73aec8b9d649be29b7ed49e10c9018c9b0cb4e4fcb561a4871ea722de81f9794

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_73aec8b9d649be29b7ed49e10c9018c9b0cb4e4fcb561a4871ea722de81f9794.exe
Size 36KB
Sample260924-kx1e4aaa87
SHA256 73aec8b9d649be29b7ed49e10c9018c9b0cb4e4fcb561a4871ea722de81f9794
MD5 59d4c6e5e3bc59849411b82d2d1d02a6
SHA1 6fc71781b5ac46a992a4f8202126bce6f334ec0c
SHA512 90298d9cb994f633726157dbc79e5108f75482a873333750a4d4cf75beb86558dd89743ec4f51455c57b6066f47611faea0d3b352611cfa00301dfb1c1859ea6
SSDEEP 384:nqswIvcWWyK42NAdso1Pl6etgt6C9XxEApOlaEMelIXBWq8fySSG3jfws3tw5nZq:nDNLbHgthxEMDkIXWBL3jj3JWHO
TLSH
T140F24C9F6E938162CA560BF00D3B2656DB625F13D33046F7D758EE192FA21E2C93825C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1420	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_73aec8b9d649be29b7ed49e10c9018c9b0cb4e4fcb561a4871ea722de81f9794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 53 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	firefox.exe
Token: SeDebugPrivilege	1980	firefox.exe
Token: SeDebugPrivilege	1980	firefox.exe
Token: SeDebugPrivilege	1980	firefox.exe
Token: SeDebugPrivilege	1980	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1980	firefox.exe
1980	firefox.exe
1980	firefox.exe
1980	firefox.exe
1980	firefox.exe
1980	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1980	firefox.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1420	2416	jaffacakes118_73aec8b9d649be29b7ed49e10c9018c9b0cb4e4fcb561a4871ea722de81f9794.exe	90
PID 1420 wrote to memory of 3392	1420	cmd.exe	91
PID 3392 wrote to memory of 1980	3392	firefox.exe	92
PID 3392 wrote to memory of 1980	3392	firefox.exe	92
PID 1420 wrote to memory of 2136	1420	cmd.exe	93
PID 2136 wrote to memory of 3296	2136	firefox.exe	94
PID 2136 wrote to memory of 3296	2136	firefox.exe	94
PID 1420 wrote to memory of 3412	1420	cmd.exe	95
PID 3412 wrote to memory of 3312	3412	firefox.exe	96
PID 3412 wrote to memory of 3312	3412	firefox.exe	96
PID 1420 wrote to memory of 2440	1420	cmd.exe	97
PID 2440 wrote to memory of 1776	2440	firefox.exe	98
PID 2440 wrote to memory of 1776	2440	firefox.exe	98
PID 1980 wrote to memory of 4664	1980	firefox.exe	99
PID 1980 wrote to memory of 4664	1980	firefox.exe	99
PID 1980 wrote to memory of 4664	1980	firefox.exe	99
PID 1420 wrote to memory of 2044	1420	cmd.exe	100
PID 2044 wrote to memory of 1840	2044	firefox.exe	101
PID 2044 wrote to memory of 1840	2044	firefox.exe	101
PID 1980 wrote to memory of 1352	1980	firefox.exe	102
PID 1980 wrote to memory of 1352	1980	firefox.exe	102
PID 1980 wrote to memory of 1352	1980	firefox.exe	102
PID 1980 wrote to memory of 1352	1980	firefox.exe	102
PID 1980 wrote to memory of 4748	1980	firefox.exe	103
PID 1980 wrote to memory of 4748	1980	firefox.exe	103
PID 1980 wrote to memory of 4748	1980	firefox.exe	103
PID 1980 wrote to memory of 4748	1980	firefox.exe	103
PID 1980 wrote to memory of 4620	1980	firefox.exe	104
PID 1980 wrote to memory of 4620	1980	firefox.exe	104
PID 1980 wrote to memory of 4620	1980	firefox.exe	104
PID 1980 wrote to memory of 2996	1980	firefox.exe	105
PID 1980 wrote to memory of 2996	1980	firefox.exe	105
PID 1980 wrote to memory of 2996	1980	firefox.exe	105
PID 1980 wrote to memory of 2996	1980	firefox.exe	105
PID 1980 wrote to memory of 6108	1980	firefox.exe	106
PID 1980 wrote to memory of 6108	1980	firefox.exe	106
PID 1980 wrote to memory of 6108	1980	firefox.exe	106
PID 1980 wrote to memory of 6108	1980	firefox.exe	106
PID 1980 wrote to memory of 2776	1980	firefox.exe	107
PID 1980 wrote to memory of 2776	1980	firefox.exe	107
PID 1980 wrote to memory of 2776	1980	firefox.exe	107
PID 1980 wrote to memory of 2776	1980	firefox.exe	107
PID 1980 wrote to memory of 1104	1980	firefox.exe	108
PID 1980 wrote to memory of 1104	1980	firefox.exe	108
PID 1980 wrote to memory of 1104	1980	firefox.exe	108
PID 1980 wrote to memory of 1104	1980	firefox.exe	108
PID 1980 wrote to memory of 5764	1980	firefox.exe	109
PID 1980 wrote to memory of 5764	1980	firefox.exe	109
PID 1980 wrote to memory of 5764	1980	firefox.exe	109
PID 1980 wrote to memory of 5764	1980	firefox.exe	109
PID 1980 wrote to memory of 1096	1980	firefox.exe	110
PID 1980 wrote to memory of 1096	1980	firefox.exe	110
PID 1980 wrote to memory of 1096	1980	firefox.exe	110
PID 1980 wrote to memory of 1096	1980	firefox.exe	110
PID 1980 wrote to memory of 5848	1980	firefox.exe	111
PID 1980 wrote to memory of 5848	1980	firefox.exe	111
PID 1980 wrote to memory of 5848	1980	firefox.exe	111
PID 1980 wrote to memory of 5848	1980	firefox.exe	111
PID 1980 wrote to memory of 4932	1980	firefox.exe	112
PID 1980 wrote to memory of 4932	1980	firefox.exe	112
PID 1980 wrote to memory of 4932	1980	firefox.exe	112
PID 1980 wrote to memory of 4932	1980	firefox.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_73aec8b9d649be29b7ed49e10c9018c9b0cb4e4fcb561a4871ea722de81f9794.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_73aec8b9d649be29b7ed49e10c9018c9b0cb4e4fcb561a4871ea722de81f9794.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7E4E.tmp\Neues Textdokument.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
      4⤵
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1980
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {035b8deb-fdef-4d8f-bf77-26bd9e6c2bf2} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4664
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {0019a9c7-1483-4e5f-8eb7-485f21f0e919} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1352
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4064 -prefsLen 25213 -prefMapHandle 4068 -prefMapSize 270279 -jsInitHandle 4072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4080 -initialChannelId {a59aee93-f6ea-447a-a052-2eddac26f19c} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        Checks processor information in registry
        
        PID:4748
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4248 -prefsLen 27323 -prefMapHandle 4252 -prefMapSize 270279 -ipcHandle 4260 -initialChannelId {baee5d86-8b7e-45c6-995d-c6980f619787} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        
        PID:4620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4560 -prefsLen 25213 -prefMapHandle 4564 -prefMapSize 270279 -jsInitHandle 4568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {48f5c9df-8f33-4af0-8f4b-7eea95529451} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:2996
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4768 -prefsLen 25213 -prefMapHandle 4772 -prefMapSize 270279 -jsInitHandle 4776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4784 -initialChannelId {44788513-baae-49d0-a3c7-cad55a34a687} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:6108
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4936 -prefsLen 25213 -prefMapHandle 4940 -prefMapSize 270279 -jsInitHandle 4944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4948 -initialChannelId {4b2d267e-b621-486f-beb4-2f8d710a0baf} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:2776
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2916 -prefsLen 34822 -prefMapHandle 3092 -prefMapSize 270279 -jsInitHandle 3160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1028 -initialChannelId {06811b10-53b8-4f18-ac85-19954819fe47} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:1104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3260 -prefsLen 35010 -prefMapHandle 5300 -prefMapSize 270279 -ipcHandle 5616 -initialChannelId {a0cb5872-45c7-45fb-9a60-21ec4e5bf5da} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5764
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2800 -prefsLen 32952 -prefMapHandle 2808 -prefMapSize 270279 -jsInitHandle 2812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2576 -initialChannelId {3fafa46e-148f-4a79-a8da-9db333060989} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:1096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6140 -prefsLen 32952 -prefMapHandle 6148 -prefMapSize 270279 -jsInitHandle 6152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6160 -initialChannelId {51a685c8-e4c2-4a23-a28a-d2b3a8908d8a} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5848
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6332 -prefsLen 32952 -prefMapHandle 6336 -prefMapSize 270279 -jsInitHandle 6340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6348 -initialChannelId {dc7e2cc4-bd67-41f4-8224-d212ab4f9cd1} -parentPid 1980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
      4⤵
      Checks processor information in registry
      PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
      4⤵
      Checks processor information in registry
      PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
      4⤵
      Checks processor information in registry
      PID:1776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" http://wowomg.com/spin_counter.swf
      4⤵
      Checks processor information in registry
      PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 f50f39c696e844f63fdeb58e625307af28524882b48b714466f0648d5c38e9fc
MD5 a0965c6359c877449f7943e98ce72096
SHA1 b4fdf5a4402e896fada7a08bf671dbcd2275b6b9
SHA512 44957123c33833609774b3516cac29678585e6c84a87912fe0d59d032e02e960157e973038bfd95db7df48b5b4bf5411ffc8bf539811d95c3a9199e38dffdd52
SSDEEP 384:HalwSiO024Y/DL84KKDL849B7SOEAd9KVRaAcP+AWRMAHL+mS+r:6l8ZY/DL8lKDL8CB7S/AmVAf+hRM+LpL
TLSH
T1A9728E794F013CFC2597C0E8C4B942A98D0877A7DFEA806D21683D0DDB98A69B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 235ddfa67b44938e300300bb17d5f87355128b1af4853a745a140c99fca1ff4f
MD5 838c56137d685cc770e38bd0486f2d78
SHA1 4c281bc7e608ad39356dc31991d89a6eb9bab76c
SHA512 ed7ff044b3de3bfee49040545286e98f4d7cda39cc7e1d6ffc43aafdf3188344f891df60ea53f480bcb4c95d115388617b2cfd426bbd6596622b6907a67356e1
SSDEEP 1536:jTrli6MAsDBBcP39UOWXQjTc+dSlkI5Y1KiDUlpLSBVrwBs0I10t4c5hQ//0QBRn:j3lsY39dnc+29kY1HPPC0QID4GKwje3
TLSH
T12CB39EF7DBA2CD3D64FFD02D6A82C43EF8266400B3A73009C953671562C6BB86679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Neues Textdokument.bat

Path C:\Users\Admin\AppData\Local\Temp\7E4E.tmp\Neues Textdokument.bat
Size 276B
SHA256 62004d9c289e3d833a1324208d1f5cdfa2d99ce494eb8488ad20a6147f1ee0a9
MD5 3c7bc26cc38cfc2b9f8623d37b537170
SHA1 adc10935fc070ea2edc9ea624d5aca6f31ae6145
SHA512 1989b9446f67be4b54709c88b39b128d5041488c564d651575434ef4a8d96d6b74b27116e0c20bdf96c372946f96dcc418e66ce693f06ff3d639e24434b9e68f
TLSH
T150D0024D5D9250465E83D98521513A12C1C256555C82D689D8F01C1D619FEA331D63C8
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0223813b64a969d6bbbd54f31e0a8e6b545040ba92404e965d29d353db05b76d
MD5 7621b3a88ae37b1ef02294f21573e176
SHA1 6e97198c38247e7bfcaaa5d77b82ba51bc2f3416
SHA512 d9bc4a6a8f162242a1d2d736fea0036898a0ef70d03bb7cd55833c7b1b18535be2bdfa2d6870152237226b8e328d122afb314858f198dc1742021ed767682cc9
SSDEEP 192:3Y1d66JoztdzgCl6mc0dsOv5zbo7KZaqyjXy8K:3yd66Joz/zgC1jtbo+Zaqyjy
TLSH
T175E11FA4EA38823FC419137BDCA61B414F35385A988E3F2936DC610C2C572DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 83672faa777dea7322c01dec06cafc0fdba902565a3b502b2830ba5fbe6cae9a
MD5 9247605051bdc12e298e2dd01930eb1e
SHA1 48e21e7529d46f0a8839483b6ad58991fbb8d274
SHA512 8caabd35c0bd81f3e19ae62ffe7b626219a4499a008176640d0aed5f1732a7fec22ba78d564a35d65c07cc2f3a829aad2c22d9bf7f9854f79ee1ee0641985949
SSDEEP 192:6Ov5zbo8baqyjXy8fY1d66JoztdzgCl6mc0dz:5bo8baqyjHyd66Joz/zgC1jd
TLSH
T1E1D11064EA38863BC409537BDCA51B414F36386A984E3F2936DC65082C5B2DD768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\events\events
Size 1KB
SHA256 94a36b8821099a570c0e399df5ed17523ce046925cf0e9bf6dff241537bb4208
MD5 3132ac266874bbc390c444e0b8649f61
SHA1 1de8597b5e408fdeab8bc6122830be0f36952442
SHA512 6ac036a20c59a76817f4e0a8ac2437b52320288392098cd961a689105f0b42579b214609e70c20e8e8797aeec84cd03ac348641674cac208810c1027fc49e2d4
TLSH
T17E219D4D3AF84D2A9CC7E66C7480528F53948E0A14471D475D62DF8DCD81BD931AA829
MD5 SHA1 SHA512 TLSH

Submit Download

3cbaa450-0432-470e-9d07-a31daf14551c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\3cbaa450-0432-470e-9d07-a31daf14551c
Size 883B
SHA256 257ab26b69ed61aac17748767803e5eeccc1abfff02bcc544235b0e212680b59
MD5 ce81671e42c655e55ecd2f8fc9b3ef74
SHA1 184d8cc88aaee2cb55f27b87b4d684d8c949bb5c
SHA512 2ce327020f888c7cb370e36d17cf9dd5acff0bcdf8ce1adc6fda4fd200aca2f27f15ef36694629f02416e5bcf70df38a5a8e97057cc0fbc2f8eba3c5e1ee4918
TLSH
T1741100809634B5E2CD28924FC99137038FE4652380CA45147EF65A080CBEA1EA3A620F
MD5 SHA1 SHA512 TLSH

Submit Download

7dc7357d-873d-4411-88c7-b910a469eab5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\7dc7357d-873d-4411-88c7-b910a469eab5
Size 15KB
SHA256 7526441c5e2c134e708d04611c34197d1462e065f9008c8cfaf7b36858e1e7cc
MD5 58bf292f95374f05d0bf548918578105
SHA1 000743225631299ac3b2465f03e1bfdf60d7c3e0
SHA512 a4cf129ab1ff237d04d125db6f3d989a50bc94d6dcb0fd7c01de23950797900eddb611688a985c1b7f55ad71d0ead785e497c288a55648f4bedd04db1b8fb037
SSDEEP 192:MEvHIOkdu21x1CABO63+eJIGJS3D1XNzxiIkaflVSQ+ItV8SrYfTpEy23lvmyhwR:lVXC1PweJI8S3D1NliIk+DdriSgR
TLSH
T1F172C9566820557B8291E3A998FCBFC3E5F628CF4C415FCE97E4BD0829DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a95d3ffc-b068-4457-b8f8-7218b7a33188

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\a95d3ffc-b068-4457-b8f8-7218b7a33188
Size 235B
SHA256 5ac4083ca8511ece30af9d70e5b3196a6f372a9d7c6a891088e552508edcec10
MD5 e0ec3ad3e5ab2625c2ca94647d7ee31f
SHA1 9b6280d2cecea82c8c9ad8afaf69ab33f45ae58a
SHA512 922e0b24042b8b32b3f6839d72f70c20b6df03f7defd65768b0c22917e180383edc6eff30e6d0e80e4c66cdd784e9195ad07e35c04299f7183ff526625afb37d
TLSH
T1AFD0978568A8772C0C100F07F0E06DCA30A84C3365A4A820CA600674D9FAEC4411280A
MD5 SHA1 SHA512 TLSH

Submit Download

d34ebf84-dbcf-4496-959a-6458a0df1074

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\d34ebf84-dbcf-4496-959a-6458a0df1074
Size 235B
SHA256 3f734af14e93da1228d18d033cceb6493147524b7547656c1ef2ba4f0e8f2f11
MD5 b93a2186a516f02222e5f54fa09d3515
SHA1 9421bb8d176fdf60755b25c8c07d52e3a5987c1f
SHA512 8aae68df23736bb6cb6eb5c03003fad23e9c7a3bdd7c2de4d219d33b0e940edbffdde155c55b06608d2d5e2c98dfd98624f9754bdb3f770aa206b4952bfdb2d7
TLSH
T152D097C05488B3AE08040F0BB0E068C23084CC3354F45820EA9108B8ADBEAC60112C1B
MD5 SHA1 SHA512 TLSH

Submit Download

f3f162e6-4500-4249-8709-376edcc6557a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\f3f162e6-4500-4249-8709-376edcc6557a
Size 2KB
SHA256 b998fcc9236ddcede5d5d8aeec6a15120e7f1ffa573c53b1ecb2a73a3ba0e6a8
MD5 2262bd9b65177a0ca4540d517ed39634
SHA1 b9ad2718e1ca6aebbbf9101eb395065b08eb4128
SHA512 5109504d780d7f07064a932626b345dff41607119905701f66534af0f0b9bf46a581e9f92ab5b8a53146499ceafd540342ef3c2ab87c4026c43968891389ce51
TLSH
T1E741515C74B85D779CDBF65D9482338E57648A0340C22C836E52EF0C8E976AD73EA42B
MD5 SHA1 SHA512 TLSH

Submit Download

fd208c17-79b7-4df9-bc58-08b9fedb6956

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\fd208c17-79b7-4df9-bc58-08b9fedb6956
Size 886B
SHA256 f048b3f8dee0c743e076498b286be3251a0ef06bfdb277606650e0fdbf00c12d
MD5 1d65620d2d84b8f71839841eadc03469
SHA1 113560c2485162dc2ab48bdef58687f65d8026e9
SHA512 aa3cd633f706ecfa9ad989a9623ab277776ca9db13634d33395fe33750ef9448e07e125294deb0ce6c34e504b682c9ae9417ea7bd6d19c988b0f119b7b7cbef6
TLSH
T1D11104815534B5F2CD28D29B989177438BE07423C0CA49247EA55B0C1CEE52E636660B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\extensions.json
Size 16KB
SHA256 e4bd396608de0b4ed1ed2cf67142dc6de9231c37a842f721c99cd9c914fe80a1
MD5 ab4c1b898bd7cfa6259a33a6bfc467be
SHA1 b8eecf78fab79cd23bdf6f6a2f19109bf379be31
SHA512 16abb9b929fbd4d78fba1d737fb46a29933b87fe64c0837fe57142bd875b831d917514b3fc7ba2d27d2694b574e8b4f3d788631b8a4b6507bc5319028b8750c1
SSDEEP 384:MkI4vbUmldv18dhWX94zY96ouL4H2L4PEL4HcL4HEL4H9/4hy:DI4TRfGXC4g6z4c424W4+4p4Q
TLSH
T15972411545048EB8294FA78BAA267E02C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs-1.js
Size 8KB
SHA256 5839bb888733e904b75dda3940bef4bb63085dc85020f4e2f84eaa9fb995d575
MD5 49995deddc18933c48a5be4aa87ad829
SHA1 1753d43d59222e9ff9d017d5362dc9014a162d02
SHA512 922acb2902133dda440421c83b8265e3e3c78156dc831ea45c2bf48e8b7c0a8237c875224aca26088a994e44438fa4a6a3d6b30f53fbca9f4dd0d67ed305bfea
SSDEEP 96:xHzhTUX7qGqOfCqlObzS2+SSlXdv9j+Yn1WR80/Tz3XDBw88S0G8L4cn1I++:VzROfCqlE+SSMDR1/TjTBw88Y
TLSH
T15A021E789144CB7F74B6776CAC6489315AB2013BBABF68C750BA44C5050CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
Size 6KB
SHA256 f1cbb5444daf7a0bae068a9e21cf862c809995d39ef4745e2cef742edfea53d7
MD5 ac4cc7278c0cc58011a0a473e584b350
SHA1 794e1f9f72280be5c681903372a757babd8c2894
SHA512 d26f3b2b2f300854ea5b627950d421170a018561a642bfd6f600d64b0ab9633178e4d048f38fb146cdb21ada86a34f0ce2fb9ec1243478e9b6fc6257f35e6a7e
SSDEEP 96:xHzUTUX7qGqOfE4/1zS9SSlXdv9jln1HA/Tz3EBw88u8L4cn1I++:VWROfE4/sSSJA/TjEBw886
TLSH
T18FE130789048CB7F74B677ACAC6888316AB2413BBBBF68C750B54484050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
Size 6KB
SHA256 d382c0e8f26a8545fae1002f19a590af530902d84a3c65560a07cdc8d70d8914
MD5 adacfdd9c63c3c439de30f49feea5090
SHA1 61f555cfbfb7d0c08724e21202f00292b7d25fc1
SHA512 28ef915d5e76435f488002cee51b8ecf2d0f57d75ee47689fa0d5434ee8c52e55ba83cd5046cfe2c0e4b4fb24f35c803ca71ec3f89a4d9767085686345127795
SSDEEP 96:xHzUTUX7qGqOfEqlObzS2+SSlXdv9j+Yn1HA/Tz3EBw88u8L4cn1I++:VWROfEqlE+SSMmA/TjEBw886
TLSH
T172E13F789548CB7F78B6776CAC648831AAB2013B7BBF68C750B54484050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b75709f6e56c9cf53e9913a600051c171fa4226f01fe7a35a6365320a60c7323
MD5 d8a32667719761e9fe53fdc5a9d4c464
SHA1 6070d878816ce23626e7f17ba1a6cf89b62bb35a
SHA512 185ed8dd95321a642a8edff3fc669fba66f824b4b9285bcc94bcd54d1c650c7f1bfed39c0a7c898f888e84d890c961212680a60141a4181ee627041f783eea9a
TLSH
T1AB310AD24E262DF43242535958CA5FF1D6953411C931B9B0E4ED4F4E148E88E3B8905D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 cccd54cd91900f60ff8755c5be4c59ea4c9823b04f13420c5524745408f27daf
MD5 ff78dddce7fa9e35f7050ed10bf4f647
SHA1 cb5a58f1805402cb80904fd68e5ec6a6fee337e4
SHA512 62440d7971df1812e015e486d30765d336c86bed5287b6d1b6066c5c2c3dbf0d385a0a3312a4e3b86ab3123512c2fdc62d89a9a10c4bc9f1413f03bc27565d44
TLSH
T114310AE285263EF47A41024859CDAFA483A63032C57464B0D0BF8F4760AE8CD778521C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 8754fb4fb1cf45e0f6c9b337bf88e4684007159e907f70ad3e1431623e67dbb5
MD5 a7e0244e56d9cfab9094d0ba0222bc6e
SHA1 fef304ebae186d1f189bdf422ad3498c89b7f35d
SHA512 6481322ec5133a1145045bcdfd7ed5c9ea1130cfcfd8f7134647e47f9eba711496405112e417d41cd7bdf41c1eb7d8a016fdc3affd31a91e1463b1609a02913b
TLSH
T1BB312CD285162FF43681034894CD5FF492A63021C47164F0D4EF8F4B50DD88D778916C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d9e9cc12ec2d3c97d096651ffdd4b1116768a0c9e8f91df736b54ed022325c82
MD5 510a32cbc51b60b63492e1690156b232
SHA1 103527cc13e7de61a5c1f1ac621d62abebc5fffb
SHA512 2b04dce42c5ac0b7c9296fcbaa6c156c52309a8baaa28a5a04477276380dd2493bff038f5bcd4df5c3ea8172d215dceeec6fb25ecff93ed028e15d3380a3d37d
TLSH
T1A021B7D25A2B2EF437858369588E5FF1969A3061847154E0C4CE8F4A1DED88D378651C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e0b74b1521485f32bb62b262db1ef198d5d34613f6992af78639116fa11596be
MD5 2f5dff19d3afcc1eb4fcc1b72a198976
SHA1 5d60f3f30538448f97565afd5bc1ea66481a8318
SHA512 ad4790303a5c742118471357097ac766e9e75fad95a069cd79e4fbe6359b2e2d4aae904dc91c2cdf20957104583f76769c2e5e0fc3e41ce2a171f3851ef7d77b
TLSH
T14531EAD285173FF87541429855CD9FB492B53432C476A4A0D0AF8F4B54AD88E7BC515C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.7MB
SHA256 797e33726ff6113455d92c6420b1525dc32b676b1c5143d120505058410b8947
MD5 df345fde35142da976d5b2b4c3be1b8b
SHA1 2899241554c5364fae7491db2d20778a3fadb26e
SHA512 bf275fc1e7d0ca6313499c4c3beaa7d8ecb073444c88decd51e7ed27e9fc03f134ff4b35ce9feab332c71a6d8a12f1c8a1eaed170f84ceb0138a9e975ee75908
SSDEEP 24576:sKexFgRJbrNKij6sOYxNOznISnGP9PJ+ZFPIumfXuN9Nr6wpjWuZUdLxwkmAl2ov:sKUc4iejYCTIxeNHrvWSUdLxwkmAlV
TLSH
T1615618F820D1A297F3824033764593EB21EFD00D5027DA085BA95AE9A574CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-0-0x000000000040A000-0x000000000040B000-memory.dmp

Download

memory/2416-12-0x000000000040A000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads