wrote to memory of 3528	1740	firefox.exe	107
PID 1740 wrote to memory of 3528	1740	firefox.exe	107
PID 1740 wrote to memory of 3528	1740	firefox.exe	107
PID 1740 wrote to memory of 5428	1740	firefox.exe	111
PID 1740 wrote to memory of 5428	1740	firefox.exe	111
PID 1740 wrote to memory of 5428	1740	firefox.exe	111
PID 1740 wrote to memory of 5428	1740	firefox.exe	111
PID 1740 wrote to memory of 5656	1740	firefox.exe	112
PID 1740 wrote to memory of 5656	1740	firefox.exe	112
PID 1740 wrote to memory of 5656	1740	firefox.exe	112
PID 1740 wrote to memory of 5656	1740	firefox.exe	112
PID 1740 wrote to memory of 5680	1740	firefox.exe	113
PID 1740 wrote to memory of 5680	1740	firefox.exe	113
PID 1740 wrote to memory of 5680	1740	firefox.exe	113
PID 1740 wrote to memory of 5680	1740	firefox.exe	113
PID 1740 wrote to memory of 5688	1740	firefox.exe	114
PID 1740 wrote to memory of 5688	1740	firefox.exe	114
PID 1740 wrote to memory of 5688	1740	firefox.exe	114
PID 1740 wrote to memory of 5688	1740	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Loader\fix 102.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\system32\net.exe
  NET SESSION
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 SESSION
    3⤵
    PID:3364
- C:\Windows\system32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:2136
- C:\Windows\system32\ipconfig.exe
  ipconfig /renew
  2⤵
  - Gathers network information
  PID:384
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1564
- C:\Windows\system32\netsh.exe
  netsh int ip reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4184
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3488
- C:\Windows\system32\netsh.exe
  netsh dnsclient reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4100
- C:\Windows\system32\netsh.exe
  netsh int tcp set global autotuninglevel=normal
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4444
- C:\Windows\system32\netsh.exe
  netsh int tcp set global heuristics=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4988
- C:\Windows\system32\sc.exe
  sc config vgc start= auto
  2⤵
  - Launches sc.exe
  PID:4404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {6cad46be-f040-4891-b16d-6652ad4681a8} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {ece19f80-83b2-4e05-a121-b8c86a3b4ffb} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704 -prefsLen 27276 -prefMapHandle 3708 -prefMapSize 270279 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3720 -initialChannelId {b5ad972b-db29-48d9-aac3-a4519084548b} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27276 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3704 -initialChannelId {01e648c2-d1c2-436e-ae08-3fec6d5b86a2} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4328 -prefsLen 34775 -prefMapHandle 4332 -prefMapSize 270279 -jsInitHandle 4336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4344 -initialChannelId {6f6c637e-f504-4463-9280-4a0a8b62b835} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4776 -prefsLen 35012 -prefMapHandle 4780 -prefMapSize 270279 -ipcHandle 4784 -initialChannelId {41cde031-702e-453a-9424-00066b2e4780} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4980 -prefsLen 32952 -prefMapHandle 4944 -prefMapSize 270279 -jsInitHandle 4780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4792 -initialChannelId {b22221ca-9743-47ea-9c1c-9a2fd4382d24} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5028 -prefsLen 32952 -prefMapHandle 5032 -prefMapSize 270279 -jsInitHandle 5036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5040 -initialChannelId {0f8d1e17-dcf7-48aa-9c0c-78fc8bb45107} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32952 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {a33db5cb-0743-4839-930b-fa8610a5f90e} -parentPid 1740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 31e731c975c27071550fe6f85ea5485176856ea78275389017affe03d33188f4
MD5 1f942e8de16b3e8089ae668e936843a0
SHA1 e317840c971cb462592a215fc3b86827204f99c5
SHA512 430a83576a4e9a2a138b1ca7a5ca08ada222deeb3d4b046b10eb733a6bb25224d2480092b52d06a33a79354ebc441eb09e4ee57cbc504c7842cbbb0e77722b8b
SSDEEP 3072:j3lUTsrX/m5Vcj5OwaTrC1Bvr53Ebo8dX+ob2CdGV5:pU6/m/cLJHvr50bo8dtb2Cc
TLSH
T146B3AFF6DBA6C93D64FFD42D6BC2883EFD262404B3A33009C953675461C6BB87679248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0bdc713a064887c8705e9cd519c3108d3004380e4b8a4a3c96db4f474bb8e001
MD5 27892d5b9fe645a61c4e96938642a9f3
SHA1 34692c51fe46cd158f005302e4356b6cce1d7960
SHA512 e8a333c996b4490cc0c7a6c91c4dd76c21abb340c8bb259cd7cb9e791a80126c32525013d8c1d464dfd99557e83a68b3fb4bbc274c5475f7b189848328a209c8
SSDEEP 192:V1d66JozGzgCl6mc0dFQcOv5zbowbxLpyjO1O+:Td66JozGzgC1j6bowbNpyjc
TLSH
T191D11E64EA28463FC448123BCCA51B424F35355BAC4E3F2935AD750D2C8B69E778D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2bbb5673ea5fd1ee118aae665dbc3463ce76c63583786d7f1b260e820d9c26fd
MD5 e8d1004e6f03a6ebb71a88c91c5743a9
SHA1 c849c5c3d8c8a589580135868bfb24c09b60a199
SHA512 1c40a7fcd9e9d9fb5c19389ccc74314c496ba60afaec5c51e80c2cc1558e58c539eb879e2970e41e8a4868b1e2cd64cf17d05862c1c448143c47ca308380e32e
SSDEEP 192:nQcOv5zboPKzZxLpyjO1OZ1d66JozGzgCl6mc0dz:mboyzZNpyjVd66JozGzgC1jd
TLSH
T1CAE120A4EA28463FC408027BDCA61B414F39395A9C4E3F2935AD741D2C876DE778E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 527070cd8457570ada477aca9ae8086c3042389445bba22ca716745772cec83d
MD5 34349e4e3b7c18c24e90a54b71a96ef4
SHA1 330f548cc16903920c35dc7b177f7780b0d6b94e
SHA512 0148871eb43cf3a8c156f2e713268df9c743cce31d9fe7967349b5efb863fb8d3d6191a7c58cee6dba10cd322eb95c2fa3c54e0415b04eac41110ed4d1b26c50
TLSH
T10521AC5C39F84D3A6887F29C79811BCF53514E0A08871E438E02EF8CDEA1AD9326A47C
MD5 SHA1 SHA512 TLSH

Submit Download

1f50d6f3-f6c9-47af-9b94-91dff53d0907

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\1f50d6f3-f6c9-47af-9b94-91dff53d0907
Size 235B
SHA256 40f85445f3815bb751ec2c8e7c70b440defa79f88040cbab6f794c5329e86302
MD5 f5c0da7ff6367427f2985edb511dae34
SHA1 2567094f35ce6ad45fd05d4ef250dc0afbd23db0
SHA512 52ef79c80fbcfa4a5c80aeca622868ac1f3c63eb14d1ce9d6a03c8403b7de38603477b062dddcbbd7d49593ad82c8cfafcdc5ae50ac2eb96ac847481c8726d0a
TLSH
T1E5D0978094AC632C48180F13F2E028C630648C3328786850EA9045B499BD9C40251C0B
MD5 SHA1 SHA512 TLSH

Submit Download

617c11c4-141d-4051-afbd-c978f17f4f87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\617c11c4-141d-4051-afbd-c978f17f4f87
Size 235B
SHA256 5efa698b4443fa7a2ca822077f8f458c01e765d3f8907f982a9dcfa4e2f206cf
MD5 2a91e3eba7cb71cbf732a7fcdaa274f4
SHA1 0830ecdfb6e23811c6f4b495a72dea8c297f1bdd
SHA512 0f212a8b3eb2883cffa2391b1c7381f958dff1524a03a872feeceaa77d8056bf6ffb16c654923bed922713f79fbd155fe958cd69c7cbfa11d67409ea39e823e8
TLSH
T194D0A7D578986B6D08141F07F4A06DC671488C37146468609A9145B89DBEAC98261917
MD5 SHA1 SHA512 TLSH

Submit Download

d4031034-804b-4206-8bb5-df81240339a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\d4031034-804b-4206-8bb5-df81240339a6
Size 883B
SHA256 4ec8c45913b4ae782b657386af7f5327c3d45ed6a8639fb03dfbd30c59ec159e
MD5 ea46f803ccbbc19f991121b83659a123
SHA1 457e84267f88ebb0961827ced3b76609a9acc6b7
SHA512 2a40b18a63c9e128d4fd9f5434f69593662fd9c98d36dd950689b6e894b4eda5c725a8edfc50b9ad7c147e1d397aac99bf804a413538788c6a1f6fd8d8eecc84
TLSH
T16A11C0419A39B5B6CC68D34F85653747CFB4762380C954243DB6AE180DAED1E93AA30F
MD5 SHA1 SHA512 TLSH

Submit Download

d77ad773-3047-4286-b48e-053129210744

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\d77ad773-3047-4286-b48e-053129210744
Size 886B
SHA256 04060883da83b7bae3f20637289277146b4a737902c230ace6701b6a1db7adfe
MD5 420777312463883782613a756167f7c6
SHA1 01b5bf0a8e0c21e43f1c01d6112b892b7b43af4f
SHA512 7d4de7d011bfae4db33ae7b7d1ed1d8ab5e082781f41c8e4c01c0ab9e832442776142a120f27360442274fd5ab07efcf1f144295eecca6913086760ca0129e6a
TLSH
T18A1104815D3464B18C68D25F949177438BF47523C0C619343DA1BB1C4DEB91E536A20B
MD5 SHA1 SHA512 TLSH

Submit Download

de43e028-49c7-435a-b428-51fb0ebf2d94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\de43e028-49c7-435a-b428-51fb0ebf2d94
Size 16KB
SHA256 1b4fe0934e6755499ba137207e93a376e22a987fa3f6c9ecafa917dfcdb79a1d
MD5 9fb5cb2d4d5af9efc19b790f680277cc
SHA1 e8f5fe8ff018ad0b229999d9102b8fdf747392eb
SHA512 ee32a585aa70742d7cbe60d9b1fef535ca7e02f188f2f5ab35cfadf36ac2555b5cb99e3ee487d361e94209f728dcb664c5d7fab65793ada8991d05a62fddc1ba
SSDEEP 192:WhuMjafZuzg8bRDaSk9uLZxhW4BP8e1VIYsv/qKUICg06Zz2NGGYudcy/J8/1e2c:AuRUU8bRDaSxLZTW4OvvyNYKuS+B8
TLSH
T16172E906283045BA8651E7A8D4F8BFC3E5F528CF4C019FCA9BE4BD086DDE06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4fc9e29-a6c6-432f-a71a-d1017dc5e1ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\e4fc9e29-a6c6-432f-a71a-d1017dc5e1ee
Size 2KB
SHA256 4ae18104d5b706df7e6183ee73f934e701125bf3c8177e92c8ac3c6ba783a7a4
MD5 8b761e55d271ded43262336fc868a798
SHA1 b4cb806034d22d3c1b61eb9e991e0657e4e2312e
SHA512 21c18ee503be478cf65ca616665ada83277c2bffb3a3be614c08b6edde9d28f6909f9752e510b093880aa95fdf051c8b6ab0e30ddbb55fcc8a862793c9f94f80
TLSH
T19E41455C36784C7A4DEAE19CD052334E57A48A0710C31C532E62FF4C8CDBA9D336A47A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 6fb3afa87feb3c72fa6b47bde2fd4627fddfb143c3f742222eaef8f6c4676cab
MD5 ffbada8f8ddc6c740898a9d28451f7df
SHA1 3dbe4bfc6ab56cd9bcf182cf3bd35aa0da309eb6
SHA512 cd0e7a481b228ae682276fd495af1f3c759300825e9fe2fcbe343bb4a8cf3b35cd32bc9ccb9f8ed3c397dc435de63000744d5f5046b6f2855c6f2e0ceb29d436
SSDEEP 96:xHi+UTUHqGqgaf0Y6x1zSdSSlmdv9jFnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0bxgSSl5lfWTBw88qV
TLSH
T1E4E12E7894088F7F74B676ACAC688C316AB2013BBBBF68D750B55485015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 79c6e9f742f9a89665dcdcebdb37a47547d91cdf836fb38b410b4e9488eeb267
MD5 bf3088433ddd5e1f9699c95d66e4cab2
SHA1 2c057868196e403baa96a1bf88e0ef8c81b5844e
SHA512 09415f3a99e35e6e4b49d717757ccd04f820484ba441e270e4b2b3d16f1ae3666db56bd65ac30ca3557aa1f5ee0dbc7c28733c2c396747348fc1207381764cc9
SSDEEP 96:xHi+UTUHqGqgaf0io1zSOSSlmdv9j3nuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0iovSSH5lfWTBw88qV
TLSH
T117E13F7894088B7F74B677ACAC688C71AAB2013B77BF68D750B55484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads