9850a2fc558ab63457df4113f2f3dee935ad4f258f9df6891d326a0d8c43b0f3

Resubmissions

16/04/2026, 02:05

260416-ch2evad16q3

16/04/2026, 02:04

260416-chntrad16m1

16/04/2026, 02:03

260416-cgxp9sd14p1

Analysis

user interaction
yes
max time kernel
898s
max time network
671s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SafeLauncher.bat
Size 2KB
Sample260416-ch2evad16q
SHA256 9850a2fc558ab63457df4113f2f3dee935ad4f258f9df6891d326a0d8c43b0f3
MD5 c0f47071ea7fd26bc0ad2b881a9f66b1
SHA1 357b8de68ffc13616b3b0bfde7ec66a18de3c2f8
SHA512 5a9d049802f77aa1b4bc104b46c2a1d9e36fbc12eaa2744bf696b4db96a59d041d406890d5ead04c10c2b4d8f173d62eedd8e68802835d1501f9363e6e39c414
TLSH
T19751CEA3BC3318742B6E0B0E02CE53B59B28B846705DE59438786419539BFF4CB27D6A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	firefox.exe
Token: SeDebugPrivilege	4212	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe
4212	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4212	firefox.exe
5232	AcroRd32.exe
5232	AcroRd32.exe
5232	AcroRd32.exe
5232	AcroRd32.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4212	2832	firefox.exe	83
PID 2832 wrote to memory of 4212	2832	firefox.exe	83
PID 4212 wrote to memory of 5456	4212	firefox.exe	84
PID 4212 wrote to memory of 5456	4212	firefox.exe	84
PID 4212 wrote to memory of 5456	4212	firefox.exe	84
PID 4212 wrote to memory of 3908	4212	firefox.exe	85
PID 4212 wrote to memory of 3908	4212	firefox.exe	85
PID 4212 wrote to memory of 3908	4212	firefox.exe	85
PID 4212 wrote to memory of 3908	4212	firefox.exe	85
PID 4212 wrote to memory of 2688	4212	firefox.exe	86
PID 4212 wrote to memory of 2688	4212	firefox.exe	86
PID 4212 wrote to memory of 2688	4212	firefox.exe	86
PID 4212 wrote to memory of 2688	4212	firefox.exe	86
PID 4212 wrote to memory of 800	4212	firefox.exe	87
PID 4212 wrote to memory of 800	4212	firefox.exe	87
PID 4212 wrote to memory of 800	4212	firefox.exe	87
PID 4212 wrote to memory of 780	4212	firefox.exe	88
PID 4212 wrote to memory of 780	4212	firefox.exe	88
PID 4212 wrote to memory of 780	4212	firefox.exe	88
PID 4212 wrote to memory of 780	4212	firefox.exe	88
PID 4212 wrote to memory of 5868	4212	firefox.exe	89
PID 4212 wrote to memory of 5868	4212	firefox.exe	89
PID 4212 wrote to memory of 5868	4212	firefox.exe	89
PID 4212 wrote to memory of 5868	4212	firefox.exe	89
PID 4212 wrote to memory of 4156	4212	firefox.exe	90
PID 4212 wrote to memory of 4156	4212	firefox.exe	90
PID 4212 wrote to memory of 4156	4212	firefox.exe	90
PID 4212 wrote to memory of 4156	4212	firefox.exe	90
PID 4212 wrote to memory of 408	4212	firefox.exe	91
PID 4212 wrote to memory of 408	4212	firefox.exe	91
PID 4212 wrote to memory of 408	4212	firefox.exe	91
PID 4212 wrote to memory of 408	4212	firefox.exe	91
PID 4212 wrote to memory of 1488	4212	firefox.exe	92
PID 4212 wrote to memory of 1488	4212	firefox.exe	92
PID 4212 wrote to memory of 1488	4212	firefox.exe	92
PID 4212 wrote to memory of 1488	4212	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SafeLauncher.bat"
1⤵
PID:4292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3264

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {37900dbc-7ae8-4a79-b557-f443c762febe} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27133 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {50e12845-6ada-4c4c-88e9-2c4440cfa151} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27274 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {f6e55113-b238-42b7-9782-8b6ede588d89} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27274 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {47e17828-5d70-4445-afea-227a176d6a89} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3068 -prefsLen 34773 -prefMapHandle 3196 -prefMapSize 270279 -jsInitHandle 3200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3040 -initialChannelId {baf44f1a-b941-4f11-9c55-96606818268f} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4900 -prefsLen 34822 -prefMapHandle 4904 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {c3eadea5-fc45-44a2-a57b-796a05589f4a} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4864 -prefsLen 32952 -prefMapHandle 4868 -prefMapSize 270279 -jsInitHandle 4872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2732 -initialChannelId {1c9351ae-2e11-4c3b-b948-f9b50dc933be} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {8329169f-2630-419b-a07d-114c67ace284} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 32952 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {4cf8b5fc-57c3-4dd4-8e96-7bed4e8b3f29} -parentPid 4212 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4212" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1488

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 c3f13eae04f6d9a847bd7087c5546536cf833baf66c85fae1a2f2f8d54e8661c
MD5 b11dc9dcb1440386f4392964d4cd162c
SHA1 83415b62a1bf00cb0eff9c48c6e07dd0f1b3d2c4
SHA512 186824bd4246ec85be730a8ddcfffd3ca4aded67f4bb9d0fe71e5015c0b5c83b41b14d4a70f7d03c32a74dd348f622ca22c16b53eba032b8703c18d1e8dd166c
SSDEEP 768:nC4YIvljGcmhu/2RJH7iHubpb5bPb8Dmpm/:nC4Yq2ul
TLSH
T128D2E044EB2E953FD41512BBDCA55B002F78B88A58192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 4a2ba712ef2a7f378a3af9c568ff097ed3d3ba198c7ca586f61b55d32a18adc3
MD5 9cf3d540b5d3f468ef8cea9d3435ce38
SHA1 2523424cd176727a0edebe527b33d14ddbf219ea
SHA512 84909bfbfa784c78187dbfee788c3024f824e12f59b34f411dd4c16c8d431f94f50c06f7cec1e2ac53e00c33eff0873546b06e8a2f2821f1f5ee50e0c78ba1a2
SSDEEP 768:nC4YIvljGcmhu/2RJH7iHubpb5bPb8+1dm/:nC4Yq2uj
TLSH
T1B1E2F244EB2E953FD41512BBDCA55B042F78B88A98092FA73A4C646C6C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 edceae39dc78fe63f6dac7ca62ccc4ab8e2925d431e019b5ae21d4d90e7bc52a
MD5 193b34fc8b0b6a70ddb33c9bb2353899
SHA1 b870da8345055f900949dd2bada67ea17fa7b5e4
SHA512 2c3646bd00e48b6082c29ce99bde1c790f8071ba345b1de67cea960bf552d14d96110b93bcb325487de75d4a2094c4c4f83207a4b9aa36b7a61b48fa97256082
SSDEEP 768:a5SC4YIvljGcmhu/2RJH7iHubpb5bPb8Rm/:PC4Yq2uS
TLSH
T1A3E2F244EB2E953FD41512BBDCA55B042F78B88A98092FA73A4C646C6C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d529086acc86ee46d474a268b7299a25950d50841587fc90c1df0f488efa58d6
MD5 ac83910b7fa4f38b41641c685305733c
SHA1 7ae083bcda0e86239705f1fa85392cdaf2eef2c4
SHA512 62563b75d6c35de5fbe3e9f04a1ccbfe396017d1ea1376c157a8ae80177acb6d6255b7508602026fc3b3de41fb4f9761138d618ef0d4baddf3ee76eafc113924
TLSH
T16B217C4C39B84DAAADCBFAAC7451128E53254E0A14C71C431E02DE8EDD95FD932AE839
MD5 SHA1 SHA512 TLSH

Submit Download

01ba954e-44d9-4709-9659-2b49359d0d64

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\01ba954e-44d9-4709-9659-2b49359d0d64
Size 235B
SHA256 57f3cf13cd10cad26fdc92bfec89fc53848f43d3e47ceda2617db095b55b7e32
MD5 6eca82a75b12648fe44fd8bd7cee7029
SHA1 bdecef23132466d971cae25aae95aa9445eb2e92
SHA512 d6888b49c790eaf7237c25c1ecdc18464588131a033485af59abe4b71ffcb2d711d2962016a0347cdc849c526a760d455e6961ac38ba8bddc8e07997e5707bf3
TLSH
T1D9D0A7C164E8676D0D240F07F5B469D630948C332CAAA860DA568574AAB9BC95262D17
MD5 SHA1 SHA512 TLSH

Submit Download

18e9810f-44c8-4872-8c7a-3508277efda6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\18e9810f-44c8-4872-8c7a-3508277efda6
Size 2KB
SHA256 e8acd2a4abe6745ea55d225a003d4cbd2992cd21ddbae9ab6ba6e8c99dc076ed
MD5 7f26c6b4d3f0fcc40e73aa23a37fc735
SHA1 8ec048cc38c77b4e6a1da151eec7778284292108
SHA512 bed0fedc298905c0b857725a9bb830c9ed0303d5e3561cd2fa83a44ca3dd4ea292d8fb651f3e9b5ca9ae4bde5cf46334ae2d277e8f826fb4d7bdec07b235a866
TLSH
T16241115C3578AC7F5CDAF55D9492338E53A09A0300C61D832F91DF0C8DA66EA736A53B
MD5 SHA1 SHA512 TLSH

Submit Download

6a8a6f6c-a896-4fc6-894b-49f1ebce8080

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\6a8a6f6c-a896-4fc6-894b-49f1ebce8080
Size 871B
SHA256 ace40c9cb5d0bd07a0ddf140cb8574c64a6e168ce6ea690c7697e42113fc1b76
MD5 7ab3b3d0a6b1324f7d7a4b6a5beacddc
SHA1 fdec16ca9da010b8aaa16b2e3eee30fca094504c
SHA512 97e6568294b95a800205f2e29c77ba1fa8b5267226c351f6fb5faa392ab3bc04897ff2414a1a15e5fa1e8adb91f800d5df073eed348a3b1a89135271417d38ab
TLSH
T10011004096307AF2DD78D34B85A23B169FE4B523C0C608183FA55E080E7E22AA76A707
MD5 SHA1 SHA512 TLSH

Submit Download

6a996f5b-d8de-4701-8b72-28fc2e429955

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\6a996f5b-d8de-4701-8b72-28fc2e429955
Size 886B
SHA256 c881524d60e2ce91570c4ae5a29479d06d71686308534b33168db85873f12ab8
MD5 30129916038c8e7371bedde4793ce334
SHA1 300e1cec99c4a219957a4a7a35d4d4cdf7c1c9d4
SHA512 f183314191bdb7edaf08485061a9dfb69706b0ea3d423d3021530a1acdb28937da02953a13656dd7994277667149e7bc3ec7cd9c4f10cf9533eb63b8486d761c
TLSH
T192110440893579F28D68D38B84A17B534BD47533C0C949183EA55E1C0EAA12BB31AB17
MD5 SHA1 SHA512 TLSH

Submit Download

aa0b43d7-c83e-480c-bdef-e81ae65706a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\aa0b43d7-c83e-480c-bdef-e81ae65706a9
Size 235B
SHA256 9dafdd4ff24771ef2152bdeaa89491a6559b3c88531b7994180c18bfb96aa393
MD5 296056f0ac77d5f009488c9b63fee0ec
SHA1 0d2a1ef206fb79519470f933f5058b226a71e0ae
SHA512 1891039569995629407eca1e6038f1e3bcb6b122b4e6f998b0f6fcdc98b7816c253c7b510bad802fbdfb7f624316c2d8329ed1c99c4a8bcaf4332457403bc7dc
TLSH
T15FD097801488233E0C000F06F0B068C2B8488C332568F820D9538134DDFEAC84192816
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 6KB
SHA256 4d100f8e0f2816309c7b5559a5ecb964e838990d7d61d92aa354f9de5bdd045c
MD5 406d4e137cad9374a36534253d293b13
SHA1 d8a5c82c8809a0ecead736abaea6c72694e30637
SHA512 530575209cf0fd7823098450215a2b7d602f19c4d464dd36995717cdbd12aabea616da0e961203f5e30f890f955274b873b219a35a7b8c8ddb02e7c06d1a10fe
SSDEEP 96:xHiUTUAPqGqcUfCj22ObzSNSSlrdv9jA4nHHCriDYzMgBw8OH8L4cnHVGkGS:UwCRvfCj22nSS6oCaYzMgBw8Oq3
TLSH
T139E11E7890088B7F74B67B6CAC6888316AB2413BBBBF68C310B954C4051CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 4da1f792dacde61b00d9e5bb5c5f3bab52448d9e1900c02cab216b30a7fc8fd3
MD5 fdde983c9b93fc17e797e607c35df6e3
SHA1 3fc395225e583bbfb3b4f1b07ab0757a116b52d7
SHA512 ceff4532f3e3ceae79ec863c31dfe99000638e1167335dd8ed5f3bed5bac56387f097e2dd72b538de0a3c68ee932455b8adb36e325e5e6ec78c1935c6ddd123b
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zS/GSSlrdv9jGnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNgvSSACaYzMgBw88qL
TLSH
T152E11E7894088F7F74B6776CAC6888316AB2413BB7BF68D710B95484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 22006649f1463ba5ba65f683520b344286e0844a07f790c807680a6a27621727
MD5 cf5f963f2d2b23196381f8eb3933987f
SHA1 5821b57d986b70eb8f8d1f9a8327023006db958f
SHA512 cf3187a6e6bb32d074bbc8cc068b28a6d208e22a0619a98b518c3e6113e67487b104d7871a043d65230d5b9b592a21a3c501c984431e19a4d45d100a98885376
SSDEEP 96:xHiUTUAPqGqcUfCj221zSNSSlrdv9jA4nHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCj22ISS6oCaYzMgBw88qL
TLSH
T160E12F7894088B7F74B6776CAC6888316AB2413BB7BF68C710B954C5055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 4a7e5df15b971c39255881d7ebf7b94172f2aea1c05c81bb01f15b8d076ab74e
MD5 d8860c7548e34159a6d47293ef3c3c6e
SHA1 9243dee0263bf5c27d83065ef6ac03c75dd136b4
SHA512 c12e02908798bc9d36cebb834733eef93a9f632a97b9c4262e6f8e177b4aa762d615b0b55b05909d82146fa56b47238254746f53dc6500d58818270660e26942
SSDEEP 24576:rCWk+tIYI0Lgrb63BDcYrVQpa9dfH9EQ8lQyjH:rjv7LO6pcYrVEa9d/9EQ+Qyj
TLSH
T168F52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5232-387-0x00000000016A0000-0x000000000173C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads