d9e8e6bc2df1863b3d9be74f77f5fe79d30647248b0a0271c658c79cadeebb09

Analysis

user interaction
yes
max time kernel
169s
max time network
171s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/08/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LuckyPatcherInstaller.apk
Size 10.7MB
Sample260823-slhd5sswhy
SHA256 d9e8e6bc2df1863b3d9be74f77f5fe79d30647248b0a0271c658c79cadeebb09
MD5 f9a0a3501f16fbcaca78e4b8541c91c2
SHA1 18e53482d2a975e7c1165c4d6dcd54b430da010e
SHA512 26337c7ec605b83aed2002dd021e1831d1286c002b20ef61977602a6f41339b5880df5f0412344e205bb1db9132c5fdc0c0154ee940e99a4496fd3f0dd716b74
SSDEEP 196608:8eTwsB3eipjUw2Lh/rJbqkKXjdeQuJ0SIT5zkn/DX7d4SLgb91v:8eT/OMUwmhqbXjd7Umo/DX7d4SLYH
TLSH
T13EB6CFEF36DC252AC83441B3C88DB57966974D7A5F43DA822C08372C34B36F45B49AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4352	cmd.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	firefox.exe
Token: SeDebugPrivilege	5068	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe
5068	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1568	OpenWith.exe
5068	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 5068	1732	firefox.exe	98
PID 1732 wrote to memory of 5068	1732	firefox.exe	98
PID 5068 wrote to memory of 1420	5068	firefox.exe	99
PID 5068 wrote to memory of 1420	5068	firefox.exe	99
PID 5068 wrote to memory of 1420	5068	firefox.exe	99
PID 5068 wrote to memory of 2256	5068	firefox.exe	100
PID 5068 wrote to memory of 2256	5068	firefox.exe	100
PID 5068 wrote to memory of 2256	5068	firefox.exe	100
PID 5068 wrote to memory of 2256	5068	firefox.exe	100
PID 5068 wrote to memory of 4760	5068	firefox.exe	101
PID 5068 wrote to memory of 4760	5068	firefox.exe	101
PID 5068 wrote to memory of 4760	5068	firefox.exe	101
PID 5068 wrote to memory of 4760	5068	firefox.exe	101
PID 5068 wrote to memory of 1344	5068	firefox.exe	102
PID 5068 wrote to memory of 1344	5068	firefox.exe	102
PID 5068 wrote to memory of 1344	5068	firefox.exe	102
PID 5068 wrote to memory of 3632	5068	firefox.exe	103
PID 5068 wrote to memory of 3632	5068	firefox.exe	103
PID 5068 wrote to memory of 3632	5068	firefox.exe	103
PID 5068 wrote to memory of 3632	5068	firefox.exe	103
PID 5068 wrote to memory of 4372	5068	firefox.exe	104
PID 5068 wrote to memory of 4372	5068	firefox.exe	104
PID 5068 wrote to memory of 4372	5068	firefox.exe	104
PID 5068 wrote to memory of 4372	5068	firefox.exe	104
PID 5068 wrote to memory of 5476	5068	firefox.exe	105
PID 5068 wrote to memory of 5476	5068	firefox.exe	105
PID 5068 wrote to memory of 5476	5068	firefox.exe	105
PID 5068 wrote to memory of 5476	5068	firefox.exe	105
PID 5068 wrote to memory of 5636	5068	firefox.exe	106
PID 5068 wrote to memory of 5636	5068	firefox.exe	106
PID 5068 wrote to memory of 5636	5068	firefox.exe	106
PID 5068 wrote to memory of 5636	5068	firefox.exe	106
PID 5068 wrote to memory of 5652	5068	firefox.exe	107
PID 5068 wrote to memory of 5652	5068	firefox.exe	107
PID 5068 wrote to memory of 5652	5068	firefox.exe	107
PID 5068 wrote to memory of 5652	5068	firefox.exe	107
PID 5068 wrote to memory of 4140	5068	firefox.exe	111
PID 5068 wrote to memory of 4140	5068	firefox.exe	111
PID 5068 wrote to memory of 4140	5068	firefox.exe	111
PID 5068 wrote to memory of 4140	5068	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\LuckyPatcherInstaller.apk
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4352

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {95fe4e45-e45c-4be6-a5eb-cf9ee1cbd1bc} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {dde2ea54-efb1-4847-ba7b-05d903e9a961} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27277 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {65a69641-c4ba-49a4-9772-597e58bccd52} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27277 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4052 -initialChannelId {eb954f31-7555-4e35-acec-687920907c62} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2952 -prefsLen 34776 -prefMapHandle 2956 -prefMapSize 270279 -jsInitHandle 3040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4440 -initialChannelId {a43a07f9-d825-477e-8e77-4a59ee589279} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 34879 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 4892 -initialChannelId {6dd8241b-ecec-4158-adf9-0f5251aff9bf} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4800 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {91a60617-69c8-4bdc-89a4-62ec439936aa} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32952 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2828 -initialChannelId {d75720aa-6d5b-4bad-af30-678e67f0d0c6} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {2ba06b66-b6d7-4e4e-9cb9-c41f721249d8} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6088 -prefsLen 36718 -prefMapHandle 5960 -prefMapSize 270279 -jsInitHandle 6292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5364 -initialChannelId {e78f32a8-dcd3-431a-a056-0eecd8977a32} -parentPid 5068 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5068" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 762338a854e8517b6a3b9cd2eab03578179f7095e1d2ed4320730d810f250dca
MD5 0765d6057357d7b49b903bcd03255491
SHA1 f74fc23b0f2ac91701fdf2e9f70192c7a072809c
SHA512 eb46d4148e093e3702aa35f2ac1c38f119cef760c0b13ae54d4d9d61662124999b3f70db28e9d9300da789863a5ef0fd93cdae060691da99f2662991c0bde0a9
SSDEEP 384:HXkRyiO024YnDL84KKDL849B7SOEAd9KVRaAcP+AWRMAxOvOl:3mZYnDL8lKDL8CB7S/AmVAf+hRMqOvOl
TLSH
T179727D3D4F003CAC25A780ECC5F982A98D18B7A7CEE6C0AD21183D0DC698969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1d28855d0d9434c5e6b62380ef4b0eb.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\thumbnails\f1d28855d0d9434c5e6b62380ef4b0eb.png
Size 1KB
SHA256 5fa0608bb3291da5006676cc5880c90c3d591c29e0f96ffad8a35cc961522560
MD5 a4e3dec615867334fc01bb2b71796edb
SHA1 6ca3970f02d7ab704f5b82849c2f9163a9bdb9e1
SHA512 ff4192657fc611ae0938c3962a541eac877a66d372924a8df62aa8e99f6be4431c6b706df232aff96269746a448fa8a23e7d1c8a9d809d74782baa78a0af62e7
TLSH
T11F21C68EE2D329ED6A24CB77161F12C1F38971CDE493655E550C99C3CC1C87104266A7
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d22dca339476bcde3eabc1758432982c567e2a2511a87f615fc6a205d3322d63
MD5 039af28d14f04e2891a848cd96162900
SHA1 d449ea65deb549cfa3beb2fb581d4b30d2c31cdb
SHA512 fce3ddab9011784d824a28e59f4362e29fc4ac954113f3a1eedc8e0a6158bad778dc2c2975fb71294a78e75ad48d52a450460274e4c826bead7dc0630c8e470e
SSDEEP 192:IOv5zboAB2ByjbOm1d66Joz1zgCl6mc0dz:zboS2Byjjd66Joz1zgC1jd
TLSH
T120E1FEA4E638463FC408027BDDA21B400F39389A988E3F1935DC241D2D472DE7A8E27D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bf3e2c0c88b19ba439746198fc968f1cb7dfa5be5cacd621c592f31e14318109
MD5 aafce7c270510bbd3823f4d054fbdafc
SHA1 48393a842cd0a994890b9fc55b6bdff684a111c4
SHA512 30372d9e77e73d5cfe5436daec4dffbbf568a543168ed8acb16a36184d940b927254bb7477611f2c83cf1467a7051f3441cebe01868b2abb4a576899fb714cb7
SSDEEP 192:f1d66Joz1zgCl6mc0doOv5zbo4Z2ByjbO+:td66Joz1zgC1jRbo4Z2Byjz
TLSH
T105E10EA8E638463FC408027BDDA61B400F39389A988E7F1935DD350D2D572DE7A8E27D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 e641de5f25ad7419357219c16af80c36a684b050aaf59cbd6dc90d1fc0de748e
MD5 d084cb50c65a2bd4ee8072b5406b3e3a
SHA1 7d974af1242319416859dc0c9630becd6e54531d
SHA512 1e9a7e4864cd7142860c6546c03721d7085749ee182bac64490111b3e9ae457fc4fc17ad80e547c87972d60b7e46d8ecff8bbe4a6d9b15f387b108ac6f7639e9
TLSH
T19E61C958F629463FE449413AEC822B405F747456A8AF3F2A35AC604E1E5B3CD36CD03E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f181650241beeab943c3d36bb031a6c58565a54d6b1fd33e9ff7b661614cb174
MD5 8f96ac705cd4922dc7101c65b294b3e8
SHA1 69122837ae8032f32d86beda20d17659bdebf31f
SHA512 b56888f0803af7ec0fcc619765e9165a869d080ff7270c33e9e83294ca9bb786467cda689790f5234394893f799c278401152f583e5150cde616e77c1d558c98
TLSH
T1A821676C3EB84D6A69CBE29C7481218E57914E4204872C431E13FE8CEE82A99326A43C
MD5 SHA1 SHA512 TLSH

Submit Download

2140e9ee-154e-4fe1-b752-efae552ef1bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\2140e9ee-154e-4fe1-b752-efae552ef1bd
Size 2KB
SHA256 52086ffe0c9f11ff3d28b12907a2ccfbfe7e47b749851ef0db44a6d5fc9a7c8b
MD5 a2121021b100628b6861bbee55bdf493
SHA1 b4ee63d142d031d305200841de8629830c90a754
SHA512 35791ed95bdc73ed50a0e60c83e190e97328ea2b89a516f6ad65d932bb57667109f768567125f6bbde9519e5be508515476642ecf0b774054a90ce8fce6ba1c9
TLSH
T1D441545C35784DB69C9AF18DD892338E53604B0350C568436E92EE0C8DCA6DE336A56B
MD5 SHA1 SHA512 TLSH

Submit Download

6586d7bc-154f-4d85-bc3c-911a4f1632cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\6586d7bc-154f-4d85-bc3c-911a4f1632cc
Size 886B
SHA256 ece8a823bafbb2e80fb2e6dfbbf6547247d7116271d146d62ca316abf5ed09bd
MD5 ce231239cdaf35dd7a34c0bb028ed689
SHA1 53e9a23807df7efc3913e77176e02c06e2c8cc24
SHA512 e53cdb29968ccf96da8f3f310e8457a0dc8e2258eb7f292ed6ed8dd77d95b34eb192139f7a6dcfb7e0a0f82c363fd51bcc4c54b705c29988494881322c3674b0
TLSH
T1F11123C08A707AB28C6C928FE5D277834BE03123C0CA55147EE59B0D4DBB25E63A770B
MD5 SHA1 SHA512 TLSH

Submit Download

81859375-1617-4eb4-b771-4309c8933e4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\81859375-1617-4eb4-b771-4309c8933e4e
Size 235B
SHA256 6a90b1d32109967b5212098378fcc55089d2a412792f76968aaee22466e27dac
MD5 67676dc6d270eefb8b5e40cce1f31afb
SHA1 5f916bbf4dbe8060d19340fe904eaa3a685eff65
SHA512 2f0dc0ca6b742f38460421134f679394707092a3afe031be90f36dec2ee911302934b1f76be631592bc6f5602a458433669ab24759983c799d65107b2396ec57
TLSH
T198D097C0988867AD08184F02B0A13DE23048CC3364B868309A910478CABADC51192A26
MD5 SHA1 SHA512 TLSH

Submit Download

a189ffdb-57d1-4555-b7ff-25e1e4a3e9aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\a189ffdb-57d1-4555-b7ff-25e1e4a3e9aa
Size 15KB
SHA256 0fd8d52279e15fa6ba7d6fa7bfada40144a56d92c383e6a1ead30a7a94c739ae
MD5 7cec20fae133bfe3e18843c916d5fb3b
SHA1 92fec249e4f7237cfb4410ffcf07dcadec7e40f4
SHA512 db48619e96addd7f2be1d722f5bcf20ca4bf621f768521006a757e288a8ac9e08739820b83e6a949d6dd0c9b00acad29df3d150f739b5abca6a779980bb54675
SSDEEP 192:NwaRZ1wytQGGf3ae7PzedB1zoIHfGQX1Z913kBZdzevHjblXvoJCIVw6:GaR7wytrGfKCredvMIHuQFZYJqm
TLSH
T1A972B756686045BA8251E3A994FC7FC3E6F528CF4C018FCADBE47E086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bed28853-f68d-4c85-8b00-641abadebcaa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\bed28853-f68d-4c85-8b00-641abadebcaa
Size 883B
SHA256 0ef9b8effc73455892499f3ceaba7c8d42abcca9f449709206b1098489ae3755
MD5 d180f93649f189cc6fca1cb6dc43fade
SHA1 c74d79334e7063e518a67490e7d3de25e130964d
SHA512 951b22a7c13899ca93d176487af892fd053e4eddecf693e17fcfed1fbb974e63b38b448e03aba63d8913bae1ff92615a8e2a655bb2b58cc0a5d4a6584ad6e989
TLSH
T1B4112785863076B2CC6CD24FD65637424BE47523C0C994083EE15A094D7F55EA7AA70F
MD5 SHA1 SHA512 TLSH

Submit Download

c2f5b8e6-196a-4b24-a352-45bdb465522c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\c2f5b8e6-196a-4b24-a352-45bdb465522c
Size 235B
SHA256 ec71ec43c0e4348fa72aee4d70e705ab89ad0b211ac97f0693613904f4a3f949
MD5 6a5718daf6cb38596052530ffdfc59d3
SHA1 02291db37162270495d4b77456a06a8260c17fe2
SHA512 d6693f5d8bbe0ad5b68f620d5c0df5812d6d23f9258abfda366810dc57e3d6616191eb6e37d33550986be1a8f64e99355e57118f9ab75f898c8c647206c8ee60
TLSH
T1EBD0978024A8A75E09000F02F0E078C230444C3318A858208AE24274DDFDEC48216996
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\extensions.json
Size 16KB
SHA256 dc08d99cd351513223bd1eeb2ce3450149f875941ffc292441c07b1f6be9b20f
MD5 08a49eeed248101123c27b1f5ecf2d4b
SHA1 359511c4cbfadfe801a4f1be9c3db619ce993cd2
SHA512 bd61c7d32926258b91585fb955c767e4d1dd52c851072a2158c70766fb2e03ecae6024b48154ca6150d17181392266ffb3778dea386fdf915f173e77ca50c9f8
SSDEEP 384:MkI4vcUmldvW8dhWr94zV96oetL4H5qQL4PBL4H1L4HnL4HQI4hv:DI40RfLX2436jt4ZqS4R4V4r4145
TLSH
T14072541545049EB8294F979AAA367E02C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 8KB
SHA256 289a4155a2ee02ed4312dda5dd0cd2a17cd25c37f2fa7ef59b368b13c3e97edb
MD5 f3d938ca91152b527ace326ef90f9fc1
SHA1 b73520acadbba53b476ff73162727299c679b577
SHA512 74147effe400750a04443efce3580c3de822f4ca71be6f51207e04fbd8168b1faef5a27a322507ee64bed5a1013b546cdb9345dabf6e90ad6b9c9dd316890ab8
SSDEEP 96:xHXWVTUuqGqSfkwJObzSbSSlNdv9jcUngWRI9XJKSIYiIBw88yicm68L4cnzbQGS:4wRSfkwJdSSQoRWZKSZBw888mE
TLSH
T18C021E7C9004CF7F64B6766CAC6488305AA2023BB6BF78D710B9A485050CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 7KB
SHA256 e474b5265a64efe29adc71416411aadae8b3df6f0774f91e209aa86390e3d236
MD5 b8083bdbc6d69831221036b6ea6a521b
SHA1 1c8465e1ea976c419f27c92ca80c77a4795f204f
SHA512 8b5632d7e18b8f949b4aa2a74c18cc9079826bf2bdc9e721a9901a83e23594f44859edc0bfd37fdeb423c236320e9c69256e26f1d76917154eb8fd7ad2af064b
SSDEEP 96:xHXWUTUuqGqSfxwJObzSbSSlNdv9jcUngH5XJKSIHBw88P8L4cnzbQGS:4ZRSfxwJdSSQh5ZKSYBw88Z
TLSH
T110E11F789018CB7F74B6766CAC6888316AB2013B7BBF68D750A554D8051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 6KB
SHA256 6c2ef397829e4f84180d4a206c0e73a58dd744a35c984dda6783da8003924fb7
MD5 413bc6ce42f7774c05917910eb62a6c5
SHA1 2b7b9e6e9d2513555453750cbdfdb7e2af5026cd
SHA512 04e197f892d106fdc95f8ee22451be617d6b6732b6e1840caf8d7ddf1eee510ff9eaddf538915e37bc0deb48b94e4d2f8ae8b3cb5840b5da5dcb60a486928e8b
SSDEEP 96:xHXWUTUuqGqSfxH5Y1zSw8SSlNdv9josngH5XJKSIHBw88P8L4cnzbF:4ZRSfxH5Yh8SSs55ZKSYBw88q
TLSH
T138E1207890188B7F75B6776CAC6888316AB2013BB7BF68D650B554C8051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 6KB
SHA256 10fbdcc0bd3f82718303b28ab296bfca8e1634214efc58152d0ae82b5293860e
MD5 6bbb6ac5fda724797290fb421478ed70
SHA1 1b313a6850dcbd28cc2fa6f46531959fa54a7f3e
SHA512 f32e4499ae50d01a14ae05b62acaad06ea34f6bce94f8271fba88c8bbe9302b24150e8b1147147869a5ec007d3caebdb630aeac2132319ae08f8f706d0c7d137
SSDEEP 96:xHXWUTUuqGqSfxwJ1zSbSSlNdv9jcUngH5XJKSIHBw88P8L4cnzbF:4ZRSfxwJ2SSQh5ZKSYBw88q
TLSH
T1A6E10F789018CB7F74B6776CAC6888316AB2013B77BF68D750A95489051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 15972730e5d8bf8473cafc2e1e5c347ab163c76d8937aede1ab101f49e397974
MD5 d435993514148f52d200997527b597f2
SHA1 ff78caf0acbc504402adbdc084953c2f9aca5ce8
SHA512 47378a70feda2bb7a4a8ee9aef113096ecf5185207fa46f363e62c8fa22134b3208630f5482e1d9c99204d2efb6ec4b2ecd2922f10c1fbaaa419a32133887078
TLSH
T16521DA84FE2F29F22B46C58D80C94BD9EB627012831C78F0D99A760061DCE4936CC60C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 a4a53ee6fb48728aed4901a3466d91d67dc950a9ab0dc19946a1937600d6ce9e
MD5 10373b61899b44fc48debcd1a9e6bd25
SHA1 1609d4e0c574b01d77c3a42e13998f0ec99c79b0
SHA512 bc6ca5b2c621afb9d8624c79e69de7cf421cba83a70db96906d4ea5b344e9ed82cb278fbeb5bf66d960a4454224f1df513a403e2b98ceabb8eccb0e5c8c2eac9
TLSH
T14A210D80FE2F29F21A85958E80C84FE8DF52B411835C7CE0C9C5E50157C8D0D325C70C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 ca623fb3a37cd130c83ac89b5914e55756a2133aac532b6d68dee9480331a255
MD5 6f517d4de949c7cd24ba76e6b18d3ca8
SHA1 11c05019c42d7cf8786e4af699a9a2d0858c4511
SHA512 0616664d193f842c5f43e469b3cbe6fe03d14e0b505f3861858d643856e7d27a02944bbeaea1491bc4401ea82fcbed573257b2e15e8adf07d61b3251174d230a
SSDEEP 49152:47xefsJyaP6ryMtvNd5C9S8rRz3UghkR0bPHYRpqZ:KYfsMaP6ryMtvN2Rz3UghkbqZ
TLSH
T1881639F824D1A257F3808037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads