hxxps://api[.]instafin[.]pl/api/p/agreements/download-preview-doc/credit_information_form_preview?code=pdl&amount=1000&tenor=30

Analysis

max time kernel
20s
max time network
27s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://api.instafin.pl/api/p/agreements/download-preview-doc/credit_information_form_preview?code=pdl&amount=1000&tenor=30
Sample260420-p8metsfs7x

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6048	firefox.exe
Token: SeDebugPrivilege	6048	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe
6048	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6048	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 6048	4780	firefox.exe	80
PID 4780 wrote to memory of 6048	4780	firefox.exe	80
PID 6048 wrote to memory of 6080	6048	firefox.exe	81
PID 6048 wrote to memory of 6080	6048	firefox.exe	81
PID 6048 wrote to memory of 6080	6048	firefox.exe	81
PID 6048 wrote to memory of 5776	6048	firefox.exe	82
PID 6048 wrote to memory of 5776	6048	firefox.exe	82
PID 6048 wrote to memory of 5776	6048	firefox.exe	82
PID 6048 wrote to memory of 5776	6048	firefox.exe	82
PID 6048 wrote to memory of 5424	6048	firefox.exe	83
PID 6048 wrote to memory of 5424	6048	firefox.exe	83
PID 6048 wrote to memory of 5424	6048	firefox.exe	83
PID 6048 wrote to memory of 5424	6048	firefox.exe	83
PID 6048 wrote to memory of 3284	6048	firefox.exe	84
PID 6048 wrote to memory of 3284	6048	firefox.exe	84
PID 6048 wrote to memory of 3284	6048	firefox.exe	84
PID 6048 wrote to memory of 4472	6048	firefox.exe	85
PID 6048 wrote to memory of 4472	6048	firefox.exe	85
PID 6048 wrote to memory of 4472	6048	firefox.exe	85
PID 6048 wrote to memory of 4472	6048	firefox.exe	85
PID 6048 wrote to memory of 3412	6048	firefox.exe	86
PID 6048 wrote to memory of 3412	6048	firefox.exe	86
PID 6048 wrote to memory of 3412	6048	firefox.exe	86
PID 6048 wrote to memory of 3412	6048	firefox.exe	86
PID 6048 wrote to memory of 1848	6048	firefox.exe	87
PID 6048 wrote to memory of 1848	6048	firefox.exe	87
PID 6048 wrote to memory of 1848	6048	firefox.exe	87
PID 6048 wrote to memory of 1848	6048	firefox.exe	87
PID 6048 wrote to memory of 3568	6048	firefox.exe	88
PID 6048 wrote to memory of 3568	6048	firefox.exe	88
PID 6048 wrote to memory of 3568	6048	firefox.exe	88
PID 6048 wrote to memory of 3568	6048	firefox.exe	88
PID 6048 wrote to memory of 2680	6048	firefox.exe	89
PID 6048 wrote to memory of 2680	6048	firefox.exe	89
PID 6048 wrote to memory of 2680	6048	firefox.exe	89
PID 6048 wrote to memory of 2680	6048	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://api.instafin.pl/api/p/agreements/download-preview-doc/credit_information_form_preview?code=pdl&amount=1000&tenor=30"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://api.instafin.pl/api/p/agreements/download-preview-doc/credit_information_form_preview?code=pdl&amount=1000&tenor=30
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {bd2844e3-0f52-4784-a9dd-ed83e54506b5} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {2bf5d17e-1ffd-427d-a947-9e4e6b2e9c95} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3912 -prefsLen 25164 -prefMapHandle 3916 -prefMapSize 270279 -jsInitHandle 3920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3928 -initialChannelId {452f0cc4-574b-401f-8977-5488a19eaf6d} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27274 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {1f7eeead-4dbb-4db1-836a-a90d4a487c99} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4388 -prefsLen 34773 -prefMapHandle 4392 -prefMapSize 270279 -jsInitHandle 4396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4360 -initialChannelId {7d6d400f-4407-49f8-8354-3447a0c13baa} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4928 -prefsLen 35010 -prefMapHandle 4932 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {a2961926-22e9-4643-ba63-38916080f308} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1108 -prefsLen 32952 -prefMapHandle 3300 -prefMapSize 270279 -jsInitHandle 3304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5396 -initialChannelId {2347bf04-8821-4fce-87dd-3f8080e67f19} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5416 -prefsLen 32952 -prefMapHandle 5420 -prefMapSize 270279 -jsInitHandle 5424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5432 -initialChannelId {4721e248-d677-4bd9-80c8-5ddfe5376c34} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2852 -prefsLen 32952 -prefMapHandle 2856 -prefMapSize 270279 -jsInitHandle 2860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {9a4fb962-8e3e-4a58-ae9b-765ffc6aa9fd} -parentPid 6048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.bin
Size 7KB
SHA256 41a2cf4abf147515090f59f9ecf73fd78a91a75eb332456cd64640cb486af86f
MD5 d153ecddd329d444f8f1b75d5ead650d
SHA1 1645bba7103c31910ccbc1d3370972f47cf677f1
SHA512 7127dfc21991578674879b8cee663c5b5cd53e69ff0f76136192c23dde81eebdac2c8e22a720182d88ee9df3f97656a2e4f32a9e6672120fa08adec1e9b43c85
SSDEEP 192:G1d66Joz0dzgCl6mc0dwOv5zboyZl9yjRhv:gd66JozQzgC1jBboyZl9yjP
TLSH
T11EE11E64E639863FC408137BDCA62B440F3A395B9C4E3F2936AC65582C572DD368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2b8af52f115d5e4122d50dd6609ba33328042d5985c806e28d1d35356f6d9762
MD5 cc8eb9229ba8b52f8479623f59557a02
SHA1 320041f1c3fbc3e287ab489019aa9ab4a8d1aba8
SHA512 789aab0bd69cf898c304843e0fd76f1f6c5e9533f69ceddf4cd125de3babd9e0dfaaf76316050d624a96a083a609a118b2410ff72d161d45fe62866f92028817
SSDEEP 192:T1d66Joz0dzgCl6mc0dVOv5zbozZl9yjRh:xd66JozQzgC1jMbozZl9yj
TLSH
T170E12F64E639863FC408423BDCA62B400F3A395B9C4E3F2936AC65582C572DD368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3d5722f456934821c9473598a331fd29e494908098f5c02ee55bc75274b11cb4
MD5 40e31d301eab26155745ae74f75e4c61
SHA1 e2b0ba0decb13c5d5f9223d29bd87a3ad425681b
SHA512 6a999a41a599b6a80dcff008ef087b8ecfdeef0e02ea7da33e35cacedf38a7094136fd74e160f363e2d31b4be7f91923f0f2803fa0a131b18924b5362b62a386
SSDEEP 192:V1/66Joz0dzgCl6mc0dwOv5zboH0l9yjRO:T/66JozQzgC1jBboUl9yj
TLSH
T13AE11064E639863BC408437BCCA62B451F3A384B9C8E3F29369C65482C472DD778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0e8775904c54a0ed9916145970e3879e7d5d2cc6a4506861af1dfe58d33f0750
MD5 560addac019d92545d85121edd708198
SHA1 912a82718eb2d93886495807775f98b4bb80f00c
SHA512 80df95571962679aec9370013aecef5c1fc2fb3abcb52d09fef4874e60663cfdb66d80fb345bfdd326423a5b852626d6965dd33b2689edd7a6d75ebd28cd8782
TLSH
T1EC31A04C39BA4D2A6D8BF65C7446138E53918A4B04CF1C4BCE92DE8CCDE49C9316E578
MD5 SHA1 SHA512 TLSH

Submit Download

0cebaa44-efb0-4782-8845-73262fd3e457

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\0cebaa44-efb0-4782-8845-73262fd3e457
Size 235B
SHA256 2299dd64f1cbcd4c866283fb67a4a3b6a6ddb2f207094561cb664baa2fcf3048
MD5 e1e8c114674ae3a23f0e3ff12d6732e6
SHA1 adb702ba9fd02bdc6bd25144d701693e8095a6c5
SHA512 caa0cd2a8e936c7c47e2379f67695603f3c4e9dd1386fd671cccd3ab395a247a8149356cfa6156edfbede1a8a16536d68157014598cac2f6609941d905b15c85
TLSH
T181D0979028986BAD0C100F1AB1E0E8C230948C3328A8A811955114398ABD9C401A1917
MD5 SHA1 SHA512 TLSH

Submit Download

0d359bb2-55cf-4134-8028-4187240f0705

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\0d359bb2-55cf-4134-8028-4187240f0705
Size 883B
SHA256 2f6c2c0a0644409638777803c6004faaf6847bcfd650fe1f2a7e64b3961f8523
MD5 476971ce3b9a2f66b08b541222348f55
SHA1 5fb252befd0e0bd273f6df1bd61519b356b5f5e0
SHA512 fd5f2e9bcc34d826a9cb39f17f0bef298d8265b7cddc65cc14fcaf293ba25cf53f7d70146b2208dd92ad34d72d7ee89031e54e8b4be68ed53fb57950f93831d6
TLSH
T147112340D735B9B2DC6CD25B8991770297F4751380C654183FF05A044D7E92D9752A0B
MD5 SHA1 SHA512 TLSH

Submit Download

39678dce-a5e4-4e7b-a1b1-11e5c560f29a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\39678dce-a5e4-4e7b-a1b1-11e5c560f29a
Size 2KB
SHA256 a756579a3086ea18497ad1611e7e4db9658eed7a70e16323a51c3df3225a6b09
MD5 78b8d944b3f16ad6c2f9bf62765d881c
SHA1 16f05246a84cc4d01427573764e34ecde9110967
SHA512 bd8d60f041c48a21b5b63e7c7de69806426013d48379f07c8f2e7eee600b434318d6ae21747f9e87aa6b32238e292e8b217930458ec94bc869c896b1b084aa67
TLSH
T1B451415836788C7B5CCEE56C9842338E57A0CA0700821D936E96DF4DCC9A6DA737F51E
MD5 SHA1 SHA512 TLSH

Submit Download

a5e510df-241b-4c6f-8ff7-3baae7520af7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\a5e510df-241b-4c6f-8ff7-3baae7520af7
Size 16KB
SHA256 6fea75f9c72225db2f33b31d6e732266a1d7b64c6b276b9a1b9cc6a0d3409968
MD5 5619fb8e7a274d2201d9f013a49e4a3d
SHA1 8c0021e19b4663cba2e3953a55414c396eeb83c5
SHA512 8130686d589b671c84e9bdeb2493e901eebc1912d3bc786d4f1e0c99eaaee2db36cbc0150928ae56d141b94b128fa8c3ee416a60c782053f1411929fd178df04
SSDEEP 192:HJ1K7SwzgJu+lCyLpk4Arv2eC9OJ/gGBn0lb1upVWpbG+1FPR7TmF+/kwAJig53M:HJ1K7SwUkaL+4Arv2rNGhE1XKc88
TLSH
T16F72B856582049BAC691E3A894FC7FC3E2F528CF4C418FC98BE4BD086DDE46E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5e51220-6c54-474f-829f-9b9294c52829

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\c5e51220-6c54-474f-829f-9b9294c52829
Size 235B
SHA256 fb7ee87860f35617daaa85088366e748d87d61b46d2f94f6bbf2cd733fcd8cee
MD5 788662a8988338a3de6804ac5c24cd07
SHA1 c353e741a72e6602d14027e88c4c0412abff1515
SHA512 ac6cb02097c6d1ca886ee49747cd929525245d3f2e9125283e4d1621f029c23c05a89f68c2659df9097369af51c5308b6f08831cf7499435be77eb886acc6f1c
TLSH
T159D0A7C41498676D8C240F5AF1E06DD63095CC33196A6810E6D25674DAF9DC84169D1F
MD5 SHA1 SHA512 TLSH

Submit Download

d138c7e7-a0d3-4dbb-b80a-933e3c83bc0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\d138c7e7-a0d3-4dbb-b80a-933e3c83bc0a
Size 886B
SHA256 c23e54c7d82b83764e82ed59fb8d1f80fb01a14ea6f3ab9876fbc18b2e75f955
MD5 230f4e91a600a5c8adaac0b451cec2fa
SHA1 a4d471807aa0a62784fe35da0d0a8861149df6d2
SHA512 74c32338def681b20534094577e7e63e9a201e9bb9bdef89a0fee90f142fc98b85b7275c575379353fd9f12c07fc6d7fd003bef0a07ad9e120097fe077b195de
TLSH
T10C112351D672BDB2CC2CD29B99D1B71657E5B023C0CA1918BFA49A140CAA22D6393B0F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
Size 6KB
SHA256 65432df030e8ea0eed7c5831a6c54a1b406cec402a1387b863b153ce1bc54e02
MD5 96eb1fcaed32e0c83e56e643c66cc21c
SHA1 8506a37646749064ffc2fca6cf202d619ec61fff
SHA512 e40354782aaf90addd96c55ae15adfe2b0536890ac16ddbf85efcc7433945fcd6ef4db1f5c1c18cd3a3486231a12049a5bb85c874403148d79808e98f4f2ab7d
SSDEEP 96:xHX9UTUq1qGqafuh761zS9bSSlIdv9j8tnlHw303tBw88H8L4cnQVJ:d91Rafuh76EbSSzw303tBw88B
TLSH
T1D3E12E7890088F7F74B6766CAC6889716AB2413BBBBF68C750B544C5054CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
Size 6KB
SHA256 7aeb5489da50fb8daf4dff7a3ec7deba7d569673f7a546ca89ad1e34eb84d976
MD5 34a28a4f92fafa36bcbb1d847b1c1785
SHA1 f9fa8da1926703bb49dd0c29353b72d79fccda58
SHA512 8a9c1f8ef419e09ebb6520114f9607b53d17d08df0d128f73621539169af7f6f16edb39ff0dd74722169df6f0d57767c1b190ffb8886c92f6502191a4f6ab74b
SSDEEP 96:xHX9UTUq1qGqafuKjmnjv1zSiSSlIdv9jenlHw303tBw88H8L4cnQVJ:d91RafuNDfSS1w303tBw88B
TLSH
T1E6E1207894088F7F64B6776C6C6888316AB2413BBBBF68D710B544C5054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 a2d145e9a3805148984964c3a777a460cf8f997335bc0c2c1acbca3b97248786
MD5 e0b4b35305087120e3e172ffd9ef835b
SHA1 7b2743d4be0b4d6b488dd50bac4bfc204fa71669
SHA512 dab4a17cca8688d4da29f4432bd172b8c4db4c9153106c50ae565f10dd4567141dd86bb96c9c9df9a34a7b8227da6de1cef99eec263b72e541604be2bf1be363
SSDEEP 24576:bE+OO/IgzrJ4rq6lZYDyrRLvcMIrQwdOWlr3Yt:bVbfJr6kDyrRjcMIrrdOwr3Y
TLSH
T10AF52AF820D2B357F3418033A64553EB21AFD00CA467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads