hxxps://api[.]instafin[.]pl/api/p/agreements/download-preview-doc/credit_information_form_preview?code=pdl&amount=1000&tenor=30

Analysis

user interaction
yes
max time kernel
36s
max time network
42s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
20/04/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://api.instafin.pl/api/p/agreements/download-preview-doc/credit_information_form_preview?code=pdl&amount=1000&tenor=30
Sample260420-p8metsfs7x

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4214655515-2537246629-1547560666-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	firefox.exe
Token: SeDebugPrivilege	4296	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe
4296	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4296	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4296	4432	firefox.exe	81
PID 4432 wrote to memory of 4296	4432	firefox.exe	81
PID 4296 wrote to memory of 4516	4296	firefox.exe	82
PID 4296 wrote to memory of 4516	4296	firefox.exe	82
PID 4296 wrote to memory of 4516	4296	firefox.exe	82
PID 4296 wrote to memory of 2928	4296	firefox.exe	83
PID 4296 wrote to memory of 2928	4296	firefox.exe	83
PID 4296 wrote to memory of 2928	4296	firefox.exe	83
PID 4296 wrote to memory of 2928	4296	firefox.exe	83
PID 4296 wrote to memory of 4744	4296	firefox.exe	84
PID 4296 wrote to memory of 4744	4296	firefox.exe	84
PID 4296 wrote to memory of 4744	4296	firefox.exe	84
PID 4296 wrote to memory of 4744	4296	firefox.exe	84
PID 4296 wrote to memory of 5528	4296	firefox.exe	85
PID 4296 wrote to memory of 5528	4296	firefox.exe	85
PID 4296 wrote to memory of 5528	4296	firefox.exe	85
PID 4296 wrote to memory of 6012	4296	firefox.exe	86
PID 4296 wrote to memory of 6012	4296	firefox.exe	86
PID 4296 wrote to memory of 6012	4296	firefox.exe	86
PID 4296 wrote to memory of 6012	4296	firefox.exe	86
PID 4296 wrote to memory of 5308	4296	firefox.exe	87
PID 4296 wrote to memory of 5308	4296	firefox.exe	87
PID 4296 wrote to memory of 5308	4296	firefox.exe	87
PID 4296 wrote to memory of 5308	4296	firefox.exe	87
PID 4296 wrote to memory of 1368	4296	firefox.exe	88
PID 4296 wrote to memory of 1368	4296	firefox.exe	88
PID 4296 wrote to memory of 1368	4296	firefox.exe	88
PID 4296 wrote to memory of 1368	4296	firefox.exe	88
PID 4296 wrote to memory of 1704	4296	firefox.exe	89
PID 4296 wrote to memory of 1704	4296	firefox.exe	89
PID 4296 wrote to memory of 1704	4296	firefox.exe	89
PID 4296 wrote to memory of 1704	4296	firefox.exe	89
PID 4296 wrote to memory of 1628	4296	firefox.exe	90
PID 4296 wrote to memory of 1628	4296	firefox.exe	90
PID 4296 wrote to memory of 1628	4296	firefox.exe	90
PID 4296 wrote to memory of 1628	4296	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://api.instafin.pl/api/p/agreements/download-preview-doc/credit_information_form_preview?code=pdl&amount=1000&tenor=30"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://api.instafin.pl/api/p/agreements/download-preview-doc/credit_information_form_preview?code=pdl&amount=1000&tenor=30
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27100 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {bdb68196-071a-450d-a4b1-2f4770b11b7b} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27136 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {5805a5f8-298e-4e74-89a6-7ae88ed47eaa} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {9c177a90-1b96-4d15-9681-6fa08ddc4d3d} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27277 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 3836 -initialChannelId {8d4036d3-84bb-4ecc-a3bd-51c34726ce9b} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4440 -prefsLen 34776 -prefMapHandle 4444 -prefMapSize 270279 -jsInitHandle 4448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {f1ae43c1-3f24-4c03-a286-7793b9ac80b4} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:6012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5112 -prefsLen 35013 -prefMapHandle 5116 -prefMapSize 270279 -ipcHandle 4984 -initialChannelId {9c1c428b-c774-4323-af66-a6bfadea900f} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2116 -prefsLen 32952 -prefMapHandle 1620 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4448 -initialChannelId {1bc7f210-c199-4b24-8598-26110a18a50b} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5616 -prefsLen 32952 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {98b0f392-aeef-44ff-a31d-983b382043cb} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 32952 -prefMapHandle 5816 -prefMapSize 270279 -jsInitHandle 5820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {44e86f96-fcb4-498d-a6c7-03e2ee957727} -parentPid 4296 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4296" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1r2x66wx.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 973db59b73602139de55028b5a33d355061a2fcafb05fe754608d65f67fe6121
MD5 33bee755fcde201a39cc0636b2afa660
SHA1 f49abf871640b061ba2277fabe51dc5ab9666e4e
SHA512 6477bb5a6781ecac6abd14fa4698f159873eb5ae18d9caea8ca26ff5ead769910a3c222b9d552e553d1ea7c6652ae533d5dfd527b66aade402ae74cad63052ea
SSDEEP 384:HbaFrLiO024YHFuhw+5EL1pPsac4j0lpDII+oXn:7aAZYHFuK+5EB9sac4ID8LW
TLSH
T18D527E7DAF0138BA1A2BD2D4D9ED9214CE04D6BBEFE2D16605143844C7847B8B4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1r2x66wx.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 f104764a249d214cc3c66ea0311e98e7831dd59749a086c3d09f80aac2f5c71c
MD5 08833555ec442893c19bf4ca87b20412
SHA1 eb126f07d533e863df938ec1a2e0358eb0a965a1
SHA512 9be0d3d934c59785f0f03d07075f8417fa4b9b19c6ae7cc848c56ce3fdac3ce84602a37a39e116904c737196f7fd1ac15e09126e908366629ddb00f96b6b16f3
SSDEEP 1536:jTrlirzXzDh6+2gp1AjvcDU4ZF/bhGIQprJ4niEEvNsGQgDzYpIgNKhB2x7MXAxY:j3llfgpGkZ/Q9J4i11QgzCIjKDO1L91
TLSH
T12BB3AFF6DBA2CD3964FFD01DABC2843EFD272400B7A73019C963635592C6BB86675608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\db\data.safe.tmp
Size 43KB
SHA256 789d17c4a287e78317ec9a89b9c65c1d67eaf64ebee13b0462189966d79247e5
MD5 8904046a1adb842ba051f57f28351d9e
SHA1 0731a125c7cdeadf8494b4c1b414c5d6749e0fe3
SHA512 c419b469eb0730b58f3587307064f3d7ee175494994acba4bb9f43eb04b4b33e4f2016c336aef63ca69d7caf41d381f7a52004dc8fa30f5ee12dc25ac39df67a
SSDEEP 768:zfTPQ3swo/uxG6UGcmhucFnwdKimEUTiZ3EoOvbabWbVbob0bAbabhbVSAnBYa7C:I3swo/uwgnwd+SAnBYa7nZ4Haq
TLSH
T1BE130244EB1E953FD42802BADCA61B002F79F889591A2F673B5C64386C872DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a4630445f93d9fed6a461e16331ef1df8b9e39cfed88db428a2214672452abe7
MD5 5f46e6a9bcf7b3b84a26898146999210
SHA1 0a6ba7db2983b545f31c73fd82d67a11c59aadb3
SHA512 9e932ad273f12e027f8851dad02e89606745a04c0e289c12f377846625ca9c7e613e46f9e81fa8b01c519a035ca79bc150727293d2659a643533c0f1590e1ea8
SSDEEP 192:U1d66Joz1zgCl6mSSdzOv5zboRZj0yjwhv:ed66Joz1zgC1bmboRZj0yja
TLSH
T1BFE10068E628863FD408037BCCA51F404F39385B9C4E7F15769D64182D972DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 84361621e6d2fde5b1d5428cb5479ced66f9d0b939bf0d84408037d5495b1abe
MD5 96bc78c5cde68b3bfb9637eb066e0f42
SHA1 395d3038cd3c5b17888024edd7ec068b356b5f75
SHA512 45d2063669803188d4ff9e0061372a74193ccc9059fc326cf515f47087006ca5de010aadb9702b9b21ab9aa8fef96a61f11d60fa6d48c20d3ce37a7d7072d422
SSDEEP 192:31/66Joz1zgCl6mSSdeOv5zboA7j0yjwS:F/66Joz1zgC1bLbosj0yj
TLSH
T171E10068E628863BD008437BDCA11B414F39389A9C4E7F1975DC641C2D972ED768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 65ca3656dfa06951b23929dcf45f26335233cb921b8518399cbea2e1b20e8353
MD5 2aca1d69c9edcd807f6570f545f5c729
SHA1 02518e27dac8d0f1b4968b44203f2c6a4d6ccc17
SHA512 2d29623e42a37a9ec13e6ad4a28d8bf631e5b016008db02eb9fbd96009d82437704ca4deb02833abf4dafea7b5aa8cd75a8f33f134acdf94dd40b4a0b81f747b
TLSH
T1F721C75C39BA4D2AAD87F69C744103CE93544A0B048B2C478E42CE8CCDE5EEA322A53D
MD5 SHA1 SHA512 TLSH

Submit Download

4316bb81-f2a7-4186-82b4-9c1331b1e57f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\4316bb81-f2a7-4186-82b4-9c1331b1e57f
Size 235B
SHA256 216dfc6d706c765c52365105754c970628ff544db2d68b4f98295c9d70412906
MD5 f4344cb852054a246db14130e92f3495
SHA1 8c9b5c537d6abcaaf2ef5c3ec2941615ee611e01
SHA512 fc18e648cb7047a061fb5b1a28ce083505316005cbc14aaa9db5078660e7b98a5c96de6892a65014fb38c5b35995535441d06d0e2c5946c6256c0155bf556068
TLSH
T10AD097D014C8732E08000F07F0B128C630848C3310BCA821EA618A78DAB8EC80261D1B
MD5 SHA1 SHA512 TLSH

Submit Download

4b102cad-d6ac-44bc-8b11-97c8f7eb99e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\4b102cad-d6ac-44bc-8b11-97c8f7eb99e5
Size 2KB
SHA256 b3ce5684b2d4e561ae9292e326b13d63884697ea0ddd6be1842b2bc6dff79432
MD5 2df1830f6c8e3d3bf7d557e2a7b9a1b6
SHA1 1753fa143bd0eaac7353b0a6fef2793c1e81a65d
SHA512 cb4f7e557803f766820c8aeca894f840e1928efc0f14bfe4ffe475f7fc47f59fdc7cb24c6285080f6df743449c3d1e07802dc277acf9df15a1e1aaa2a13b6d25
TLSH
T16D4146EC35789D7B9C8AF14C9481375A43709A1300C62D436D51DF0C8CE675A73EA82B
MD5 SHA1 SHA512 TLSH

Submit Download

5e946439-2ffd-4e28-8ef8-2049c2fb4fa1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\5e946439-2ffd-4e28-8ef8-2049c2fb4fa1
Size 17KB
SHA256 38004a4682aa2a59a0e2606973f8c569b1db39f32d38fe4583d6cc45f7537bba
MD5 e18cafec5bd1b09231f269833b9adda5
SHA1 6fffa35c3c7ba78c9e561223bbb9264f4410d099
SHA512 8c2ec57c1f4149b7a14c46ababd8bb2a488a12b23784f186509ce69995d6213f107fe748dd74f3d532eca4f7d318beb6120cc60380aaa4727586e7ad751e2672
SSDEEP 384:em7XiSz6CzYeJMQmK6XBr1VodPByJHBj6i1:5NFseujLBr1VR1
TLSH
T16482B956682045BB8351E3A894AEBFC3E5F528CF4C418FC9DBF0BD0859DA09E532794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6515952b-9dee-4547-be52-b677b9827d45

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\6515952b-9dee-4547-be52-b677b9827d45
Size 886B
SHA256 092e6a58cb3ee44078d1a299a8d931f6100477d8260beb72a10c1ce852101cdf
MD5 24a23aab00a8a148d63165a8a859daa3
SHA1 5d39a633c106c98526269fdc387ba438788c22ee
SHA512 da722abd927670ebd917df6b6b0dc3f076e8242830e8024fa880d91e61e9fce53a24abb18a15e7cef2699986eac013d82441d21e4940cef1eafe8952673fc1bd
TLSH
T10A114482CA75B8F2DC28928794E07B424BE4651390CA0D14BFA05E180DEB11D6392307
MD5 SHA1 SHA512 TLSH

Submit Download

bbbfc1e8-2d02-499e-a413-ba84f05f5baf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\bbbfc1e8-2d02-499e-a413-ba84f05f5baf
Size 883B
SHA256 a3c829edd975b1ea04fcd05d14cfb519d0ed3e5b19413e5b24dcb26369278ea0
MD5 db7ac5fa7799e54c5e0fc19f5047dbd2
SHA1 b5ce54b8c8ead5664e0439edebe822628bd67ca4
SHA512 a18cc2ad79c303a64bee3db4f665365e3ce50c25cf234dc1ef2bf12fe0e906f4beda1aa3c8fdf41c704e84891e7a1244904c11466ab8a70909c577c83db7de32
TLSH
T16A110091D635B8B2DD2CD28BC9907B4387B8742380CA44147DB05D040DBE52DA3A620B
MD5 SHA1 SHA512 TLSH

Submit Download

c3413f65-6bec-490c-856f-cda8112603d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\c3413f65-6bec-490c-856f-cda8112603d9
Size 235B
SHA256 d2f4b21ee85d3dcdbdb66990534a4d8d43a78a8ff7e6d43f9e4231b56e585ee4
MD5 c649d7024e5a88ff61ac470e5f4a6182
SHA1 e3cd5d8870122575fd9322c5d1e1e36bfca54603
SHA512 7a1c4bed40414a263b70194e579bdcbb9badcf59a488d1cf08d62a0687c22e83882d25d475c25732b908a0fb7262ea3897e27bff4d0468cfcbd8d5c315303c93
TLSH
T1C4D097C0248C335C0C000F07F0A029DAB0888C3319789C209AE10274DAF99CD82A680B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\extensions.json
Size 16KB
SHA256 479f0bb8adaec07b8f5ad8acb0843ef6e8c19a0c077d42afbfdd2086ba6c58cf
MD5 3cb76d3f12e3cdd67b877cf4dcdb6ac9
SHA1 0e5d811489b21a4273edc4a2490a60577aa1ced6
SHA512 cd47b50c58ab65d0237c1bc3163c71c42e55b3225d8d7485afaaddf94cc2b49647238884fbeaad57920939fba4915b59ab7bb090b1f058e76aaff89db3fb4202
SSDEEP 384:xkI4v4UmldvlS8dhWqQ94zB96odL4H3L4PFL4H+L4HXL4H2B4h8:CI4gRfNXY4r6q4b4d4k474W4+
TLSH
T1B472521545049EB8294EA78BAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 8.8MB
SHA256 f1e5bf234e81be1386a118aaf2fea5bf25880eb09efb714da768850b1647e83e
MD5 3e3693e6ea36f6a4cebe59a0635d2f47
SHA1 4e737794082e0e5699f51cc06c86242c01434c19
SHA512 95e4b5a81dd6658243478d53264b17cf2850a6b9d62920fd8cb6e07f0c46e33b381a75003d12e91104b9395f033eef06b742656eec57649d7cf6cfb8aa9c62fc
SSDEEP 98304:2dDd0eXxX1+WNxvNQ9EQrt6mWwxwEJyb93D0/GD+l8VHuM5Qp3NinhYqxZ5:uDd0eXxDy9EQrzx9/GD+l8VOfpWb
TLSH
T1DF968E4DE36310E8E81E8DF4866EDA72D474384E0335AAEF17D48A355A727C02A79F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs-1.js
Size 8KB
SHA256 b37f63fa4d598b643e303c0c1d7cf02fa3e7c430d1e4c80acc150f01e842ffe8
MD5 6a1590b6879851343845270b2e2343ad
SHA1 ce6c760c5d2edd0a1407a1e07b267957fb80f194
SHA512 3695018cc641ff8ad35c65009074dca8902809f37b4e5d102a69d1735f9a74ba9698f3e0426c4a88301d269870a1b51693b4eb3a17943d6dceab1ca73e31466a
SSDEEP 96:xH89TUx/qGqOfO0lObzSQSSl7dv9jQ0nqWRcqDT0Bw883ASr8L4cn0X0A:WlROfO0liSSmSRZ8Bw88tpN
TLSH
T1D40221389104CF7F75F6366CAC288E715AB2013BB6BF68DB91F948840548F3445E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs-1.js
Size 6KB
SHA256 fc984d35983420052fcee43916767d7c4d5c6302a7c7e72b7d8386ba3a30fcaf
MD5 4599d0dfc912191037b548a007602af4
SHA1 c65ba10da36cbdb95297526a0cc8b666e5753022
SHA512 ff5790b21fd9ef01d05fb0f50bf67856dbb29d8d57c1b9aa28eb97b8bc49af233c878560a75fbfe3d76865d2293d74350752c06094602bf889373dae9eb99de5
SSDEEP 96:xH8UTUx/qGqOfp0l1zSQSSl7dv9jQ0nqHWDoBw88P8L4cn0XRA:WkROfp0llSSmbW8Bw889+
TLSH
T1DFE11E7895088B6F74B677ACAC688D319AB2013BBBBF68C750B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs.js
Size 6KB
SHA256 200abdba422cfe63fdd9be467f5e994d5f8d2b68656257a02b596c39727edf8a
MD5 c39e850ddec0f142de988aa2a6ff575a
SHA1 9f1d82a1bf5b1848f5b21c5c9706e024607efcec
SHA512 97fd705034a371d1a24b28ec5530150483a9161ea5c989036499e4fb70fbfb395b41e8550b2ec0eb36104f73feda2766ce02b060bbbd917a017744ef3a189e13
SSDEEP 96:xH8UTUx/qGqOfp0lObzSQSSl7dv9jQ0nqHWDoBw88P8L4cn0XRA:WkROfp0liSSmbW8Bw889+
TLSH
T117E12E7895088B6F74B677ACAC688D315AB2013BBABF68C750B554C4054CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs.js
Size 7KB
SHA256 c7d2b3c38ee837a3e1e1719cb5d51f989b3e8f31189000ea045f772fd48971c2
MD5 fdb68961596fe06e301caf1bdce7526e
SHA1 4c576d4e4caa1de40914389b38560031c3f11ba6
SHA512 7521131e1111e16d66f83c7d21fb0390a2bde58932d62e3ef1f5f72d0055ff152205aff029a34785f35ca0b3d1fc0f8f3be324acefb1de327d510e9608935984
SSDEEP 96:xH89TUx/qGqOfp0lObzSQSSl7dv9jQ0nqHWDoBw88d8L4cn0X0A:WlROfp0liSSmbW8Bw88jN
TLSH
T10AF120789508CB7F74B677ACAC6849315AB2013BB6BF68C750B944C4054CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 cdce36238e2eb155d4025510d12d8f174cdd527c077ded2376aad48cc3253b3d
MD5 ad609a74c30da039617f21c021d95749
SHA1 60ba1cc6bfe660361ddc064958175eb5574679e2
SHA512 8fb919011672bf66bd17e05f7194a62a9a9a3771443474f30a52cdc0e02f90fb838db7c00eeca94ac6755877e116ab84107a0874bdb89d84a4da1237a80636ed
TLSH
T14541EA57E54A2CF26FA9D4CC90C52AF50A1E303B0DFC90B0805BED0119A9939B6A826D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 891e0d1f89cb9f3028d1b1611bad0c860232e9ae71f2d7beeb61e39b5ac73bd7
MD5 1dd5b36c092e9b6bb3e4a88b60e46602
SHA1 fdce936d7d8c40e310f38d69cde14b90da05aae7
SHA512 0dabd93c18cb3ffbaf3392cd975b29f47fbe699d3aa900d0c2f64c2d7a753357c9e2a646735beb61afa7eafd824cf67bb3b030dacd2f38ee919813a923a82c6d
TLSH
T1A341DA57D64A28F16F5AD4CC50C82BF5091A307B0EFD4070C1979A11296E566FAE835D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads