hxxps://66[.]36[.]109[.]208[.]host[.]secureserver[.]net/Y19PllgxvrHkK/DxHVxQAkxuApP6Y4/0ays/50669909/ALS3oT5lDAONrKx5yo2/650657525037__

Resubmissions

17/04/2026, 17:06

260417-vmfcaagz3v6

17/04/2026, 17:00

260417-vh7kzagy411

17/04/2026, 16:56

260417-vf35rsdz3r1

Analysis

geolocation tags

brbrazilsouth-america
user interaction
yes
max time kernel
299s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://66.36.109.208.host.secureserver.net/Y19PllgxvrHkK/DxHVxQAkxuApP6Y4/0ays/50669909/ALS3oT5lDAONrKx5yo2/650657525037__
Sample260417-vmfcaagz3v

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\android-studio-2024.1.2.12-mac.dmg:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5408	firefox.exe
Token: SeDebugPrivilege	5408	firefox.exe
Token: SeDebugPrivilege	5408	firefox.exe
Token: SeDebugPrivilege	5408	firefox.exe
Token: SeDebugPrivilege	5408	firefox.exe
Token: SeDebugPrivilege	5408	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
5408	firefox.exe
4420	OpenWith.exe
4420	OpenWith.exe
4420	OpenWith.exe
4420	OpenWith.exe
4420	OpenWith.exe
4420	OpenWith.exe
4420	OpenWith.exe
4420	OpenWith.exe
4420	OpenWith.exe
5460	OpenWith.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 5408	5396	firefox.exe	86
PID 5396 wrote to memory of 5408	5396	firefox.exe	86
PID 5408 wrote to memory of 4840	5408	firefox.exe	87
PID 5408 wrote to memory of 4840	5408	firefox.exe	87
PID 5408 wrote to memory of 4840	5408	firefox.exe	87
PID 5408 wrote to memory of 6080	5408	firefox.exe	88
PID 5408 wrote to memory of 6080	5408	firefox.exe	88
PID 5408 wrote to memory of 6080	5408	firefox.exe	88
PID 5408 wrote to memory of 6080	5408	firefox.exe	88
PID 5408 wrote to memory of 2096	5408	firefox.exe	89
PID 5408 wrote to memory of 2096	5408	firefox.exe	89
PID 5408 wrote to memory of 2096	5408	firefox.exe	89
PID 5408 wrote to memory of 2096	5408	firefox.exe	89
PID 5408 wrote to memory of 6116	5408	firefox.exe	90
PID 5408 wrote to memory of 6116	5408	firefox.exe	90
PID 5408 wrote to memory of 6116	5408	firefox.exe	90
PID 5408 wrote to memory of 5160	5408	firefox.exe	91
PID 5408 wrote to memory of 5160	5408	firefox.exe	91
PID 5408 wrote to memory of 5160	5408	firefox.exe	91
PID 5408 wrote to memory of 5160	5408	firefox.exe	91
PID 5408 wrote to memory of 5980	5408	firefox.exe	92
PID 5408 wrote to memory of 5980	5408	firefox.exe	92
PID 5408 wrote to memory of 5980	5408	firefox.exe	92
PID 5408 wrote to memory of 5980	5408	firefox.exe	92
PID 5408 wrote to memory of 2620	5408	firefox.exe	93
PID 5408 wrote to memory of 2620	5408	firefox.exe	93
PID 5408 wrote to memory of 2620	5408	firefox.exe	93
PID 5408 wrote to memory of 2620	5408	firefox.exe	93
PID 5408 wrote to memory of 396	5408	firefox.exe	94
PID 5408 wrote to memory of 396	5408	firefox.exe	94
PID 5408 wrote to memory of 396	5408	firefox.exe	94
PID 5408 wrote to memory of 396	5408	firefox.exe	94
PID 5408 wrote to memory of 412	5408	firefox.exe	95
PID 5408 wrote to memory of 412	5408	firefox.exe	95
PID 5408 wrote to memory of 412	5408	firefox.exe	95
PID 5408 wrote to memory of 412	5408	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://66.36.109.208.host.secureserver.net/Y19PllgxvrHkK/DxHVxQAkxuApP6Y4/0ays/50669909/ALS3oT5lDAONrKx5yo2/650657525037__"
1⤵
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://66.36.109.208.host.secureserver.net/Y19PllgxvrHkK/DxHVxQAkxuApP6Y4/0ays/50669909/ALS3oT5lDAONrKx5yo2/650657525037__
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {f9920378-0e26-456d-8d11-f78f2755b9b2} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {45b1c498-4343-4ce3-8e14-3d8188cc517c} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3696 -prefsLen 25164 -prefMapHandle 3700 -prefMapSize 270279 -jsInitHandle 3704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3712 -initialChannelId {28567eab-e125-4c76-a766-df30bd13b9a1} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3864 -prefsLen 27276 -prefMapHandle 3868 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {6ca661b6-cba4-4fd8-8469-2b8b55ed1de1} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2832 -prefsLen 34775 -prefMapHandle 2836 -prefMapSize 270279 -jsInitHandle 2844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4440 -initialChannelId {16c4f8ab-dc8d-469a-add0-43b04c5407bd} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5016 -prefsLen 34905 -prefMapHandle 5020 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {a2f9dad7-8580-4253-aad1-78e309fce5a6} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {c29436e0-08e3-4fbc-8e3b-3d0dd74c9335} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {0cb79e00-ab5c-4732-8bf2-46ac61f447c2} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {f4c06b60-5deb-4321-919f-a61035df2bb2} -parentPid 5408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 89c592ec773c6059093d13307cc51740475133d449eeafeba34732f07acd5670
MD5 d9a783519b848111547c1a4881aca285
SHA1 9c8f4b5102a0956dcb930c79ed4a18a600fb2e14
SHA512 9dfb12b7debe77ca22024f86f1dc4d22c448a4022884033c8a133e71c41c4fd7abffc4a91c09af713bee42d392e0eace2068dd9a36910d50d681dc6c7f1b19fe
SSDEEP 384:HbaFrLiO024YrFuhw+5EL1pPsac4j0lpDII+aXJK:7aAZYrFuK+5EB9sac4ID8L0K
TLSH
T1D8528E7EAF0238BE0B6BD2D5D8AD5318CE04D5BBDEE2D16605143844C6847B8B4F94EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cab2a03-9928-418d-ba4c-df811dd05928.zip

Path C:\Users\Admin\AppData\Local\Temp\3cab2a03-9928-418d-ba4c-df811dd05928.zip
Size 3.7MB
SHA256 4ef536eee4ee7d4cdd8b9b1e02b3e7e02ab0135bd8f3dbb2d6d0863bbc0776c6
MD5 5dd6349d9a32d4a7fc1cc2f4fa2378e7
SHA1 8f904c028538264430d13c1686873937e31edd7e
SHA512 68e2cbda16f2ca30d6fd2a16fa7994e45e89753ec000087fd83fd094c1aa568dfea5eaa38b6274219648bf717c55f6451d1421db42ae2d5ebf083d5a13dbf12d
SSDEEP 49152:zz74wVQbxlLuLqrGj+ds6YMLzq6L8LswjSyrhM8LnkTbLR6d6iyPc3kii72pdVX8:zz7FqEt6YMV8FtrhMsnk96IP/apdVkJ
TLSH
T13F06E035D69C1639C9CFC3BA850C2FC2984CCFA6805CAB6F6E6A9D7D5CB31E61B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 bf270a9e592be30361292293afc0bfdbfcab1a5678105955423bce6effe9bdd3
MD5 3fe3f5cbf010a5e0ce570dbc9aac80b8
SHA1 0847da051b93af238dff7ae17f180443a9bbf0dc
SHA512 b8138ff1b3dd2f855f654efc3f0312c6dc48dda7339f38b179570056bb1652006478d46c064e6e939b0d0348b0640d64a5852119daff396dff59363d3ea0c727
SSDEEP 768:iEE9JlYaG2yGHUnl+x6GcmhucoaKU7UxNuiJ3vfebb3bobAbqbNb2b/bwb+xZCcE:SlY72yGHUnlyNxZCcasWKqLL6U
TLSH
T130230144EB2E953FD46812BADCA61B002F39F889591A2F5B365C64783C872DC3D5E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0eba25cc9cd761707374d7871d277125ad3ab940f2ad9177266b5f99f19120b2
MD5 da847509c610987ac5b38e565570541d
SHA1 2a0140e955b70e997c8214fa2a66c78fac85f55a
SHA512 819f4afe704b16724c84d870afa5774d68e61a15f43252fb0c95f7f9c01b49920438053c640c8cf5439d5d7f77167c78d1a21f6996c53b1b34ed26239883f061
SSDEEP 192:36mOv5zboPGbHLfyjWKl1d66JozGzgCl6mc0dz:36dboObHLfyjWed66JozGzgC1jd
TLSH
T114D1DB28EB29463FC448123BDCA61F400F76795A9C8E3F19319C641C2D5A2DE768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 0260f2586429507dbc2b920a048411e3a9e711ec230c4ddcffb4bc49420c7995
MD5 922ce370e78b8d1de2b0802947ecd51e
SHA1 088d76f8b0e1675d9c202aef1d756c3a8da6808d
SHA512 4d4e9a839939b8c65e9d3447eab489619d89989daf4c6558ff9d5ec4fdcff07de95af8747da76a4c20b7965039bd2f0901283394b10ae76cae91e68e515feb78
TLSH
T1C661D958F2298A3FE448513ADC921F811F747446A8AF7F2A34ACA04C1E5B3CD768D07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 28b3c909493de20d4a5148b4d25b4d6aacf0701ee3b85f71ee581efa6344d3ad
MD5 f4f616c089b8db2f0a6d84583f919338
SHA1 631a1e4dba0d4533b9897f627a887d1746988612
SHA512 d552e11ef5dfd8272c2ff31e2fc031b35a384c62dd2e6c78b7d4cc0c4981006a3750886d9d768c18c5d79b9b5f372f24699504447d58ae7a0e54cd21193e497a
SSDEEP 192:L6mOv5zboPGZHLfyjWKl1d66JozGzgCl6mc0d:L6dboOZHLfyjWed66JozGzgC1j
TLSH
T146D1FB68EA29463FC408123BDCA61F400F76799A9C8E3F19319C741C2D572CD768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 1928f93e19b127361ec0bd01d156214e29091bb960188e79746c1be74cdc8669
MD5 3ee329bddf5b43f4c3d67f6a23096bad
SHA1 89d2126caa752ee678963b4a3b3ec9f29955033c
SHA512 3a1e813a6887475d0c723af4a94b0283107e9ef1b9e21d04a953ae98dd08c8bbd00eec32fec89eb37df0f42b50d9d3cc9b0bb2cb87c7b02455961c10384a5b53
SSDEEP 384:s6dboCHLfyjWyd66JozGzgC1jCKKCaiffkTK309GcmhucmLrv8Kqr1n7btbWX:dXnEQKKafpEGcmhuc6kKqr1n7btbC
TLSH
T148D2EF44FB2A953FC41552BBDCA50B002F79B88A591A2F5B3A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 08dbcac8295a203be348a5d11d4741b29817059722e04b8d1a54d4b950fd7ccc
MD5 2f8f1c99e89f165bf0739fade06e75d5
SHA1 5191bfbc7d4641b1d312c9f4e8c22dfc6c243932
SHA512 3e59264af58a594c3f20b6bf1752b626bf9f65baa0f8b29ef0e722c90b1234b44206b03381dade92f5fbb79a929d77f35b0a6ad9ee2397bf718f370c924f9c95
SSDEEP 384:s6dbokHLfyjWyd66JozGzgC1jCKKCaiffkTK309GcmhucmLrv8Kqr1n7btbWX:d9nEQKKafpEGcmhuc6kKqr1n7btbC
TLSH
T135D2EF44FB2A953FC41552BBDCA50B002F79B88A591A2F5B3A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 142d639e98705ade7353a6faff641b52510b9f370c18a8484b9fde99e6336ee2
MD5 2d248f7b68a1d822679f3bc72d657753
SHA1 8774b216c0baa62029248c412607e19f5bf05a7e
SHA512 ea9e091953e9be575f87f55449ac7a3778d68be4d898e34953608329dfd7cdfc7dc4b6a7bb784c18c96b09af4f9f81b42083c5aadbf561f1790399b793ccbcf5
SSDEEP 384:dKKCaiffkTK309GcmhucmLrv8Kqr1n7btbWX56dbokHLfyjWyd66JozGzgC1jd:dKKafpEGcmhuc6kKqr1n7btbCS9nE/
TLSH
T144D2EF44FB2A953FC41552BBDCA50B002F79B88A591A2F5B3A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 aeb1b3cdd2a2e1be009f84aee284c2092f8b5d158455290cd9b9ac93eba5e50c
MD5 8cf6f24212b882bb06723a818e64d13d
SHA1 083d8146022acac3db7de7d10a04bd230466aa2a
SHA512 f8e41c5bf756d5f9cddc1a2909d08f8af1f87e2b61b843aa89ccd11f1dd4434e692f8d12b749b88ef84a7dcf044c84038b8483b8468176fdfa0003d78deb625b
TLSH
T134214B4C39B94D1AACDBF69C7441038E93254A0645871D430F42DF8DCD95AD9316A839
MD5 SHA1 SHA512 TLSH

Submit Download

0d694443-ef65-4419-9478-16904c84fc5d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\0d694443-ef65-4419-9478-16904c84fc5d
Size 16KB
SHA256 3211d0f8e40717d434f73ce885ce703140e989866ed20f8a59c9f8f5a73c21b1
MD5 efdeec1e65d6537998821a3d83260c1b
SHA1 06aa45b0a49362446057c65617ef41e56cadbd90
SHA512 9cf8cc84d6ef1f93877952085be213e441ce764eb0bde38b7f632463a21e072c30acafccf2708962d97018504e28d483404c8e36cd2956fd34d45c79a985600b
SSDEEP 192:uU7ipScRyF/zeVmiqpWTDhYGB7k802/1NTjuwyDmBunpy47R99/48GX8zVWh0AnU:57ipScRytyVJqpWHhYGC808fgii4tOz/
TLSH
T15C72CA561860457A8291E36994FCBFC3E5F52CCF4C419FC99BE0BE086DDA0AE112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1400149b-315e-49be-b128-70aa2c44e3ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\1400149b-315e-49be-b128-70aa2c44e3ef
Size 2KB
SHA256 ec29a1db6d3a6431b03204750618f36cfea10a2b3ee6c7924e93583f621264ab
MD5 2073514843c5531b436806cc99440afe
SHA1 710b1b895d98e21dd512d0bd875ff48ab298db84
SHA512 81a1933abadfd3c3b7d48704aa2bd44ff0516cbc1b22875c42f63b7f3a49a1cd592728a2e874c07eee342022275e625525c4e8361dde27d40ad9c28350ceb9df
TLSH
T18A41205C39785CBB9C8BF15DD582338A53A18A0340C62C436E41DF4CDD966AB336E92B
MD5 SHA1 SHA512 TLSH

Submit Download

1a763d03-9958-4734-9741-2e4bddc22e36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\1a763d03-9958-4734-9741-2e4bddc22e36
Size 886B
SHA256 8129210e77d254c4afd6815173213b4d2ea2fe56a771497a3426f67f8611dd40
MD5 205ef89f252c777d862407242abdfbb7
SHA1 04406ffa1db4f627ecd49a8269bf682a7dec3a04
SHA512 f6dfaed673973896461dbf3a03072d729fb95c2c7582764bcdf0a0287bdfb73ba947f34e78bb5ce4f400aefcb721e0b535f7286d12cc2073925c3573a174beb9
TLSH
T14D1100418A747DF28D68F25B98A07B4347E4B12380C609087E205A1C5DAA51DB35AB07
MD5 SHA1 SHA512 TLSH

Submit Download

1f9e9d47-8140-4bee-be06-80e49f5d7ec2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\1f9e9d47-8140-4bee-be06-80e49f5d7ec2
Size 235B
SHA256 a84a726970115a1890595eb7aeff45593efcf20215eacba06e99b3782ba98164
MD5 7e6f606883b4842f2e8d7ac8f575642a
SHA1 43de0c52dfa20428daa4408159273e7ebf72ec72
SHA512 d27da1ba15b1114aa516d6bd9e55e7b34407c618072aaa3e018285417f311a8f7b3140f55d5f9c0d40d35db0458bb31d6385c36db9719b5dc2c622981498db49
TLSH
T13AD097C82898231D08000F07F0E03DC370988C3330A0B850CA5005B499F8DD80262856
MD5 SHA1 SHA512 TLSH

Submit Download

2f537a97-fb1b-489a-9d3c-7e7b3fcc40d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\2f537a97-fb1b-489a-9d3c-7e7b3fcc40d8
Size 235B
SHA256 9e28f1ed383acb671d8778bc61d4370ec931c2534383fd89bee947eeb501dce9
MD5 4962e4fdd8bcd794a85a3336df9827d6
SHA1 ab5bc92af66e251afcc015c4030edef0b9dfe64a
SHA512 e9d3ad4cf553c2816e198e1220cd0db6b60239d571c8e0d4711686aadf8cf5620db8df5204db52282787098725186e8b58db2ea9a76d04993a1f998ce1a0a076
TLSH
T1AED09782389E675C08140F0BB0A068C631948C3720609821DB9640748BF99C4015182A
MD5 SHA1 SHA512 TLSH

Submit Download

c093e749-3f65-4816-ac9d-4e5c2971bad3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\c093e749-3f65-4816-ac9d-4e5c2971bad3
Size 883B
SHA256 f43b972e7c280b5e7da831d7b240dbe86c1a47a7f76c53c7265a769a27ec97ff
MD5 e9716711b9ea03b011a323c0a91ce465
SHA1 dab07871d7371e471e5125fc398966fa3c9fb30d
SHA512 d3deed927583531fd3ab18f5fc7fa3dec6bf98689826f9ca8700e27ae9f36622aa3de97e5418815cdf78efb921dae6ba6e2ada9829cf862c5bfcb2ee4d44aafa
TLSH
T1F911004197717AB3CD68E25BC8913B414BF5B52380C648043FA11E0C4D7E929D36B64B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\extensions.json
Size 16KB
SHA256 99eaf327097ef5694c997586852f102ca4da1de87c22a1b61d1ed910c42ee7ea
MD5 a511e0f5f8b7e48fae21a09bf22bc7d9
SHA1 f4c7533a3a7662a309f486ff3c1ccd3ba6b86290
SHA512 6a2c122b00b0ddecf217ef74683f275c23f68395592c92c8d45e2ea6e8d47a6ac2aa9caf95064d29d766f24b2f6927b4d567b735bd1dd63ce3b91063f3e29ff7
SSDEEP 384:AkI4v0UmldvN8dhWZ94zq96ojAL4HyDL4PeL4HofL4HYL4HGh4ho:nI4cRf+XA4q6h4a4s4ID4a4u4e
TLSH
T19A72411545049EB8294EA79BAA36BD02C37D473B60845C38F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 7KB
SHA256 4bd6a6ea4338e1aa18ba84a951a9f921691a1b9839de251dc7ac1251161add61
MD5 a7cfe4470832995a8563541f1d93b594
SHA1 4190db6d6c9271ba056865ba4c03b3f755d7903c
SHA512 9f59d494f261f18c13b4ba50579deb517954b914fd0a6ebc1894b758fed687d12db7e0236c8ea2d9373f51d0c73690ac2a0bdcf802c0362543202b4e612999f3
SSDEEP 96:xH899TUSPqGq8fA6pz6ObzS/SSl8pdv9jr2nFIH6DBw88Z8L4cnoVBFHn:27CR8fA6pz6hSSGhR6DBw88n1H
TLSH
T195F10E785508DF7F78B6366CAC2889715AB2013BBBBF68C251F98484050CF3451F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 12KB
SHA256 4054e992d3dc2a98944086a32d8cef8b1eb8abbad79a6b270fb1adee525fccb6
MD5 a7b86144b652dfea28a94d33a22b54cc
SHA1 b65561ac599a11ff04a07599649858fb4e4b96d6
SHA512 3e39d57dcadec0bf60bf1402a9f19f4913be5030abc08e4cb7567f2ef9f373432b3ad2e242814ab9a342a95e4e2b92627ac5e8c73196591aefe0b83edd44be59
SSDEEP 192:C7CR8fA6pz6hSSGYJZLRnwgOzmBw88CzinNF1H:8xwR+gwYyH
TLSH
T10542BE3C55449B3F79F6367DAC294DA059A1023B76FFBDD206F88881084CF2451E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 07319f10439ae0ebd0d7674b47ba9a44e1da94131e3ee010446d4704482a3fb3
MD5 bb5cde62f813faa9db194158703de873
SHA1 d7ffec80b0470a9ffc234f12e972b227beea77d7
SHA512 f929a2448891d8bcbf68f212af19492469fcdbfd3c7b2a441847d6296d708fa42d666a08f0df855ef9a2b526b00f86b6cfd1b7fc0b4b71b76aea1d4acdbdb586
SSDEEP 96:xH89UTUfqGq8fCqVKjfnjz1zSpLC2SSl8pdv9j3BnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVYvoLC2SSG06OBw885y3H
TLSH
T148E11F7855088FBF74B6776CAC6888315AB2413BB7BF68D750B94484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 26dacd71f8893564d7b5cb93879e7adb4e29baef66f516b534e3ecebe6b8aae4
MD5 d0a1b4062d3c306a9ac99b7919cff076
SHA1 44848740b1494f73689c1448b52e09336feb897b
SHA512 47dd5a793ab4d970d2fc8e31bec956370c41dbfd9c01ee35ab44d71118258ad4b06e9312cda669a42a9f629cf4c6a23e417da35bc874ba589b171d2f6b9afb37
SSDEEP 96:xH89UTUfqGq8fCqVz61zS/SSl8pdv9j3BnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVz6KSSG06OBw885y3H
TLSH
T12EE11E7895088B7F74B6776CAC688C715AB2413B77BF68D350B54484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 816a9d6faa71eb057bef5ad38f1df731815511e02d10bd7220fcfcdd0e44d6b8
MD5 ea137055389d18596e4c827a3e8633f0
SHA1 3b461d01e6cf3f240215ce2cdb29e91121d89435
SHA512 f0df5ffe71e4dfca498078b40a828c7abee77d8227dbae6300940e0c17cea127b79e2c320f8a116ca12cb9298726010e334c956827ddadfad7de6a7ad798a7ed
TLSH
T11A310A8392572DD9BB12831DE4457FB6C15824714CBD44E1C6CBCA8528AE85AB3CE168
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 1edb2c93ce20ba387bfcfdd8bdd683cf5cadaeef4133fee1cc062e6ec9d71bb5
MD5 84b58b95834bcbbc205509fc76c29b12
SHA1 0dd4088ffae0dd65f2fccc1b5b0f75a60db4b8b1
SHA512 2ea31ea29e03cb7e8fe919897d2d863fd0410ca38823c84491b1158c59f59b25bc3f46130adff27922891d90570e685e5c377e2350da935b306b24802ad55ab1
TLSH
T13C21E993403F2DE5B610811EC4895FB6C654306344B95CE0DF8ECF49558F48AB382259
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 1678891cb9e92fe551731693d2d32357d05daf62b0c072ca564810b6937b5378
MD5 eb98725a16a879bdd592dbb0511650ea
SHA1 a7a612313309df224fd8a17c1d271d7bb85cf751
SHA512 7db23da7266ae8fa63858a77ff7a52f296d4ac1da3ac95873196f299010ee212f7baf0cbba0b618de1003175cc18a2332d01f747a53fe78b366c91f432dbbd3f
SSDEEP 24576:hYSr+tIUJlBzTj6N/rZbr20eOVRYvmxhHMg2QJ:hJ8/BT6BZbr2zOVRAmxhsg2Q
TLSH
T141F52BF820D2B357F3418033A64553EB21AFD00CA467CE044BA956E995B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4420-4601-0x000001CC45B10000-0x000001CC45C3A000-memory.dmp

Download

memory/5460-4652-0x0000020260D50000-0x0000020260E7A000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads