hxxps://www[.]dropbox[.]com/scl/fi/qbhju390fxm1tohd02o6x/ALauncher-Setup[.]exe?rlkey=u1t3a7in3xn3y3q9o2mqx6ry0&st=wi6k51iw&dl=1

Analysis

user interaction
yes
max time kernel
22s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/scl/fi/qbhju390fxm1tohd02o6x/ALauncher-Setup.exe?rlkey=u1t3a7in3xn3y3q9o2mqx6ry0&st=wi6k51iw&dl=1
Sample261018-v4fdlsft7m

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
36	5300	firefox.exe

Executes dropped EXE 2 IoCs

pid	Process
4248	ALauncher Setup.exe
1172	ALauncher Setup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\ALauncher Setup.exe:Zone.Identifier	firefox.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ALauncher Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ALauncher Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ALauncher Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ALauncher Setup.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\ALauncher Setup.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5300	firefox.exe
Token: SeDebugPrivilege	5300	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 5300	4752	firefox.exe	85
PID 4752 wrote to memory of 5300	4752	firefox.exe	85
PID 5300 wrote to memory of 3180	5300	firefox.exe	86
PID 5300 wrote to memory of 3180	5300	firefox.exe	86
PID 5300 wrote to memory of 3180	5300	firefox.exe	86
PID 5300 wrote to memory of 3888	5300	firefox.exe	87
PID 5300 wrote to memory of 3888	5300	firefox.exe	87
PID 5300 wrote to memory of 3888	5300	firefox.exe	87
PID 5300 wrote to memory of 3888	5300	firefox.exe	87
PID 5300 wrote to memory of 6096	5300	firefox.exe	88
PID 5300 wrote to memory of 6096	5300	firefox.exe	88
PID 5300 wrote to memory of 6096	5300	firefox.exe	88
PID 5300 wrote to memory of 6096	5300	firefox.exe	88
PID 5300 wrote to memory of 392	5300	firefox.exe	89
PID 5300 wrote to memory of 392	5300	firefox.exe	89
PID 5300 wrote to memory of 392	5300	firefox.exe	89
PID 5300 wrote to memory of 5696	5300	firefox.exe	90
PID 5300 wrote to memory of 5696	5300	firefox.exe	90
PID 5300 wrote to memory of 5696	5300	firefox.exe	90
PID 5300 wrote to memory of 5696	5300	firefox.exe	90
PID 5300 wrote to memory of 2332	5300	firefox.exe	93
PID 5300 wrote to memory of 2332	5300	firefox.exe	93
PID 5300 wrote to memory of 2332	5300	firefox.exe	93
PID 5300 wrote to memory of 2332	5300	firefox.exe	93
PID 5300 wrote to memory of 3992	5300	firefox.exe	94
PID 5300 wrote to memory of 3992	5300	firefox.exe	94
PID 5300 wrote to memory of 3992	5300	firefox.exe	94
PID 5300 wrote to memory of 3992	5300	firefox.exe	94
PID 5300 wrote to memory of 4528	5300	firefox.exe	95
PID 5300 wrote to memory of 4528	5300	firefox.exe	95
PID 5300 wrote to memory of 4528	5300	firefox.exe	95
PID 5300 wrote to memory of 4528	5300	firefox.exe	95
PID 5300 wrote to memory of 4600	5300	firefox.exe	96
PID 5300 wrote to memory of 4600	5300	firefox.exe	96
PID 5300 wrote to memory of 4600	5300	firefox.exe	96
PID 5300 wrote to memory of 4600	5300	firefox.exe	96
PID 5300 wrote to memory of 4248	5300	firefox.exe	99
PID 5300 wrote to memory of 1172	5300	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.dropbox.com/scl/fi/qbhju390fxm1tohd02o6x/ALauncher-Setup.exe?rlkey=u1t3a7in3xn3y3q9o2mqx6ry0&st=wi6k51iw&dl=1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.dropbox.com/scl/fi/qbhju390fxm1tohd02o6x/ALauncher-Setup.exe?rlkey=u1t3a7in3xn3y3q9o2mqx6ry0&st=wi6k51iw&dl=1
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1744 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {88a7882b-06b4-4ce0-bd4e-778119d821e3} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {8e7a78ce-71a8-4c61-8646-c399240d0ab3} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3620 -prefsLen 25213 -prefMapHandle 3624 -prefMapSize 270279 -jsInitHandle 3628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3636 -initialChannelId {ab1afb22-2bb5-4689-8ddd-eb4f6dc55803} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3812 -prefsLen 27325 -prefMapHandle 3816 -prefMapSize 270279 -ipcHandle 3624 -initialChannelId {3b8c3fd9-9028-422f-84a4-81a7dff55501} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3564 -prefsLen 34824 -prefMapHandle 3188 -prefMapSize 270279 -jsInitHandle 4344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {88e70fc1-ce29-45a1-b345-b301886ac0f2} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4896 -prefsLen 35012 -prefMapHandle 4892 -prefMapSize 270279 -ipcHandle 4872 -initialChannelId {2c41759c-bda6-4ede-823e-4f4aa1c0c46a} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 32900 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5064 -initialChannelId {240baa4e-4174-444f-80f2-085b63c1a7af} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32900 -prefMapHandle 5108 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {790f624b-87e9-4a2c-b4eb-27fcb67149f9} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 32952 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {9229c4e6-9272-4ee8-9e03-63eed0dfaa35} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4600
- - C:\Users\Admin\Downloads\ALauncher Setup.exe
    "C:\Users\Admin\Downloads\ALauncher Setup.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:4248
- - C:\Users\Admin\Downloads\ALauncher Setup.exe
    "C:\Users\Admin\Downloads\ALauncher Setup.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.contile.json
Size 4KB
SHA256 7e8b8eca2bc5fd50157e453ffc3be96eb9764c4580e50bc13c9344ad17688679
MD5 e4ddf8eef8725d364e6be30e2e5a6f29
SHA1 000d52bfa77c75dcfcd394c137cf0cd44efc4b8d
SHA512 1c793b973613286a1e582412822c45ac2d4dc4c1dfe1039f9c0fe9003757da4c694f39b1b51c7cf5a6a8620ee1770fcd63b8f014f539fd2dc0dd287c1bbe828c
SSDEEP 48:YdbACTSreDZWMyfWMonzapqEiocWQdmqp4JMTSreDZWeyfN1PQrPFGjy6T+jiR4N:T7MzMoGmdmBeod5T+mRIcnfP7SvWdIlz
TLSH
T1A491C75B847488561BB2F6E9AC4F2758F103B005CDF8DAAC712F9C21C5783EE90DB985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 12f7605b90f12b828e251fa4d5c6c4021bf28c38f07c8d65e4057baffb0441ea
MD5 76c4c6fc971d202b3ccae97a8706f34a
SHA1 d5b92d2204624705de055b39e7bd695a33b04886
SHA512 4f4167ff7464801d518c9f14919b8efeb5b70a1aaadae6e5fb07c76992d9998062e41c626b69e0696aa8bbc50a346f0e1d2e29042900ddd0da91dc6b838bc353
SSDEEP 768:+yT5SIQsDGhu91kxJi+57SjF51a07NB1ihTSA8Y57OOrE5Ww4o+GOYK:lT59E574Xzf1K+/r5WHGOYK
TLSH
T14F731AA397E8B2FB0B9037C72C0F795B66E14185E34906C8FDEDC91D81DD654223A6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0inymrgq.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 98dccf83bd73cf90f2a557c8350d62f35fe20fb6a41d3b209bf75178a11c4186
MD5 53638a615397dc045b11f2e5a78c46aa
SHA1 82c227524e9408ea598a7a457cc6b28eaecff936
SHA512 dc98a22866b9f3373bdff024901cfdae24461d2cdca626d08054eb3570912415481f58c9bc3598ce789a023116577406401e44cc4b4adc1202de261e49d57f79
SSDEEP 1536:jTrlinJ/aDy/CulxWrI0cFpc2blzfnSIkV6MFSRNP6J+FdaOxeXQa41Hye9rGO19:j3lqCulxS0pckdQTS5FBxe541x0cL
TLSH
T1F6B3AFF6DBA68D6D95FFD41CAB82C43EFD266400B3A33409CD63235152C7BB86679608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alauncher-setup-1.8.0-1172-1792344767536.exe

Path C:\Users\Admin\AppData\Local\Temp\alauncher-setup-1.8.0-1172-1792344767536.exe
Size 207KB
SHA256 6877bfe19b3aa965731d57a6b609435b2ddb305ffc58e9989bfeb89bdbca1774
MD5 4695f61de2381008ee60e72c9f95fadc
SHA1 a99981e33db8587c9e44dfdb139f670ecdd6bde6
SHA512 ffeb303830832198c747798278d39236b2346f2c32be574deae5c4425850da607e0e8ecb925a2da54ad7859b07a356bfa5fccb5ad57e1906b75a4c245f519345
SSDEEP 6144:gN8uwip5I3p3S3U323J3D383TZ3k3j0vILWGm:owip5g
TLSH
T1AF24C6804C65CE131DD43FBD78EAAE021E8A53C175B14907BB149A5835F98FE32EB64B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alauncher-setup-1.8.0-4248-1792344755201.exe

Path C:\Users\Admin\AppData\Local\Temp\alauncher-setup-1.8.0-4248-1792344755201.exe
Size 207KB
SHA256 986e48e41cf5455990217db0ae860628b81232623d58b026bb4fe488ca1b7b0a
MD5 ee1461621c86c608954861035942a0fc
SHA1 5b2e629527b0bd09f44a2c43dc5c8d835f038e1e
SHA512 6381278bdbac76d3d8aa189edbd463597cddc074aaba78998530954014377f3559a34cfb7511f3d68626198627f232518ef455dd7813608fd21827e3837b39a5
SSDEEP 6144:AV8uwip5T3p3S3U323m3Y3H3UA3Q3jkvILWGX:gwip57
TLSH
T12E24E9804C75CD172CC53FBD78A6AE021EDA638175B00907BB545A6935F98FE32EB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alauncher-setup-1.8.0-4248-1792344757768.exe

Path C:\Users\Admin\AppData\Local\Temp\alauncher-setup-1.8.0-4248-1792344757768.exe
Size 207KB
SHA256 84e8035aadd708186616d6ea8fde252fcddd642a50f5cd674063e4f7745aa32a
MD5 94cdb13c5ad754614e9ce8ef96654b4e
SHA1 3fec9fa35f02e41137eca8c097d8a323a6dba50b
SHA512 5d202b68f51d692dc79db37fd1b27cd1b2c4f84357713b8ca6fcef0606db4e2ed79b6e50a9552ac86660933b01b4ab86e5ef1a6f84956e939b04a6231566b63b
SSDEEP 6144:J08wwip5C3p3S3U323S303X3qG3M3jkvILWGG:6wip5P
TLSH
T1E424C6804C64CD131DC83FBD78E6AE022E895381B5B14907FB145A6935F99FE72EB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alauncher-setup-1.8.0-4248-1792344759517.exe

Path C:\Users\Admin\AppData\Local\Temp\alauncher-setup-1.8.0-4248-1792344759517.exe
Size 207KB
SHA256 0cd2492ceef468b9def03e9755a9164a019110c6a603cc97813ac02851502409
MD5 3c0af7a28a8a9410ff3423e0649f2df2
SHA1 25ade8e6fcb68bbb5afb8557b93a0762a7250519
SHA512 cd97a29724e32481a720eb8311ad4f0fc71cc5966921b528eaf19bbc4b11604e407ecf1f182905bc13a0cae92aa3a8142cf415dfc68c9b8a57b0eff22ea8e5bd
SSDEEP 6144:DV8rwip5T3p3S3U323L363C39j3q3jkvILWGI:2wip5O
TLSH
T12924E8904C74CE031DD43FBD78A66E021ECA6381B5B54907BB545A5836F98FE32EB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alauncher-setup-1.8.0-4248-1792344761757.exe

Path C:\Users\Admin\AppData\Local\Temp\alauncher-setup-1.8.0-4248-1792344761757.exe
Size 207KB
SHA256 cf58684109d21b9f7c412b61979bd2773cd3e56032808bbdcb2214b83b288ba3
MD5 b6aabfce85c90ae9379e08a6dca3f7fc
SHA1 a6b6147327541bcebe022a4360acc0a3904fb38a
SHA512 8c47728583120be263b5b3138ea4e014359b5c0b8fe3c5e7798aa43172f143222c66c1ffe7d304fd0010f3da98399d9418327f90f568d37bda98c7c4d95c6392
SSDEEP 6144:xY8mwip5T3p3S3U323oF3Q3i3fh3a3jkvILWGg:8wip57
TLSH
T10324D7904C64CD071DD43FBD78A6AE066ECD638175B04907BB189A6835F98FE31EB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9233ac6e070f8eeeb8b343b58a922d47e83b236a73a5b74f690c08a88da41651
MD5 174643e01d2a543d5a486660b2371970
SHA1 7e1e43b4d7cca976320caea2a9f72b70c749f2d2
SHA512 ff851b2266bb7323413f0f95e3e9aa031eb1d36f85353356be07fb9a07fc3e66e5f4a92f9890a3d4bd2f8d8a5c0c6dc47c9fba3662ebe20c8f00ce14f29ac780
SSDEEP 192:51d66JozGzgCl6mc0dxOv5zboTboCyj/v:3d66JozGzgC1jMboTboCyj
TLSH
T123E11FA4EA28863FC045023BCCA91F410F35389B9C5E7F29369D640C2D5B2AD7A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 ed5a83a40c42281f0832d39d6fc6e8e9a736e6fccbe046716725c314278a82c5
MD5 cc13d25d7f5af3ddf1d5d39851cf64d9
SHA1 3261818bffa47813c9d8dbf4f288913acbf8df3a
SHA512 c389188d202ff19878868caa55b9b752938dbd880f377049450d9840ce322ef7f48574a74ea9ae60a1aa81c5208db8b10cb8b4489d54d26e63662a474c529c9b
TLSH
T1FB61D85CF628863FE485423ACC965B412F34745798AE7F2A35ACA14C1E1B3CD7A8D43D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3babb2445417719a92dac3d5803a4d402470ce7ed6b017a1a2246c513272ec16
MD5 b93306b18ba2baf41a36513838dd9aaa
SHA1 94f653ed852e94957da8e107eabc31bfff5a2414
SHA512 f48c103c0b5abdde30d39bcaac117a7e13bc585b862f05bc982ab36e49704d1283d3a474b876c0a41c2b21b9b3d5c0e45734a4a64746a9c9ad007003edbe6be1
SSDEEP 192:dOv5zboPmZoCyj/vU1d66JozGzgCl6mc0d:Sbo+ZoCyj+d66JozGzgC1j
TLSH
T16BE1FEA8EA29863FC405027BDCA61B410F39389A9C4E7F2975DC641C2D572DD3A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7eaec4adab46a0b691923306cd318e5c63d8a4b182eea8258598baccab67aa39
MD5 6fdd5b51f8ef4c3fed4474316d4e6042
SHA1 57840003d49da2d385b8ddae6d8c1fba791f4bd8
SHA512 f175e17453cb19c7ad03876ef6e686ea0b6c6d4bb013431a824daa0b13e1624f349bc31a0d3051a8560a5a15d1e712b52e8376801ec1b5910e8c90d08711b71e
TLSH
T171214C9C3DB84D6A5CC7FAAC7881128E97954E0A49871C474D63EE8DCD816D932FF438
MD5 SHA1 SHA512 TLSH

Submit Download

5d0f7d06-a975-467a-8ec5-df54b265336c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\5d0f7d06-a975-467a-8ec5-df54b265336c
Size 15KB
SHA256 b8f9bce3f8f8f1abcbb6e3c43741cd9192c0c13012ba67852e6ab9f6a87f0f55
MD5 cffe1da675f8e389b8186be25ed65cc0
SHA1 a3992880754ad8bcced9c5a68e846fa7834a80a2
SHA512 3450a4c9eae49d8675ef07688004983da9aaeb056212f986670091fbd33fe392816b7349091a480c5b7e4dd303fd4282394342449beea83af865d18fb64b946b
SSDEEP 192:JBhygFp12uIeoSRg3bzxiR70f991NshGuI/vDrrb/K0MfiFrm4Eje1sxy3:JOgxIRSRibliR70p1/GiFr7N1sxG
TLSH
T1D972DB56283059BA8651E35994FCBFC3E2F528CF4C418FCA9BE4BD085DDE06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62d73140-2692-4815-adea-f0ac4678f2d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\62d73140-2692-4815-adea-f0ac4678f2d5
Size 235B
SHA256 74916f60bf112a386ab215af5387b5312853db8564b63cd0c9c0514d3e4e3fb3
MD5 2ad1644fc4cb37a29e7444e05337f7ba
SHA1 df7d64f1961f1ee5635488b215d72109fa05b399
SHA512 4a6ba7bd09f9b507d7e70614b3f305e6b8b94c22d6d1c9607887d0c0af39351cf4c80aca9d927badbbf38181946d300de3d7248f40d456ebbc3b40874de7b1bd
TLSH
T19FD097801898639C08148F17B4A03CC630448C336074A820F55209788AFEAC94111857
MD5 SHA1 SHA512 TLSH

Submit Download

6472764a-2e07-40e1-b7f5-d7c77c84d0c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\6472764a-2e07-40e1-b7f5-d7c77c84d0c2
Size 2KB
SHA256 268412da0668d2335c21d0172b69007b820846e74e3e344186e6b6d2ca85a777
MD5 0a1eaa62732a79c111877553ba9ab2c5
SHA1 f9c70cb5a32ad4d7ebb6eb64443beaf97952cd19
SHA512 2dcfa634e98e9f63bc1ac846a6781351222c7ff82e9da78d05694a3ec33f9b2eb569c3567cf5e1891d9e87f87b46cb17ea4c39d2b38793c54fce957291ba620c
TLSH
T17041545C75B88D369CCBF14D9192278A53748E5300CA1C437E61EF4C8DA666D33BB42A
MD5 SHA1 SHA512 TLSH

Submit Download

70fdc2d4-5d5c-4ec6-bdfc-53244783b3f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\70fdc2d4-5d5c-4ec6-bdfc-53244783b3f1
Size 886B
SHA256 dfbc690fc758e0f3639d717f2ba42a097a95d09a87731d486fafe1b883893bb5
MD5 a67bf1f8ef7836127adbecd9b2de0548
SHA1 b5873a3a8ed9a9c85863c13bd9be161f63855fce
SHA512 d1ba121ab3cab14b8ab1160d157e4a935c12ebf26a4933365aa359c8d70c0bdb6618380b657786a06a811d46737318a7895c4599701d5eb589e71ad347cad9d3
TLSH
T1371163504921B571DCA9D24BC4F4BB0353F47073C0DA49143EB00B180DBF62E636B607
MD5 SHA1 SHA512 TLSH

Submit Download

d6bab3ea-da88-4e51-a2a7-0cd63921f9c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\d6bab3ea-da88-4e51-a2a7-0cd63921f9c3
Size 235B
SHA256 66dad0460e68fe0c508fd5953345d0afc2c397a49ba328ef4f17914d0f78dcc4
MD5 790e0fff272bb99c0ca069d258c2be0b
SHA1 22726260814abf43c3e2120713af71f3e21978e2
SHA512 f0098db6f765fe165f10488b015da6ede6fabea77ff8bb1291bef42ab3fedf2ba2a697308d3305c42b63027c05cfa4b9b2e0f7e195db7c295723c6549cdd49b7
TLSH
T136D09780648CBB3C08001F12B0A06ACA30458C332468A8308EA184B4C9BDAC48261E1A
MD5 SHA1 SHA512 TLSH

Submit Download

fb9fd6f4-42ea-4e1a-85d2-35944e4debd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\fb9fd6f4-42ea-4e1a-85d2-35944e4debd5
Size 883B
SHA256 1021ba8114e32ddd66b4b69407a1d0b05714626d9812570d28a8fba59b9a0248
MD5 afb4ee13d71d23f50a71bf23a806061a
SHA1 e0851c173bca7f8ff6f5a51c35ac4e02e1bca845
SHA512 6f50b758602ad32801b24cef088d98c3a2ab163799a9c5aa48df1315663878d5bd92bbc927d76414e3134a0dfc0d80beacc06c417be27c0bba111f1295ce4023
TLSH
T18F1123819635B5B2DC69834B84A8770263F47463C0CA41283DB04A180D7FA2DB367687
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs-1.js
Size 6KB
SHA256 360b743a0ac5b11d90d27448bb67e16ba709fd9e1d49abe78a07e3dec9b22848
MD5 f2df0399f98166925f69474c291e37f9
SHA1 9314822720a2bcc09d29d7f75e4258586d2685a8
SHA512 9928feab3737edd8e99e37828248c888412b3472049715e88840c465040ca4431653cc8b549930427df6b1eda06a91ad51a2bdd5e4dabaf52a18dbf89ea8e899
SSDEEP 96:xHlwUTUnqGqEfxNs1zSwSSlSdv9jVXnHRHZlejyiBw88n8L4cnihK:0aREfxNs9SSQ9ZTiBw88k
TLSH
T148E12F789408CB6F75B6776C6C688831AAB2013BBBBF68C750B554C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
Size 6KB
SHA256 c5ec1a0bc806a41e2e5696cd37d42e16bb4bd00d09dd66a8565534e5a1b975f0
MD5 9a64996fd16e7b8f8f33fc99d4ca2b9d
SHA1 0ea2ce6a09ca94c8949b3b1c6e2d4b6e088fe079
SHA512 4ca6f9a0a2397b100539b72a2488f577eea1bfd3fb3cb70718388012cea5014da1f16967922f36e56a1837d7cdbe273b0f1eb8e240cb672334abfddaad1daff8
SSDEEP 96:xHlwUTUnqGqEfxxk1zSMSSlSdv9jVXnHRHZlejyiBw88n8L4cnihK:0aREfxxk1SSQ9ZTiBw88k
TLSH
T14EE12F7890088B7F74B6366C6C688C316AB2013B77BF68C750B954C4015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
Size 6KB
SHA256 413503c78f8ee6d8cf305632828cd317954c577c2671229b0456b692b663f61a
MD5 72a65d2a3fc0e3f02413006768c9bbc4
SHA1 b91ce9f3b5e61979247043c1af853549f802db13
SHA512 19baf49a96446f9f56236592333e2b84fc54ef534bff9de3d72a64e0cc2dc23e89bda31e06088e201369864979e612c4b9f37991130cc2b27fae172b2d6bb13f
SSDEEP 96:xHlwUTUKPqGqEfxNs1zSwSSlSdv9jJeQHnHRHZlejyiBw88n8L4cnihK:0aCREfxNs9SSQPn9ZTiBw88k
TLSH
T177E13F789408CB6F75B6766C6C688C31AAB2023BBBBF68D750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 4c346169dd3caeefcc796000af5618beb55a88a74ae08e5b2df65a79f16b73f4
MD5 8f031fcbbf0283124eaac9b922467d42
SHA1 dd538855634e823a329b1bb29ccae7513a3066c9
SHA512 54f4eca3416d692140647111459584560e43fdd136d088c1c36db45ec142d2a9647deaf8b1ff59c26d364d343c728cccad54b4a4b99fc516c3acc872f3d84c90
TLSH
T18E2128C3110B0DFEBF72C18AEC88CBF8AA67303501AA04F0D9CA8A4162DA059670F12D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 d7ea91da37d23262a75792692be6e22d99d1d70abcec555c46cd44dd9fb71d6a
MD5 2a7b0aca236598e2e060c7d8b36c7c00
SHA1 5fa055663daf1d8b5041e5f01e4361181e2114db
SHA512 8905427b178394cc15e658494d750cc8dc78a9032018e925640ae95f9835063fa378b673382372b1815f1e9fc98828cda4122ef2767ac573cd3c2e67691f28a3
SSDEEP 24576:ixMyD7VRPaQRjujY8K43+3WSbrZyVELgk+7HGplmDiuGI+Kk0k1:ixJK8KjYyAgk+7imDiNQk0k
TLSH
T1D3362AF820D1A257F3414033664593EF21EFD00C6027DA085BE99AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\targeting.snapshot.json
Size 3KB
SHA256 93a1b02d5d62f9d9ece676aa0b19b2ab7b3d344d4c54a1227196ec8948e124bd
MD5 f7d5524f12c00428bf685d9315171da5
SHA1 61ac501d1abacb7aa628f1b38b250610ca5aa216
SHA512 c6524e770b89e2d8818c7b3b6933eb230cd7699ac3d5009e640c5ba46a7df565e0e695d7aeeeede1e133bac1ecece2b912b88e1860bb4a389268e66a3fc8ebe4
TLSH
T15A71930CA61CA4BEA66BC3C0D6447F978BBD153370406458DAFE460C95FB5FB163621B
MD5 SHA1 SHA512 TLSH

Submit Download

ALauncher Setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\ALauncher Setup.exe:Zone.Identifier
Size 271B
SHA256 d77b673854a5eb3393df634c82887d4b08aedaf1b41cc331441b189e5b9a8d79
MD5 5f2bc674c2e3cf79f19b2f03703769d1
SHA1 5aa65107cab404ed39896ad9bb2555ddfef3b8f2
SHA512 d97a9130671f72b94b3f5957ed9d873fde9380d5dc81f46bbe40e58c23d2b22e8d7673e4568874f7453a85684536444066318d4eb4a04ed8400b2ce0b6290eef
TLSH
T1D9D02BBA8A184C0C13D4E2C9058D7409781FA9289C585385BE79828503DA55D30567DF
MD5 SHA1 SHA512 TLSH

Submit Download

ALauncher Setup.ytRQzC3D.exe.part

Path C:\Users\Admin\Downloads\ALauncher Setup.ytRQzC3D.exe.part
Size 1.8MB
SHA256 d778bcfaf1f5a4bd262ac265a5aea74f1bdfc4144c30a833477a7415fc3cb5f7
MD5 76ba3b6213d5cd84d053e9029f8085ff
SHA1 d29033923767a5acd2dd82e4f6f0f65deb73b6fd
SHA512 8eb63fa84b3df6af35eeb0376e2ac448f5e617d83582247363f295b25791e40787ac9e59730d9c440c1fa801114763c32b76f8e7debb592e25c4169cb2785d18
SSDEEP 24576:UY4WKjwUOt5XRYTzYLvWHHJzJUucHKwcdOmdFGFM3VIH06iyAbl7:h4W3t5XRYTzVHpLcHK/9FgYIU6idl7
TLSH
T1C7957C026E8A99E8D19DC874C3478A735A2238CB0A36B9FF11C151193E7EBF55F2D316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads