cd62f379b66b3ab3a877e2a11af49d0200037802c350972301c1842ee41b7b20

Resubmissions

20/10/2026, 23:06

261020-23lbssys8k3

20/10/2026, 23:03

261020-21198sys6n3

Analysis

user interaction
yes
max time kernel
58s
max time network
41s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/10/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
youare.swf
Size 12KB
Sample261020-21198sys6n
SHA256 cd62f379b66b3ab3a877e2a11af49d0200037802c350972301c1842ee41b7b20
MD5 ea1d5719a0d457b49b5d5be974e79e33
SHA1 a8fca896ba2284ed65f62bac06670d58aa689c4d
SHA512 f57617834186af8a425e38d4cbd71f210702c6ce42b993a995ecd87db355784de9ac6ed2f89c68ca63961909e08d9542ec1e4b1f9138e5b2d7963ebefd98d718
SSDEEP 384:VRRPnCY1PD4uJDojYgOhC/AR6hHDwhtUnG:VrBH+YgOh7RgjwhtUnG
TLSH
T16642AE6E6122B2DFCA855620D01752E5DD3783674A3F0A98747CDA481B0309D17EABFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5748	cmd.exe

Checks processor information in registry 2 TTPs 52 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\.swf	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\swf_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\.swf\ = "swf_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\swf_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\swf_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\swf_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\swf_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5776	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	firefox.exe
Token: SeDebugPrivilege	432	firefox.exe
Token: SeDebugPrivilege	432	firefox.exe
Token: SeDebugPrivilege	432	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
5776	OpenWith.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe
432	firefox.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 5336	5776	OpenWith.exe	84
PID 5336 wrote to memory of 432	5336	firefox.exe	85
PID 5336 wrote to memory of 432	5336	firefox.exe	85
PID 432 wrote to memory of 1516	432	firefox.exe	86
PID 432 wrote to memory of 1516	432	firefox.exe	86
PID 432 wrote to memory of 1516	432	firefox.exe	86
PID 432 wrote to memory of 4680	432	firefox.exe	87
PID 432 wrote to memory of 4680	432	firefox.exe	87
PID 432 wrote to memory of 4680	432	firefox.exe	87
PID 432 wrote to memory of 4680	432	firefox.exe	87
PID 432 wrote to memory of 2476	432	firefox.exe	89
PID 432 wrote to memory of 2476	432	firefox.exe	89
PID 432 wrote to memory of 2476	432	firefox.exe	89
PID 432 wrote to memory of 2476	432	firefox.exe	89
PID 432 wrote to memory of 2184	432	firefox.exe	90
PID 432 wrote to memory of 2184	432	firefox.exe	90
PID 432 wrote to memory of 2184	432	firefox.exe	90
PID 432 wrote to memory of 5252	432	firefox.exe	91
PID 432 wrote to memory of 5252	432	firefox.exe	91
PID 432 wrote to memory of 5252	432	firefox.exe	91
PID 432 wrote to memory of 5252	432	firefox.exe	91
PID 432 wrote to memory of 4832	432	firefox.exe	92
PID 432 wrote to memory of 4832	432	firefox.exe	92
PID 432 wrote to memory of 4832	432	firefox.exe	92
PID 432 wrote to memory of 4832	432	firefox.exe	92
PID 432 wrote to memory of 5116	432	firefox.exe	93
PID 432 wrote to memory of 5116	432	firefox.exe	93
PID 432 wrote to memory of 5116	432	firefox.exe	93
PID 432 wrote to memory of 5116	432	firefox.exe	93
PID 432 wrote to memory of 1684	432	firefox.exe	94
PID 432 wrote to memory of 1684	432	firefox.exe	94
PID 432 wrote to memory of 1684	432	firefox.exe	94
PID 432 wrote to memory of 1684	432	firefox.exe	94
PID 432 wrote to memory of 4820	432	firefox.exe	95
PID 432 wrote to memory of 4820	432	firefox.exe	95
PID 432 wrote to memory of 4820	432	firefox.exe	95
PID 432 wrote to memory of 4820	432	firefox.exe	95
PID 4044 wrote to memory of 5304	4044	firefox.exe	97
PID 4044 wrote to memory of 5304	4044	firefox.exe	97
PID 4120 wrote to memory of 6012	4120	firefox.exe	99
PID 4120 wrote to memory of 6012	4120	firefox.exe	99
PID 5300 wrote to memory of 5340	5300	firefox.exe	101
PID 5300 wrote to memory of 5340	5300	firefox.exe	101
PID 1988 wrote to memory of 1372	1988	firefox.exe	103
PID 1988 wrote to memory of 1372	1988	firefox.exe	103
PID 5552 wrote to memory of 5756	5552	firefox.exe	105
PID 5552 wrote to memory of 5756	5552	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\youare.swf
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\youare.swf"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\youare.swf
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {f7983646-7020-4b54-8944-dbfccd67297c} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {7e482c49-12a6-4ccb-93cd-2d0e3e8adfcc} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:4680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27274 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {38ee30c2-9429-4fd3-b92b-419e6f730d8f} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3944 -prefsLen 27274 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 3892 -initialChannelId {a5d99224-d22b-4f40-94eb-0269684c8195} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2184
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1648 -prefsLen 34773 -prefMapHandle 1652 -prefMapSize 270279 -jsInitHandle 1684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2836 -initialChannelId {743a595e-8989-459b-a1f0-59099a3f4e21} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5144 -prefsLen 35010 -prefMapHandle 5148 -prefMapSize 270279 -ipcHandle 5156 -initialChannelId {f6aeb6f8-56c6-44b9-bca2-2238c0de4314} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32900 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {05880720-0411-4056-b056-e41b2358edb5} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {41a28fbe-e730-496d-a5a1-c764aa518838} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1684
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {a93930ca-8581-4c29-a0a9-9a33335ed84a} -parentPid 432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\youare.swf"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\youare.swf
  2⤵
  - Checks processor information in registry
  PID:5304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\youare.swf"
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\youare.swf
  2⤵
  - Checks processor information in registry
  PID:6012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\youare.swf"
1⤵
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\youare.swf
  2⤵
  - Checks processor information in registry
  PID:5340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\youare.swf"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\youare.swf
  2⤵
  - Checks processor information in registry
  PID:1372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\youare.swf"
1⤵
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\youare.swf
  2⤵
  - Checks processor information in registry
  PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\activity-stream.contile.json
Size 4KB
SHA256 2b1e91640fd9bb116ffd36e4b6f3db6ef249868bc76ace0fbbb82bd2133d4e19
MD5 9ba184dc96ad45467c86075a08d59bcd
SHA1 45aa8c6dd9c93e8c4afbd3daf167a9cac5c3397e
SHA512 8129aab14b1d7058e724f0c47c26ad1984e8113c02e931a22161baf4e651abe41d0ff2ead76e479096aa38bbf1075e539f89176f9f57bce496964f4c985b038d
SSDEEP 96:TEYkNMGSjomaMaIydeT+mRpcn4KYCKswq/k6DArOlz:AFM3EvVBxmRpcp3MwAyF
TLSH
T1EB91D85B957884521B71B5E12C4F3AADF047700AEAF1CE58B169DC208A9D7FE80EF9C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 bb0b1bbf4a127257d49be8966bbfe1af4d5e86c6ee1523233c9c0ace0ff7ab29
MD5 6e56f1d3230c3d630d6bf490f60804f6
SHA1 a0a15c6ad9020ec6bebacab68cad0ab95e00ee0a
SHA512 8b8fa21585ee154bcc292878eae4901eb78a9ff71bb885d53eee75ca7836cfb068a18abcf13b032b1dc2a143374326f0bf4316830fbb10cb7051c3d07deb9055
SSDEEP 768:7yPtc80kvrN2WNKlQKKZMyQimdu61EDNLRawXAShr9SJxnRrUb/34C:GPBrbKTimHTcKJxpUD34C
TLSH
T1B87309A396B875FB0B9137CB2C0FB89B66E24149F34502CDECEDC51C90CDA55113A9AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 2fe9a0ae23fedcd2436ae7add86b6ad6828b612a0f30fb078f47efc2c8b024b0
MD5 3f721d3d97269b280abb405aff508ac8
SHA1 dc5d32977792a2da6827c265220ab711bf97c6df
SHA512 a7bc66f20ae3e4cf15c6ef097ee545e0da03b765cc0b977a62ba0ffcae3fdd2a0bb64b793bb70d432184b0b45bad1d9c41ae5472a52704cfdec8df7e7eba27ae
SSDEEP 768:7y5U3bJaw058AgVBibOWM17oHb851x5dfNwrR7m0oAOOr+:G5qc58ACBeOWMyHb0z5dfNImF
TLSH
T1E47309A3E7ECB2BB1B9137CB2C0F7A5766E20145E34506C8FCE9C91C81DE654423A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 c759d75e80de03d5eda21c4c59ad693cfd1a068af07fd75c49a8d6fd31eaf346
MD5 044f9c6b05bef552893a1f4df62127c1
SHA1 85153707bb95c6f3bc937e5cb006e24ffb63f7db
SHA512 18cba74cb1f41459e2f98b03ef91f25577c00610940d3951b46ea7aa8f83e8ec40cf95e1df6796fc16c7871dbb241e1b32362242bde1f170cf5c3ab805101f00
SSDEEP 384:HGNQiO024YrWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAF:mDZYrWTToXJWTTogB7S/AmVAf+hRM4
TLSH
T13E729F7D8F013CAD175780E9C8B583598D18B6EBDFF6C06D12983D09C98896A71F944F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 68e59a659374bb92d6162beefc6092a51e3cea08976dec7154f498d96e6aaeda
MD5 addbaa1a28c746a44c678f795c9c04e6
SHA1 93601bc921695c44c4eace565ffff76beef97ea1
SHA512 b8cd46fcdfeeabdbaff03d654bd09bf1eb92339c5c71ced4da49646a74a874f793365ddcc43533b2c26cc61c8200b1e83d7bd9e2eb9e47f2fff2ad50e537c995
SSDEEP 1536:rTrliS/ufRDXz4bAk7Ndjqcds6c7SsuFq47u2+SkREol6hTVS1H8aMOB/YNs8SBi:r3lRLbAk72wvlsWr+Sk+xqyar8
TLSH
T194B39EF6DBA38D3D64FFD42D6B82C43EFD266404F3A33009C963275061C6BA86676649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rmb9kup0.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 fd38a7404f58393863aa9718f13609664967c9d16eb64eddf560b1b7e29e8346
MD5 c11cac880991f0a08822a60dac26adca
SHA1 5190df657becd068ddac95d5e47788c1334c2a47
SHA512 62da9a528ee7ce397059edce1b77fa39fd1f2dac4061429b55cf4e4d94ce499fe18535211f48ca68df5a55485d3f096667669115ecd0164a72ac6119756d7fa7
SSDEEP 1536:jTrliS/ufRDXz4bAk7Ndjqcds6c7SsuFq47u2+SkREol6hTVS1H8aMOB/YNs8SBH:j3lRLbAk72wvlsWr+Sk+xqyart
TLSH
T13FB3AEF6DBA38D3D64FFD42D6A82C43EFD366404F3A33009C963275061C6BA86676649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\addonStartup.json.lz4
Size 4KB
SHA256 6061f17b69b7c8645065f402e6426cfe1dbc30012188fda61c2505b49a7c86d5
MD5 07763fa5b0cc8756245350a09eb87980
SHA1 f568334a371da0b48fbc900e7f197bf789eec287
SHA512 91092bb7816f615077b95b626286078681f529de3162dff8419ea8895142f1f11c1465ee1a7cbc1eeac042fef4d7d45a60afb901224912cd1990055999913e2e
SSDEEP 96:NQ2X4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NQv52xxhD8rGvm6ApwnHUuhN
TLSH
T1FAA19E7AD141EFB1FE32C04348D93FB2EAAAAB3410A9C4D4F16BB1290C34A735305340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 3d2eda482c53bbab15d0d129b9287eb83101e69d450cb8a433217ca3a81ccf89
MD5 d97392db37b16573cf7f7dac3fd86dc8
SHA1 6889264f61bf3f7a3d06597018088843182aa0a7
SHA512 7ca2c5636300296c5f48bbfee335f1dd1422bd836ab08eec0e82dcbd365c97fada622eb4fff61c1210bfe680aee0572dd63eee829666793e52840658a56fd2e5
SSDEEP 768:piVa7THbGcmhuok3Rd6Si4zbIbObObjBm/:Ma7Tgk3Ei
TLSH
T132D2F044EB2E953FD41812BBDCA50B002F79B88A590D2F673A5C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 27910e40537935bc2679e864d56c011ab5eab0575888b1cfdc3a57fc416aba19
MD5 9a812619872076836a30ad3a4ff21a28
SHA1 d1cfcf041d2f97817eb36fa4f8b0ae40f8db00c8
SHA512 341667348e7eeff93b0c36786922bf2845b11580e8e001a58335d32ffdbb6dba9c52648c543cca726fc0140df2557a36450af3fc5bc2a8f67723106776959ff8
SSDEEP 768:Wa7THbGcmhuok3Rd6Si4zbIbObObj7NQm/:Wa7Tgk3EZ
TLSH
T16AD20044EB2E953FD41812BBDCA50B002F79B88A59192F673A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 be3d4693aea17923c37ae6c0850b87e2bff54e9da0752eae6ad094e740aa30d7
MD5 143d40c33895bcd2f5ebfe443a899298
SHA1 5aa91e1fcaf848f57a7216e7efd628b064dddf89
SHA512 c487585432411e9020b0ef44cde096a52ac82f4dd95e7755001681d59029f44fefeb4df2488ffb095494a8a643fb352a9ddab055bab455bcd3abaf36ae5bf2ad
SSDEEP 768:qxVa7THbGcmhuok3Rd6Si4zbIbObObjBm/:sa7Tgk3Ei
TLSH
T18AD2F044EB2E953FD41812BBDCA50B002F79B88A590D2F673A5C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fe2cd850b676a44cb341e0194eccfd84a447e20aee1e44d01dfe6233cdfb8985
MD5 23e18238dd9d7ab80c93f1d6ac724734
SHA1 72dcd991c3c7b6eac38075f8d0d3d4558d5fb01f
SHA512 9a78930736aafd47540544402291aaa215149736facd43a1e8bf4ab8788fce0f5235a10bd41d67699aae22a89596daa80df04371b0e2fa02116f61df829e49f1
TLSH
T1A6216A4CBDF84D6A5CC7F69C7441028E93558A0B28871E470D02EE8DDCE1DDA31AE439
MD5 SHA1 SHA512 TLSH

Submit Download

25360698-505b-4e37-bd4f-4c13ac3645e8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\25360698-505b-4e37-bd4f-4c13ac3645e8
Size 871B
SHA256 01433ebe6b768915fc846188f78b09bae42371493e1e80026b59b8531d6fa331
MD5 eb1d40bf201848927c92cb1fcb8c085a
SHA1 a823cc73b8bdcc8f3254352f5a0b5fb2dfac1280
SHA512 f1a34d943f915a9f5ec43a656557c8197715e89b49f599d1bbf6db709771a8a8a18a46a814a64e7158bab706e886081d1b1a899bbb72f788ce3f4b011fa2fa2c
TLSH
T118112384C674B5B2DC78D21FC5623B828BB43933C0CA54183DB95D044D7E62EA3A660B
MD5 SHA1 SHA512 TLSH

Submit Download

55a9fe2a-fa34-4389-aac0-6b5d8fa43b83

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\55a9fe2a-fa34-4389-aac0-6b5d8fa43b83
Size 2KB
SHA256 4c696e48f940ab1eda37477fa32c523644778b35800ca915fbbdc924654f2492
MD5 20352e789625fa7ce6131a76f7cde8ee
SHA1 d1d841bea0dbfc4cf16fa879377fe1b0c66d3d82
SHA512 b29aede8486e27c18beceed79409e149ee77aca51cc1ccc53a332a101dce688e40cfb47ce7cca6bee0b5357cb2a5278b3140db158bd14d517c1013cf71940690
TLSH
T16041205C76FC4C76988BF15C819233CE57608E13408628936D92EE4CCDA67AE737A42B
MD5 SHA1 SHA512 TLSH

Submit Download

9e526b1c-3c3b-4bae-a2ea-9225c3dc82a1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\9e526b1c-3c3b-4bae-a2ea-9225c3dc82a1
Size 886B
SHA256 248b73e57cb6d13ae274ab6a46fc51b388ee7e9928ae101f2fd257c27840629e
MD5 7633a692cfaf3cd0c41d8aa9c23a5346
SHA1 d68c947901a4d001061562eba6124a47b14a0e43
SHA512 d66ace52e6f07693689d84291fcce926d1f5e285b2b3dbeb232a63d0ce3b86557214feb269c7f9d8f8259418d1a5480e6fec6fc81acc4ca9e441575808d6ce7c
TLSH
T1B3110480C674B5B2C878A25BC5917B834AE07933C0CA181C3D659A184CAF62EA3A7607
MD5 SHA1 SHA512 TLSH

Submit Download

b164564e-433e-4557-9f2a-4d271dc3b6ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\b164564e-433e-4557-9f2a-4d271dc3b6ee
Size 235B
SHA256 1001f9575e8020e550c44378457f595afe1af9c728eec923d88ac2814c36e0b2
MD5 62f227145cb5eac56cfe9ab18a693eff
SHA1 cd7e94e93413decf5d3ef337f90b40619565a972
SHA512 1cfe0215bab024a6a0909eb3954d3b9a47b35fac11068c4a42d930a0b1f5d67ebc247ff5da4fb09e7aabafa982534358cacfec5e7ad1294210425c1c3572eaa8
TLSH
T1C5D0A7C85898676D4C184F16B0A069C63448CC3314F5A850A9A1457899BDAC841A691A
MD5 SHA1 SHA512 TLSH

Submit Download

f8ea075b-f21a-408e-b188-d9cd6ec8987d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\datareporting\glean\pending_pings\f8ea075b-f21a-408e-b188-d9cd6ec8987d
Size 235B
SHA256 78d7ef1e3c10490ab96893b0f77dbc32dbbcab29db4d69644dfedc0337491681
MD5 500ea70050bb110f23cc562fe906ff3d
SHA1 b6e48bb686265eb9e689352a2895e1dec3e5aa02
SHA512 fb439c9244da00fe00143d5f700ffe0e4fadeda425912a91a8309ea30a965d39787fa9bc10731df2ad1b76f545ad3807d12dbe13551af111a623a5c042317ef8
TLSH
T19CD0A7841898777D08255F4BF1A169C631864D376CB8A8209A5146759DB9EC88262C16
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\extensions.json
Size 14KB
SHA256 395e2ef398ed185d767d14c0a5533caf592c025610e49fb3698701ac4453e160
MD5 c9d8c3f0534c1c7b0cdc0686e3daab50
SHA1 b12cd59e1c69fd8ae7f7c4f646d82610ac8fefe3
SHA512 bcaf3750fadffd231b3c2d21e8789537315c1ec9d68ddf1a2f2cebff33dadcbc52df85c2e1fe15de88960c3d43eb90af4e92418cd3dea82bd903ae16033fa2fb
SSDEEP 384:iBkI4vsUmldvu8dhWj94zF96oI5L4HFL4P6nL4H/L4H8L4HC:9I4URfjXG4H6Dx4F4CL4D424i
TLSH
T1E962422545049EB8294FA79AAA367D01C37D473B70445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs-1.js
Size 7KB
SHA256 53425587b2dfcdb494c2ea01a5799ba6a47e3f0748f9a0948cfa3b6e61a6e1ef
MD5 a7ce1a76c409633596298584ffadc6c5
SHA1 9058661d8adc7581d10d0b781946357d2ffa0445
SHA512 a07a10c3a8b39009d78c29e4a3c8ce83297b036ce303256f02db07ec356aa9df98f87c7a75c3f1264a833350a41fece0941047da512b0d6584ba9f8f5227f446
SSDEEP 192:AloJMYgYeCRYxfqZhD8GeSSy9A6tiBw88tUoQ:8oJMYg7yzA6tww9G
TLSH
T104F10D789044CF7F64B6367CAC2489315AA2013BBBBF68D750B994C5055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs-1.js
Size 6KB
SHA256 144735bcfc9f8bec3d4d62847dafcde5bf1d56b28048827aab2cca8958a45537
MD5 75332136d223a15bfceae18d45323840
SHA1 38a07232026710cf85fcd6be37285cdd7a4948e7
SHA512 22021bcc62cdb7c16af7b8c7ca7e6b3a93f614d7f8d8f2589c4eaa3c3c1afe09428aa0e874a885539cafe00d3d4956845c072020e9f09b1115c6eead85c8be37
SSDEEP 96:xHiUTUJbqGqYxfnhD81zSYeSSlcdv9jCnuRHUuFhBw88H8L4cnAzlQ:A52RYxfnhD8teSSy9d/Bw88LQ
TLSH
T110E12F7894088B7F64B677ACAC6488316AB2013BB7BF28D750B55485045CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 6KB
SHA256 e1a19554a7191d851eb8ae2bd5cb21e39dc770b414653ca65a8efea2e2eb202f
MD5 dad7c5de06a3585ff3e82ba16c543d39
SHA1 2b0ef3e0a745b5ee7df299d5496c6fa97a1699d5
SHA512 a06fd2271e9d0b79685775774216900ec0de6947131f226b6dbd9c1f54b2ea0f2a4eae35b2072544128c7d40e8cc3a4101fefddb98c78c8eade92c083960d1b2
SSDEEP 96:xHiUTUJbqGqYxfneF1zS7NSSlcdv9jznuRHUuFhBw88H8L4cnAzlQ:A52RYxfneFONSSx9d/Bw88LQ
TLSH
T182E14F789148CB7F64B677BCAC6488316AB2013BB7BF28D750B95485051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 7KB
SHA256 46f6eadd333029489302256778a4067bbd74de9163516b91a9b0f0f03c9d157a
MD5 1383bbc0af6801390837f9c5a19145a2
SHA1 479114a37e821098cde809eae92fb2c3a8f5ee5e
SHA512 75be963ce84ace07081ffcfb25010b55701bd7d9d46feec091f2acc78467607a37df2a0da947ad72f588db5cbc3b53f4acaeaf4122d065b7c0474525d479f5cb
SSDEEP 192:AloJMYgYeCRYxfnhD8GeSSy9d/Bw88uoQ:8oJMYg7Rd5wE
TLSH
T137F11D789048CF7F64B6367CAC64883159B2013BBBBF68D650B954C5055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 6KB
SHA256 6bff2cb649a67653ebc06737a9163cffd6ea0f31a2959b25ac1a2f1f790f1e70
MD5 a824cd8c93914971f7e36fa1b52c5ee4
SHA1 1482ffac940ad79a5768aa41959d2ef9b3dce5fc
SHA512 d8bc8c36baa9d27eabca61e6afd91a2a36d05584395c50ab13a3f7b0d07f671c5a8d85ece987078e2d417b968aac05a987d1171a004e7b29d233e2dd6880a5b3
SSDEEP 96:xHiUTUJePqGqYxfnhD8ObzSYeSSlcdv9jCnuRHUuFhBw88H8L4cnAzlQ:A5eCRYxfnhD8GeSSy9d/Bw88LQ
TLSH
T1E9E12E7895088B7F64B6767CAC6488316AB2013BB7BF28D750B594C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\prefs.js
Size 6KB
SHA256 365f5878820c70affd69eee91dee725603a3b8185c7c1c64b6415821b0e51d0c
MD5 7f1fa80ef5cfa2eaaa8ce635c3c80c7e
SHA1 fcac3e56abae44f72b3ec3ee0975fd49e0b6cedc
SHA512 153ead34bcaea83ea253d0ec963b887717b981fc495066d39537fed2f3fbb363dd550f8ab014cd3a95694e1c06218d89d48aba4e2b4e17ba74613e244e0cfa33
SSDEEP 96:xHiUTUJePqGqYxfnhD81zSYeSSlcdv9jCnuRHUuFhBw88H8L4cnAzlQ:A5eCRYxfnhD8teSSy9d/Bw88LQ
TLSH
T1F6E12F7895088B7F64B6777C6C648C316AB2013BB7BF28D750B55485045CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 a89044bfc842ac9debdaa93af7626293ba0d1e217e482ffed4d5a1705ca5bff6
MD5 f79c577e1943b66565737ef23534db6d
SHA1 7881b023587fbfd5b9b2e92a297af02c5f30b9ee
SHA512 fc8f802b05dd35dbc33959774d2d5890e576f872d8667fbdf1b7959ad03ba3ac8a922f83c8e9baf1650e43dde631b79a336f467e1fef98998dfbcd0a6415fa11
TLSH
T1F22108A798AB2EF57B251299B0C82FF58764343249740CE0C0AE4FC022DD98C72C831D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 e0820c8b84bf68c9887715ba02b601e4137252d93c3fa9b30c20dc68e2236838
MD5 bdc67cd6c0448c051fec160677945473
SHA1 baaf8197ba084fbe5b5675a64a98713e0cb12ee9
SHA512 1b4dbb3e62668a331ce13b9137f93af7cc65bac951cbf8cfa7abfebb467fde54f9f1d1b2b9d8c53e6d160fa8e21c504e6e404f37a4cb9b74acc92e92c60034e0
TLSH
T1E521D557ECA60EF53E655159B0C44BF0D7692120857268F08489CA8872DEA89BBC510E
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 66f68f7607245bc72886eb00c49177297e1e37fc1fbe09027834952dc3deb4ff
MD5 b5292da50f8d4e08db2593c96ffea5d3
SHA1 c97555305311e7ef87a17ebea4f6bab1ef49730a
SHA512 cbbfddace01e79cc656212877a679b7c715c458631b9e1f1523d78780334316106d4b688e69eb5c86ce3729d203358e81c0cb655e2e7999e5f7dc4a0a96b2c0f
TLSH
T183413BD358E72DF9FE2C2694B1545BF897E93521C97298F0C06ECB4421C9D4C35DA329
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 551175480a00bcfa02d07d5dee8e8f0d2d416ab8fbc5bc646448d8b3f5dab9ce
MD5 9de8780ba1c6c5f3b807ef483c94f2c3
SHA1 0e8db4407bde81bfed6fc76645fc7fcd153a4271
SHA512 fc3d00b21beb443f26428cf5436040276eaa0f9addd442a8fef47e274da2ac42015edadec442811f8a9171759e6a4d169bc92108287d96e0f269d69bcb150293
SSDEEP 24576:jNJwu7DmsTOPjPh5YoMkhjQbDQWsP3QPhTSxK9Z15P7UBqspAhe3QNok:jNx/kDbYQhp0SxmT5P75zhsqo
TLSH
T1C4362AF820D1A257F3414033764593EF21EFD00C6027DA085BA99AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\targeting.snapshot.json
Size 3KB
SHA256 6caecaa3aabf106772414ceb888db08903be711c3207e746e75dd90b55e6169b
MD5 d8a980fbc543af873ed9af23ac994417
SHA1 ebcec3ddb71bc8c1f95b0bfc78e30cc282bbfb39
SHA512 0d7853660eac1c6d8b7381ceea37c679180d33605ee3c37b89ebd76e96c917cb0c504a42c9a796e31cb5266301b4a0d1bdd8a7364bd7f17bd0cd0c52a3a6cdf4
TLSH
T18271820CA61CA4BEA66BC3C0E684BF978BBD053370447458DAFE460C95FB5FB122611B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rmb9kup0.default-release\xulstore.json
Size 138B
SHA256 a02e97cea0637af9194a127b910c439eeecfff4c1b1ee384bee600b8afc5f088
MD5 799f594f01d16a72a8e09285553b5173
SHA1 5fd2f9cc03519d5641c2e1b9a02f09abff5f9e19
SHA512 d0d83a3d75448d3ffb1166a2d33c208f95531fbf3e24efe08fb408c6e6e37a3665a75d6f4daa74c4e5fa655127da16fb8cfdc726af5328988fddb21f720f2a38
TLSH
T11AC02BB0229FE8087F178FCF024D23843E29851081C012667BC214A0008430F4C1C308
MD5 SHA1 SHA512 TLSH

Submit Download

KkLuelws.swf.part

Path C:\Users\Admin\Downloads\KkLuelws.swf.part
Size 12KB
SHA256 cd62f379b66b3ab3a877e2a11af49d0200037802c350972301c1842ee41b7b20
MD5 ea1d5719a0d457b49b5d5be974e79e33
SHA1 a8fca896ba2284ed65f62bac06670d58aa689c4d
SHA512 f57617834186af8a425e38d4cbd71f210702c6ce42b993a995ecd87db355784de9ac6ed2f89c68ca63961909e08d9542ec1e4b1f9138e5b2d7963ebefd98d718
SSDEEP 384:VRRPnCY1PD4uJDojYgOhC/AR6hHDwhtUnG:VrBH+YgOh7RgjwhtUnG
TLSH
T16642AE6E6122B2DFCA855620D01752E5DD3783674A3F0A98747CDA481B0309D17EABFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads