7492fc0677a6efe064917ab54f62118da875a5690ee324d796a8f48c1881ca6f

Analysis

user interaction
yes
max time kernel
46s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WaveInjector.exe
Size 11.2MB
Sample260929-wnd2aa1bpc
SHA256 7492fc0677a6efe064917ab54f62118da875a5690ee324d796a8f48c1881ca6f
MD5 6b773d1427de2727105172c9e88e2f5f
SHA1 ac57cf012fbed8f43d1b7ba8758eba8818b06db8
SHA512 7e87ae39af8edda25700d7e1a29d3e708d68f62493188ce72ca73f60d45402f3274b1bec85fadf72dd9b609ee59e803fa253dbf69dedec8a7701cc2621dc4027
SSDEEP 196608:SCmWV5e61qbWIR+PUXG8xzZ10SZ/+4q0LiXLYcqyxWjsnntjO:BfVjqqIR+s2Q3dZ/I0vcE8ntj
TLSH
T1C1C612C578D5C2FCC845CA70E64529FDF0EE78898CBC952ABF8A88123571D55C8B9B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2260-0-0x00007FF7E7B00000-0x00007FF7E8CE9000-memory.dmp	themida

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2072	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	vlc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5232	firefox.exe
Token: SeDebugPrivilege	5232	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe
5232	firefox.exe
5232	firefox.exe
5232	firefox.exe
5232	firefox.exe
5232	firefox.exe
5232	firefox.exe
2072	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2072	vlc.exe
2072	vlc.exe
2072	vlc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1488	OpenWith.exe
2072	vlc.exe
5232	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 5232	3604	firefox.exe	102
PID 3604 wrote to memory of 5232	3604	firefox.exe	102
PID 5232 wrote to memory of 3412	5232	firefox.exe	103
PID 5232 wrote to memory of 3412	5232	firefox.exe	103
PID 5232 wrote to memory of 3412	5232	firefox.exe	103
PID 5232 wrote to memory of 216	5232	firefox.exe	104
PID 5232 wrote to memory of 216	5232	firefox.exe	104
PID 5232 wrote to memory of 216	5232	firefox.exe	104
PID 5232 wrote to memory of 216	5232	firefox.exe	104
PID 5232 wrote to memory of 4520	5232	firefox.exe	106
PID 5232 wrote to memory of 4520	5232	firefox.exe	106
PID 5232 wrote to memory of 4520	5232	firefox.exe	106
PID 5232 wrote to memory of 4520	5232	firefox.exe	106
PID 5232 wrote to memory of 3456	5232	firefox.exe	107
PID 5232 wrote to memory of 3456	5232	firefox.exe	107
PID 5232 wrote to memory of 3456	5232	firefox.exe	107
PID 5232 wrote to memory of 4992	5232	firefox.exe	108
PID 5232 wrote to memory of 4992	5232	firefox.exe	108
PID 5232 wrote to memory of 4992	5232	firefox.exe	108
PID 5232 wrote to memory of 4992	5232	firefox.exe	108
PID 5232 wrote to memory of 1644	5232	firefox.exe	109
PID 5232 wrote to memory of 1644	5232	firefox.exe	109
PID 5232 wrote to memory of 1644	5232	firefox.exe	109
PID 5232 wrote to memory of 1644	5232	firefox.exe	109
PID 5232 wrote to memory of 5388	5232	firefox.exe	110
PID 5232 wrote to memory of 5388	5232	firefox.exe	110
PID 5232 wrote to memory of 5388	5232	firefox.exe	110
PID 5232 wrote to memory of 5388	5232	firefox.exe	110
PID 5232 wrote to memory of 4400	5232	firefox.exe	111
PID 5232 wrote to memory of 4400	5232	firefox.exe	111
PID 5232 wrote to memory of 4400	5232	firefox.exe	111
PID 5232 wrote to memory of 4400	5232	firefox.exe	111
PID 5232 wrote to memory of 1572	5232	firefox.exe	112
PID 5232 wrote to memory of 1572	5232	firefox.exe	112
PID 5232 wrote to memory of 1572	5232	firefox.exe	112
PID 5232 wrote to memory of 1572	5232	firefox.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WaveInjector.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInjector.exe"
1⤵
PID:2260

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SaveConfirm.TTS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {bf2f442c-479e-424e-b002-cf616396a639} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {457c6480-b6ca-4fc6-9596-a63a210db27b} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27276 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {c858743a-b012-4d00-9124-024da1ee550f} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3944 -prefsLen 27276 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {cb2fbd9d-8b2d-4b1c-ab06-c36ff7c75917} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34775 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {c2106133-e67e-4397-9b17-24fb43682a63} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4932 -prefsLen 35012 -prefMapHandle 4936 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {b0fb3ef0-8b4d-43da-8f8b-a50c9724ecd8} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5060 -prefsLen 32952 -prefMapHandle 5064 -prefMapSize 270279 -jsInitHandle 5068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {22bf8d82-9a91-4570-a72a-7df16cb0f3dc} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {9d638e43-c394-4139-b7d6-a2eb5f95eaff} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2864 -prefsLen 32952 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {65aaca45-2d8d-40b2-aa2b-cf918714cd0b} -parentPid 5232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5232" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 f4fb43a070f4cffe686a1373dcf67b8f84bba659a58f99a20d907bf07f8f8ae7
MD5 36d049489181a4d6a4b631cc103ca8fe
SHA1 7526b1267e6272bfd217b875a41f388088f7617b
SHA512 7889de04be7c384b3e904d66f812f44096bb78a0cc4a1c97b14434ff06cdb59b37d4d46c74d07c87ee330922be6bd3836a3aea710ed18241857ab704e694b148
SSDEEP 768:1u3+3Vfc6GcmhuMdKDntkozvm31ApbObQbJbVbIbibKb7bI8rfmE/:w+3VExd48rr
TLSH
T11BE2F044EB1E553FD46812BBDCE507002F79B88A99192FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 770eca48fee45374f98c7a3ab2f3fe5497368ec3ce93863827cd295ed30add00
MD5 4835d7666aba9f52661611e0dd20e904
SHA1 cb617da2a137df15368d7270278466d7ec8b0539
SHA512 24f8032dcd5bb510b578355977295da405a27ba2a67e097ad3b2c7ffc6cbccdb95395dc705afcb123ee3b39258c3f9e3ae5eb22efa9283aa2cdc6b9899aa4da0
SSDEEP 192:8s1d66JozGzgCl6mc0dfOv5zbowboCyj/O+:8Wd66JozGzgC1jmbowboCyjn
TLSH
T1A8D1FCA4FA28863FD005423BDCB51F410F36389B9C8E7F2935DD64082D562AD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 102e1d5c077a6394831763a7baba8333c7f2e663bb902a062138823dc63884de
MD5 9bc1fcc7bca0adee963ac4aebc20f004
SHA1 95fb9a02804b31991400423f86a54c2b0fbe6a5c
SHA512 554f6c8a0b32ea4e7e019e6bdfa21ac8d3d1da52f8365ae47fb35b1f957a39c26aac2560a1533bed7b1645cc5f2899c81a2941fa21e7a0dcbcdd20c386b4f75c
SSDEEP 192:5Ov5zbohZoCyj/OPs1d66JozGzgCl6mc0dz:WbohZoCyj8Wd66JozGzgC1jd
TLSH
T11DE10BA4EA29863FC005023BDDB61B410F3A389A9C8E6F2971DD601C2D562DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7a99bffe82d000db17fcf151b1206c4d54e990a1b74c2d4ada64fc556f43574c
MD5 c4282e1c088a0f27fd7435505de1c1e0
SHA1 8b2c2dcac022ad8d69c208db338da6a4b3c21b1e
SHA512 b4db3daad2b0f11d3890a0b3c079e4947c9e6ae02076b3cf80eec16c182574c658fb99da04f960e5fd043f60d61159de072afb4c6510e4aa707cb78b57a49f45
TLSH
T13C217C5D3AB94E2E5DC7EAAC785102CE53924E0B14871C635E02DE8CCCC1AD932AE43D
MD5 SHA1 SHA512 TLSH

Submit Download

1f360342-548b-4806-aa56-d2b8649c849b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\1f360342-548b-4806-aa56-d2b8649c849b
Size 886B
SHA256 a30f8bee5c58ad32a0d40b0e238306f35cc709f2ebf31465e561f611f77d9c1f
MD5 28c82d1ebc0e439c0f318e537b8667d6
SHA1 1cd5619c5d3fe7d10179f53464fc2b8c6d5a7631
SHA512 af309837b902974787dd3f9c741365efff2dded56b4d832352f9376c7fb96c7d7ba3256bdd0adac0d8e56edb4c32c89e44cdbe1b236ffdc05d8e2b05ca3f5482
TLSH
T1F1114040A635B861DC78E25BD3F4774353E43063C0CA49287E902A280CBA62DA3A3703
MD5 SHA1 SHA512 TLSH

Submit Download

ae4ca303-259b-406c-a889-6aa8f80855e1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\ae4ca303-259b-406c-a889-6aa8f80855e1
Size 235B
SHA256 8f1cfa96c14576a2c6ce6222366d4248fb09eac2d7634304e7de5a10fe3f55ec
MD5 1011f87c02128ebf1dd1c78ebe452d4b
SHA1 a750574101731dcb14e5d2bf7fed1210760a0742
SHA512 f713dd36a2d7732106deb767b6ca80c9fe419d20c0a76d0799d510058400ba5f171da49e56101dd5a32299899e79372db52c7e6330114a30383d11540bc57efc
TLSH
T1BFD0979428A827AD082A0F0BF0E169CA30454C33906098208D9604349EBCAC441A2817
MD5 SHA1 SHA512 TLSH

Submit Download

c6ed63c2-ffe8-4b12-8ea7-9589d9924648

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\c6ed63c2-ffe8-4b12-8ea7-9589d9924648
Size 235B
SHA256 68180b463be49065df765c8eee3a195b6d1028325787919f0e1bcae6ae30dd86
MD5 94ca616b4a8eb3bd96dbd09ef8d0d2ec
SHA1 e3fd93f781b55da1230db9fd013bfd39540fd784
SHA512 7214950fa3f1e0568aab72c2acc0b18e8c558bf17db722d2d7ea193e365b08289b806df839e961fa0a37181cc67977b789f1fc392bfa4d55fd38bf98af05e216
TLSH
T1CBD097991498A36C0C280F17F0F03CC730448C3324B4A810A7510974CDFCDC48262907
MD5 SHA1 SHA512 TLSH

Submit Download

ca92be30-451a-46f7-aa22-c003452b9ec4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\ca92be30-451a-46f7-aa22-c003452b9ec4
Size 15KB
SHA256 583ec0fe8a0436f426a4161a1c0fb6bac4e34a6bcb44e8cce6b2e9cad4d15f5e
MD5 abdf736b10cd1d44f1915233345eef21
SHA1 97cd9f5c9be85d38509c36588b28455e9b378e93
SHA512 b3e6d505eb3cfd16db1f5acf8dd88546cf566ff1402da8fcdf4f00e0459101bf9b9de8e27406e3797b1e0a983200e72c7c49644368b4167c7dc219fe1ba4f4ef
SSDEEP 192:KkF83K8qFBMy631pBiucoYpPyVzxBg7a7o9C72kp/Mibi3RtguHsiCsXGIr:OK/FiySjkPyVlBg7aE9eUP5CiGA
TLSH
T11072C956243049BA8651E36994FCBFC3E2F528CF4C418FCA9BE4BD085DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf98c67a-21b2-411c-be06-ad523361e404

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\cf98c67a-21b2-411c-be06-ad523361e404
Size 883B
SHA256 154a666b987f450302e68c2560df230110d26c6c988e9917c922452ee12e63b7
MD5 2395ea1808ca85f6d9ce6c6e196529ff
SHA1 e249f805c561b04415ec49a0c5bf30e1648c747a
SHA512 cc4fe4819d840ad5da22370c9011828f90e4a7dc8ce40b37dbae81dedc377b46be928a9b8514d8f6e42843ebbc37234f4d434397f54b37694c036b209b9afec7
TLSH
T15A110080A63175A5EDA8924FC5B53B0367F47623C0CA84243EA159280D7DA2DA3BB646
MD5 SHA1 SHA512 TLSH

Submit Download

f9b372b2-1d7b-4fd2-a035-e0d137b383f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\f9b372b2-1d7b-4fd2-a035-e0d137b383f9
Size 2KB
SHA256 9b7af46251ba6f1d656b0a80f56ed29ad5da56030390ab55434e0b4d78b5bad8
MD5 beba0880e2b2152c2c23cabf0b0fdfa7
SHA1 2f4d7e29783dd51512e39ee323d2924c9aa6bb69
SHA512 79ee8ee8e8eb0340861ba6a3a029b25fb13945b10bd5a1e078b1c7d018cac3091f5ade3e0bdfc3f0b168057ff2753cb03b837a70336629c0578b74f7ef76c92e
TLSH
T11341349875B89C36DCCBE15D9092274E53B08E4350C618437E91DF0C8DA579D736B826
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs-1.js
Size 7KB
SHA256 818926f9878d5e786e63b8067d047962a8370661c106cd5e83c8dd99c555df0d
MD5 b1017ff7bbab4a2ac48564704d00f5b1
SHA1 f01a002610d2eed1d78b734c9c928932091ccbea
SHA512 196778670b370c1921348cf816fd876d21f0fbf93007a9b85f34267733e7e082879d672105473d8ee923a9a962ab4041a3eccdc0341ae94b9cfd6c133c812a92
SSDEEP 96:xHlwUTUnqGqEfx2yObzSBSSlSdv9j8jnHRHZlejyiBw88n8L4cnihjGS:0aREfx2y3SS1r9ZTiBw88L
TLSH
T17EE13F7890088B7F75B677ACAC6888316AB2023B7BBF68D750B554C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
Size 6KB
SHA256 2aa176d7f2b259cd19f62fb6dfe7366558d96c28c27d78196b6bc382023c5f58
MD5 f44b00571e0a177e6103bdb2c835d2bc
SHA1 8d1016bb944b6924417fcef1a51157dfde62c846
SHA512 4f59567735c40182dd4fab5653d3240f1e861c511a0b549992190c0c14e05fe0a6feb91e82a02045acbec6e86edfb0d58e42b1e39f75118d18626a89d0fcc337
SSDEEP 96:xHlwUTUnqGqEfxv11zSBSSlSdv9j/RnHRHZlejyiBw88n8L4cnihK:0aREfxv1sSSk9ZTiBw88k
TLSH
T11AE12F789408CB7F74B6766CAC6888316AB2013B7BBF68D750B554C4055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
Size 6KB
SHA256 e67c3b992d8075a321626cdb17788d8a8e94c6aa2890507d648f37e4bbbefde9
MD5 1ac045ece0621f30c0b378f5f3fcf95b
SHA1 a89ccebf0e1d215477237a1ec83ed0602d77f910
SHA512 bacd7d9b4822d0612aa5cf297ca047b9d267f1bca41530a37b88ae79769e9c3b5d0dba1dfc22cf8036aec28c6f3ad90113f33d184643be6590e2601f76fadae7
SSDEEP 96:xHlwUTUnqGqEfx2y1zSBSSlSdv9j8jnHRHZlejyiBw88n8L4cnihK:0aREfx2ysSS1r9ZTiBw88k
TLSH
T1B6E12E7890088B7F75B636ACAC6888316AB2023B7BBF68D650B554C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2072-361-0x0000018108D80000-0x000001810A5EF000-memory.dmp

Download

memory/2072-347-0x00007FF8ABA50000-0x00007FF8ABA7F000-memory.dmp

Download

memory/2072-350-0x00007FF8AB9D0000-0x00007FF8AB9FD000-memory.dmp

Download

memory/2072-354-0x00007FF8AB760000-0x00007FF8AB96B000-memory.dmp

Download

memory/2072-358-0x00007FF8AB590000-0x00007FF8AB63B000-memory.dmp

Download

memory/2072-360-0x00007FF8AB550000-0x00007FF8AB562000-memory.dmp

Download

memory/2072-359-0x00007FF8AB570000-0x00007FF8AB58B000-memory.dmp

Download

memory/2072-357-0x00007FF8AB640000-0x00007FF8AB665000-memory.dmp

Download

memory/2072-356-0x00007FF8AB670000-0x00007FF8AB6BF000-memory.dmp

Download

memory/2072-363-0x0000018108CE0000-0x0000018108CF3000-memory.dmp

Download

memory/2072-365-0x00007FF8A4530000-0x00007FF8A4775000-memory.dmp

Download

memory/2072-342-0x00007FF8ABF50000-0x00007FF8AC022000-memory.dmp

Download

memory/2072-364-0x0000018108D00000-0x0000018108D28000-memory.dmp

Download

memory/2072-362-0x0000018106FB0000-0x0000018106FDB000-memory.dmp

Download

memory/2072-355-0x00007FF8AB6C0000-0x00007FF8AB758000-memory.dmp

Download

memory/2072-353-0x00007FF8AB970000-0x00007FF8AB981000-memory.dmp

Download

memory/2072-352-0x00007FF8AB990000-0x00007FF8AB9A1000-memory.dmp

Download

memory/2072-351-0x00007FF8AB9B0000-0x00007FF8AB9CA000-memory.dmp

Download

memory/2072-349-0x00007FF8ABA00000-0x00007FF8ABA26000-memory.dmp

Download

memory/2072-344-0x00007FF8ABBC0000-0x00007FF8ABCA8000-memory.dmp

Download

memory/2072-348-0x00007FF8ABA30000-0x00007FF8ABA48000-memory.dmp

Download

memory/2072-346-0x00007FF8ABA80000-0x00007FF8ABAC1000-memory.dmp

Download

memory/2072-345-0x00007FF8ABAD0000-0x00007FF8ABBB3000-memory.dmp

Download

memory/2072-343-0x00007FF8ABCB0000-0x00007FF8ABF46000-memory.dmp

Download

memory/2072-339-0x00007FF8AC030000-0x00007FF8AC3C0000-memory.dmp

Download

memory/2072-341-0x00007FF8AE5E0000-0x00007FF8AE5F1000-memory.dmp

Download

memory/2072-340-0x00007FF8AEA30000-0x00007FF8AEA44000-memory.dmp

Download

memory/2072-336-0x00007FF8AF090000-0x00007FF8AF0A9000-memory.dmp

Download

memory/2072-335-0x00007FF8BAFF0000-0x00007FF8BB001000-memory.dmp

Download

memory/2072-333-0x00007FF8AD4B0000-0x00007FF8AD4E4000-memory.dmp

Download

memory/2072-332-0x00007FF6E9860000-0x00007FF6E9958000-memory.dmp

Download

memory/2072-338-0x00007FF8AC3C0000-0x00007FF8AC3EB000-memory.dmp

Download

memory/2072-431-0x00007FF8AD4B0000-0x00007FF8AD4E4000-memory.dmp

Download

memory/2072-430-0x00007FF6E9860000-0x00007FF6E9958000-memory.dmp

Download

memory/2072-432-0x00007FF8AC420000-0x00007FF8AC6D6000-memory.dmp

Download

memory/2072-334-0x00007FF8AC420000-0x00007FF8AC6D6000-memory.dmp

Download

memory/2072-337-0x00007FF8AC3F0000-0x00007FF8AC412000-memory.dmp

Download

memory/2260-0-0x00007FF7E7B00000-0x00007FF7E8CE9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads