hxxps://papi[.]gameinstaller[.]ru/api/v2/download?channel=GiPartner&flow=landing&pid=6&fid=93&srcd=gameinstaller[.]ru&url=&game=GameInstaller

Analysis

user interaction
yes
max time kernel
33s
max time network
37s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/08/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://papi.gameinstaller.ru/api/v2/download?channel=GiPartner&flow=landing&pid=6&fid=93&srcd=gameinstaller.ru&url=&game=GameInstaller
Sample260817-rd2blssapd

Score

8^/10

defense_evasion persistence upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	2624	firefox.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	GameInstallerSetup-a2755237.exe

Executes dropped EXE 2 IoCs

pid	Process
1176	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	GameInstallerSetup-a2755237.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000028568-325.dat	upx
behavioral1/memory/1176-366-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp	upx
behavioral1/memory/1176-368-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp	upx
behavioral1/memory/3964-369-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp	upx
behavioral1/memory/3964-386-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp	upx
behavioral1/memory/3964-387-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp	upx
behavioral1/memory/3964-388-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\GameInstallerSetup-a2755237.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\GameInstallerSetup-a2755237.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1176	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3964	GameInstallerSetup-a2755237.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeDebugPrivilege	2624	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
1176	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe
3964	GameInstallerSetup-a2755237.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2624	4128	firefox.exe	83
PID 4128 wrote to memory of 2624	4128	firefox.exe	83
PID 2624 wrote to memory of 580	2624	firefox.exe	84
PID 2624 wrote to memory of 580	2624	firefox.exe	84
PID 2624 wrote to memory of 580	2624	firefox.exe	84
PID 2624 wrote to memory of 3600	2624	firefox.exe	85
PID 2624 wrote to memory of 3600	2624	firefox.exe	85
PID 2624 wrote to memory of 3600	2624	firefox.exe	85
PID 2624 wrote to memory of 3600	2624	firefox.exe	85
PID 2624 wrote to memory of 1916	2624	firefox.exe	87
PID 2624 wrote to memory of 1916	2624	firefox.exe	87
PID 2624 wrote to memory of 1916	2624	firefox.exe	87
PID 2624 wrote to memory of 1916	2624	firefox.exe	87
PID 2624 wrote to memory of 4560	2624	firefox.exe	88
PID 2624 wrote to memory of 4560	2624	firefox.exe	88
PID 2624 wrote to memory of 4560	2624	firefox.exe	88
PID 2624 wrote to memory of 2096	2624	firefox.exe	89
PID 2624 wrote to memory of 2096	2624	firefox.exe	89
PID 2624 wrote to memory of 2096	2624	firefox.exe	89
PID 2624 wrote to memory of 2096	2624	firefox.exe	89
PID 2624 wrote to memory of 2604	2624	firefox.exe	90
PID 2624 wrote to memory of 2604	2624	firefox.exe	90
PID 2624 wrote to memory of 2604	2624	firefox.exe	90
PID 2624 wrote to memory of 2604	2624	firefox.exe	90
PID 2624 wrote to memory of 2348	2624	firefox.exe	91
PID 2624 wrote to memory of 2348	2624	firefox.exe	91
PID 2624 wrote to memory of 2348	2624	firefox.exe	91
PID 2624 wrote to memory of 2348	2624	firefox.exe	91
PID 2624 wrote to memory of 1384	2624	firefox.exe	92
PID 2624 wrote to memory of 1384	2624	firefox.exe	92
PID 2624 wrote to memory of 1384	2624	firefox.exe	92
PID 2624 wrote to memory of 1384	2624	firefox.exe	92
PID 2624 wrote to memory of 3764	2624	firefox.exe	93
PID 2624 wrote to memory of 3764	2624	firefox.exe	93
PID 2624 wrote to memory of 3764	2624	firefox.exe	93
PID 2624 wrote to memory of 3764	2624	firefox.exe	93
PID 2624 wrote to memory of 1176	2624	firefox.exe	98
PID 1176 wrote to memory of 3964	1176	GameInstallerSetup-a2755237.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://papi.gameinstaller.ru/api/v2/download?channel=GiPartner&flow=landing&pid=6&fid=93&srcd=gameinstaller.ru&url=&game=GameInstaller"
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://papi.gameinstaller.ru/api/v2/download?channel=GiPartner&flow=landing&pid=6&fid=93&srcd=gameinstaller.ru&url=&game=GameInstaller
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27100 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {c9826847-9773-4f24-bab4-d2bc50abb626} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27136 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {64041476-8ac9-45b5-a027-31f476003209} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 25164 -prefMapHandle 3876 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {50f54f7a-42c0-41fe-ad9a-7a81efe8c8c9} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27277 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {09daeba0-17c1-4413-834f-88368beae6b8} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2888 -prefsLen 34776 -prefMapHandle 2956 -prefMapSize 270279 -jsInitHandle 2932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2936 -initialChannelId {d577a72a-5fa6-4b15-a9f6-21662d542d71} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5060 -prefsLen 35013 -prefMapHandle 5064 -prefMapSize 270279 -ipcHandle 3196 -initialChannelId {51e07117-c8df-4451-b4db-f027aea62571} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5232 -prefsLen 32952 -prefMapHandle 5236 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {1a149c87-a8d4-4b8d-b078-90c1dc468489} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32952 -prefMapHandle 5356 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {72dee8f1-ee9f-47d3-83a2-1ee5a6872f61} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {019bdf03-a0fb-43c6-869e-c58d16dfe79f} -parentPid 2624 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2624" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3764
- - C:\Users\Admin\Downloads\GameInstallerSetup-a2755237.exe
    "C:\Users\Admin\Downloads\GameInstallerSetup-a2755237.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Users\Admin\Downloads\GameInstallerSetup-a2755237.exe
      "C:\Users\Admin\Downloads\GameInstallerSetup-a2755237.exe" -install posX=910 posY=138 C:\Users\Admin\Downloads\GameInstallerSetup-a2755237.exe
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\33iyexir.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 02582d814c549612653f0d858789a9f940d2aecb9b248d98c237eab9bd21bcbd
MD5 989c299c68fbd267cdd16c692a19cd98
SHA1 ec50088ffb7683104ae0c7c0b7f76ae34976a4da
SHA512 0fb97be2226d84ba821d2f61c0fbe3379569e5b4aa0e7bb1304e38c831d49bac5e79ab08f064c824b5a242e67141cad099008aed85938a29c9724fa233f4ee2f
SSDEEP 384:HXkRyiO024YQDL84KKDL849B7SOEAd9KVRaAcP+AWRMAJ:3mZYQDL8lKDL8CB7S/AmVAf+hRMk
TLSH
T18E728E7D4F003CAC15A7C0ECC5B992A94D18BBA7CEEAC0AD21583D0DC698969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 91edaa92c3188d69578feeba5cca2bf00363892dc657b644aeac5913f0acad29
MD5 33913c86e89f5c83561d105889981e62
SHA1 0249133ad81d8c4c948184a61598e52e6fe342be
SHA512 6275acdf4667e8c1e9764f6bea562d65a02178c461147f722971865da44adfc866f586875b33b6b3f72ae9ef260bcecca97d71ca02c174fe0ee22330519a0074
SSDEEP 96:VF02FPF/FgFK/dd66Joz1zgClKtmc0d/U7SdF95/7bkW6BrcErOhyUR6qx2WI:51d66Joz1zgCl6mc0dOOv5zboBbrOhyH
TLSH
T13DC1CA68F739463BC849027BCCA60F401E76798B988E7F1931AC24082D562DE778D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b0ed9e79448d41c00cdacc9715a476d5ce90ee8a34f3a488ca31802c2e7d636e
MD5 34e536f73c7d97471c44178c9697a61d
SHA1 25a19219abd13e275d0d35bc48ae3a53c45e36bd
SHA512 2bdb895b957423c40e44476e10347b14fcd8a2d2cda073f7f7dd7185ae1fe87d0c2f5ab0ffea1d3582fa3cc003a8ff3d3d6652f0fb339b79cc0ac77c6b76b8db
SSDEEP 192:SOv5zbohZrOhyjwOz1d66Joz1zgCl6mc0dz:RbohZrYyjld66Joz1zgC1jd
TLSH
T143E1FF68FA29863BC40502BBCCA60F414F35798B988E7F19359D654C2D472DE378E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2d81fcdc2806de8e3264868f67ff59c6a1152522581bfeb1064c39a235add82e
MD5 0a39e420c182674f001171120459d449
SHA1 e2c814492f23aefbb334a62201b74e68e75909f8
SHA512 7619322d43e5b70e3145e0b8419f5996d682d0e0a97df1a45d199acf94a42b78c198bf3dd42faa2a233347032dde35e4c5e1ec4f0f5a7bc0114246c319fbca20
TLSH
T1DD217F9C39B84D3AA8CBEAACB441078E53554E0608571C438E43EF8CCED5AD9312E47D
MD5 SHA1 SHA512 TLSH

Submit Download

03376391-0e7e-4e91-b39d-e06a66342193

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\03376391-0e7e-4e91-b39d-e06a66342193
Size 883B
SHA256 69ab4bd1d97165626e9d716d7967765adba4780039cae7055ca7a5fac9f6400c
MD5 962bf2e4c97d02128ef27958c8a0d15b
SHA1 f60e1acd5721f8033cfd0c1222abcbb3900ad495
SHA512 43a2ea5a970d6055a0f85b8281750144c83925c364591f790792333359e00f499344c9a07711fef17e48eded43108dc49d5ae47f79d51fabe88c24bd84fc55ec
TLSH
T15711E341B63479B2CC78D29B896637029BF8F51380CA55143DB16B080D7EA5E93AA70B
MD5 SHA1 SHA512 TLSH

Submit Download

285b1cb7-503c-402f-abad-350e1e22e374

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\285b1cb7-503c-402f-abad-350e1e22e374
Size 16KB
SHA256 3469d971e780ecab0be3175c24f159ca5e294ab25fb0187b3d897b2922982961
MD5 57c64c3667288b09f16f548c7fe1c04a
SHA1 0d77a67d96ab0dc9c07598e33adda0dbbb7610ea
SHA512 2f34fdc876178568e46078bd41f31fbec83133d5375b26244466669ed3e96901589d246c9b5e06fd5633125e0c7cfb14e2b07c689bfb9cd1cbc8fa4e02064c1c
SSDEEP 192:kW43KoYBM7XMjv78k+aGO9YG4xiRloOF3iP2JzLSbBIYm7eXtDiWVVWI1FBp7TgL:4ahBM7Qv7Ewe4KsabQ6B0RlbuQN
TLSH
T1D972C8166870457A8391E3A994FC7FC3E5F528CF4C019FCA9BE4BD086DDA0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a173363-1c4e-4576-a191-da89b75e5563

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\6a173363-1c4e-4576-a191-da89b75e5563
Size 2KB
SHA256 989d63050437b1de02bda9d89065f02f2609bd9f508d9b13a47a4ba480145d76
MD5 2f688e20185683c2ba55bd3f02f95f18
SHA1 3075def54881c1762b36e0e3d9cae24977950236
SHA512 f5b758ffe4947c778a7f22acb85e5b179f00e1cd4831fba91dfc11482542b56d14aa0131c7c1c0c1d7a7efce087d20e9e1de93bb6aed3dcf6a31c65c2e43ab3b
TLSH
T17C41115D36784CB69CD7E1DCD852234E57A48A4300C62C432E62EF0C8C9669D63AA57F
MD5 SHA1 SHA512 TLSH

Submit Download

d6f0974b-2f4c-4bdc-bb28-37f46bae8e9f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\d6f0974b-2f4c-4bdc-bb28-37f46bae8e9f
Size 235B
SHA256 0dba01777f8a549397944349e71b8cbec278c2f5b10b76e1b3dc3e97a4c9a31a
MD5 2e835b0e059eeafcaeba3330c24dee4a
SHA1 f76b618ba727d22638661e00dbf126cdcfca959e
SHA512 cdcc4d4a8f9056c52ef13d088ae1ffaff684c2aff388bf7b51edc28fe5d3a777b9e09dcd1c4e83576c245adc5f857c1a90aa685977c455de15fff1ddc6d222db
TLSH
T17ED0978018A9377C08010F06F4E03ACA70988C3310B59820D6A000748ABAAC4426181A
MD5 SHA1 SHA512 TLSH

Submit Download

d81990f2-9ef2-445c-af97-fd36e094051c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\d81990f2-9ef2-445c-af97-fd36e094051c
Size 886B
SHA256 6ebdc0ff9607bc5b836f125e288b119b3188dd8804777334750aa8270eda622a
MD5 ddddd4f183a00d035ffd7213752e708a
SHA1 c2ea7d3823749cb0208d63e15d491a3306c60561
SHA512 8b1152731773e62f1ad99bb108e09c7c2f8174e9480448b645f5fd8d86dcf6350cbd138f2f430cda6d7c267061a3c005382400b461199bb7366ecaaa44687ddb
TLSH
T1E91123808B7579B28C79D2CB84B437438EF4B51380C64C047DA26B180DBA51E93A7707
MD5 SHA1 SHA512 TLSH

Submit Download

eaaffad1-8a47-440d-a28d-221c05abef7e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\datareporting\glean\pending_pings\eaaffad1-8a47-440d-a28d-221c05abef7e
Size 235B
SHA256 3034b6184762fa8365063bd889ba0331a08aba5091d8d814f7e3ff2aec874f48
MD5 9a8a3a04995de00d93d9dfa6f1c0edba
SHA1 4826fcabd5a4f40a1b5ef278a8dc84808f3b891e
SHA512 d10e091b3defe699329fa15975da1f8617a5956aa9ab7714428d10ca0d34b026359a6f18ea8b15162eeb718f04e0490815443bc01cb3b404bc432239af56da42
TLSH
T1A4D0239454A8675D08150F0BF0F1EDD670CE4C3718BCB820DD6646B49DFEEC54252D5B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\extensions.json
Size 16KB
SHA256 0ae1183d4726ffe0111803ec91affc56965b1c4530525aacb70146c226e21e5d
MD5 c01c425d644575cde6c6ebe9689bec19
SHA1 a84b269907610265feacd6ed0a2076ec303032f8
SHA512 22e9db6cc1b11ad6d33b61d6b352ea3c906e395c36b1544cf017ae0af000eacdeb89de1953531a2c8ec9dc39b437ee11abf9076e547d6e025cd064dbae43fef6
SSDEEP 384:VkI4vIUmldvT8dhWh94zX96ouL4HeL4PEL4HvL4HcL4H6o4hEU:GI4gRfwXk4x634E424T4W4b4V
TLSH
T13372411545048EB8298FA79BAA367E01C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 7.7MB
SHA256 7f1db5a44a5bdc2e3079d42f1e833399643048cdf06f0ac242ce5dd6b842c95f
MD5 7bbe5026756b0d092ff82f06c56a1d0f
SHA1 b432e7bb2ae92eb37b7808ccf9fa32625a137ca7
SHA512 82210f3676c3c1a230f83915e6a918d3d0c9618d9adeff6b4a3ea3608d82947453350d3a55cecd57f8395e2e90bf72ea1c29669846dc1c91872e431a7a724be3
SSDEEP 98304:jXYpvNa5R+WAjfAm11aGMFRGg9LEGLYmghF5Q/i4Wvq/iD:bYpvNaejfHuGMFIg9L4mghF5QD/A
TLSH
T1EA867D89E36350E8D85ECDF0466EAA72D438384E0335AAEF17D48B315A727C42679F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs-1.js
Size 7KB
SHA256 f0162e2ab11324ecc30d8bc44b1938b0c1a46bfd6b1252f08464f0752dcfc21c
MD5 5d121bc669eb6bd59da1a5540ffdde66
SHA1 72f82af6d40ba9adc597d8081fee3b90a49a1ffd
SHA512 35a81bcf43d56282cae137e9d60936afe2d7d1433965e7a22fd4f36a891614c62f1aed06dcc2eb2f96f391b6854e601253ddd190094dc4d491989ebab686c712
SSDEEP 96:xHThpTUbPqGqyfj6EzCObzSKSSlNdv9j8nZRHboedPBw88qb8L4cnVWE:zCCRyfj6EzCESSS9bTJBw88qC
TLSH
T100F1ED785404CFBF74B676ACAC2889315AB2023BB6BF68D750B95885450CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 6KB
SHA256 75a6c87c6447579029884c31512e1cd227a3045d895acdee749b76b03af40d66
MD5 4ba106caffb0400868fa22959b710ffc
SHA1 7a69c8c6bd22ae81173ed79245f5afdfdbb5da3a
SHA512 7edda1d0a0c2b84a99d86983fb06d898ed70e8f2eedc708282d9f03af1c5aa81eaa7d4afc9703ccf056ea44ce0cbffd36afdac195f9c595c6bd5567d9672b381
SSDEEP 96:xHThUTUbPqGqyf1B6EzC1zSKSSlNdv9j8nZRHboedaBw88P8L4cnVWE:zLCRyf/6EzCbSSS9bT4Bw88m
TLSH
T17BE11F789408CB7F74B676ACAC688D716AB2413B77BF28D750B95484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\prefs.js
Size 6KB
SHA256 ac65b5f087d753c5947c18176e4c1ccb090327335460aec00260b538f939b28d
MD5 42e31305428374d638e66aa70677096f
SHA1 7b88f8b634fac01274c21aa28996d85801a88be7
SHA512 13950c03be69ff6fb541fd8c3f85e5e312420bdfbfb222003a2b56ad34747d5745a9297e41e7e52f4cbcb2c8ea5c169b2a1d34c6cdaed85e5ef7e8e4c9ad6e61
SSDEEP 96:xHThUTUQqGqyf1B3J1zS4SSlNdv9jBnZRHboedaBw88P8L4cnVWE:zrRyf/3JJSSL9bT4Bw88m
TLSH
T18EE120789408CB7F74B676ACAC648D315AB2413B77BF28D750BA5484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 416b2c7424d7df24b7ca1f2e83610e0248055bc952aaf74972c44cb130edaf88
MD5 190ab6cc47cee4c0ddf906141582f1ab
SHA1 8760060acc13c55f31574af250dc39914be4fd92
SHA512 36dc71d7451d1cf2cfbb8ad4bb409334a169ee11ee0c30406135dd01fdc1d7c462f9cfee8dc4bcadbe4822e011a6adb0f6d259c821f48a128e8c7b5136ab333e
TLSH
T1F521BBC795DB55F27BA2B163D08A8BF9C155303084AD14E0D69DDF05114B485B78730A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\33iyexir.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 53731733e308c7adbc8a41a3d646c2d65c661c776e0931edf20d7f075c39fd7b
MD5 5e25fd798429c4d9d01da459ee682306
SHA1 98b5de157dcafbfbd4259f37a66d4f542732e16b
SHA512 f1e0739a7ad0329a1368f8f4c4759f243f6ad99910153ce535f30f7eea3ca3151d8012e02ad814ab230e3be236c6fe45d00ae906c2aa5c585c851a51cb1b89e8
SSDEEP 49152:oVDPx4URVScAJfWn0Eq1NzT+ghHReb9QYkP+:sD54UjScAJfWC1NzT+ghHn+
TLSH
T1601639F824D1A257F3814033668563EF21AFD00C6467DD484BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInstallerSetup-a2755237.vz-v_vgn.exe.part

Path C:\Users\Admin\Downloads\GameInstallerSetup-a2755237.vz-v_vgn.exe.part
Size 8.6MB
SHA256 cb870e6c4e91ceadf8401d96b460c4662d4a9a473ca46ba4eafea37d26d74755
MD5 769019089277d03abd1a44218962eb8a
SHA1 ef4757a26909677fd08370cbb49f3fe749ef47fb
SHA512 d287bae238999e7b65b5d07e006c20a91c3819e2f8d3302dccd3159ee80e4707c1aafab55cbf436d2459e4bc07a233b5794c98addc9215f82daf500956662c7d
SSDEEP 196608:TNfKa7tfOb1JCF1TesQ2EsL4fAJS3l4DSnBMLXKIXXdJv3ZA:7fnPTeHjsMfAJS3E5tJv3a
TLSH
T13D9633CF411611A2E645C2F4658134EF9B0EAC31A691556AFFF7F0C12AF23F16B812A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-368-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp

Download

memory/1176-366-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp

Download

memory/3964-388-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp

Download

memory/3964-387-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp

Download

memory/3964-386-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp

Download

memory/3964-369-0x00007FF6E6F30000-0x00007FF6E84B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads