hxxp://h | Triage™

Analysis

geolocation tags

eueuropefrfrance
max time kernel
898s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://h
Sample260420-trm29ab191

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe
Token: SeDebugPrivilege	640	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
640	firefox.exe
640	firefox.exe
640	firefox.exe
640	firefox.exe
640	firefox.exe
640	firefox.exe
640	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
640	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 640	1416	firefox.exe	84
PID 1416 wrote to memory of 640	1416	firefox.exe	84
PID 640 wrote to memory of 780	640	firefox.exe	85
PID 640 wrote to memory of 780	640	firefox.exe	85
PID 640 wrote to memory of 780	640	firefox.exe	85
PID 640 wrote to memory of 2784	640	firefox.exe	86
PID 640 wrote to memory of 2784	640	firefox.exe	86
PID 640 wrote to memory of 2784	640	firefox.exe	86
PID 640 wrote to memory of 2784	640	firefox.exe	86
PID 640 wrote to memory of 4980	640	firefox.exe	87
PID 640 wrote to memory of 4980	640	firefox.exe	87
PID 640 wrote to memory of 4980	640	firefox.exe	87
PID 640 wrote to memory of 4980	640	firefox.exe	87
PID 640 wrote to memory of 4316	640	firefox.exe	88
PID 640 wrote to memory of 4316	640	firefox.exe	88
PID 640 wrote to memory of 4316	640	firefox.exe	88
PID 640 wrote to memory of 1620	640	firefox.exe	89
PID 640 wrote to memory of 1620	640	firefox.exe	89
PID 640 wrote to memory of 1620	640	firefox.exe	89
PID 640 wrote to memory of 1620	640	firefox.exe	89
PID 640 wrote to memory of 1844	640	firefox.exe	90
PID 640 wrote to memory of 1844	640	firefox.exe	90
PID 640 wrote to memory of 1844	640	firefox.exe	90
PID 640 wrote to memory of 1844	640	firefox.exe	90
PID 640 wrote to memory of 3204	640	firefox.exe	91
PID 640 wrote to memory of 3204	640	firefox.exe	91
PID 640 wrote to memory of 3204	640	firefox.exe	91
PID 640 wrote to memory of 3204	640	firefox.exe	91
PID 640 wrote to memory of 212	640	firefox.exe	92
PID 640 wrote to memory of 212	640	firefox.exe	92
PID 640 wrote to memory of 212	640	firefox.exe	92
PID 640 wrote to memory of 212	640	firefox.exe	92
PID 640 wrote to memory of 224	640	firefox.exe	93
PID 640 wrote to memory of 224	640	firefox.exe	93
PID 640 wrote to memory of 224	640	firefox.exe	93
PID 640 wrote to memory of 224	640	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://h"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://h
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27099 -prefMapHandle 2032 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {3d767bf5-c1b3-43c7-8026-d36cc1353a7c} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {2cfe4b3f-d8bf-4618-88eb-a25d304e4cce} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3896 -prefsLen 25164 -prefMapHandle 3900 -prefMapSize 270279 -jsInitHandle 3904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3912 -initialChannelId {9dc25ec5-28e2-45a9-a849-966452b73b73} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27276 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4136 -initialChannelId {3b9c5ada-1c3d-445e-868a-7d23e733dd4c} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2912 -prefsLen 34775 -prefMapHandle 3244 -prefMapSize 270279 -jsInitHandle 3248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2856 -initialChannelId {8791241c-bb09-484e-9471-f4e9091ce15c} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4900 -prefsLen 35012 -prefMapHandle 4908 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {a093ab5b-1ae1-4611-a143-2f8035d32078} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32900 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {1bf6fb0a-fa35-4f2f-8c88-cef9cace7ce2} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {aba83d8a-0bc1-424f-8922-32e84f4e3915} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32952 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1644 -initialChannelId {8c394585-81be-4e8a-87a1-f8fac6a1ad36} -parentPid 640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\14tbp3gd.default-release\activity-stream.contile.json
Size 5KB
SHA256 ddecf158b57bd008d0bdb087e3c573178ef6112106fde25f399185aa856828e3
MD5 656c4dc41f76e26e04001d132d663fb2
SHA1 4efced0ece63e014c1ac2a8710165ec623e30e08
SHA512 13c7c05106db401523fc45359cab89a050d15227c90d88151ccdea4ce94674111c32c8e59ed4b916490261127dd14f897894179daff7ee4208e277118ec38279
SSDEEP 96:LDytn3PZYvsuJiKYolW5O1M6DQD9ax8jzsvA1pP7SopO:Lutn/iJ7lWGMwQD9ax8jDXzSuO
TLSH
T1CCB13AEFD8B5C4874B627BE03C4F13BCF102E677DEDA885AF384CC2192A9216416E940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\14tbp3gd.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 e2cba9acf778f707d6ffbaf2a2040d5f3ac018581c66b4e9210416fa8a1a67ae
MD5 cc90f7ae68a8bb24541d10b3f85a8142
SHA1 c61376eae500aaeb200f4399bd9d146590b60a78
SHA512 95a577fd46c9585b774fd54c13ecbdfda7abb563cf7978a833a9803c71afd6fc6f487c5c48c68485685e69febcdded4f3b434e8e72f7ce2db9c730e85b77d5f7
SSDEEP 384:HbaFrLiO024YIFuhw+5EL1pPsac4j0lpDII+v4o4m:7aAZYIFuK+5EB9sac4ID8L7
TLSH
T140528D7E9F0138BA1A2BD294D8E95608CE04D6BBEEE2D06205543849C7847BCB4F60DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 5KB
SHA256 38c241a1609fcbedf81decf67519e8455860e914369511e905de871ff300a80f
MD5 1ad2b29fe2db1bb44b7186d0ef72f59a
SHA1 022cd7afff19902909a0ca73cf392f1f1f47901d
SHA512 114ce55b83dfd3efe0f74338b878af9929ebe55b1eee9976029685de1b66a219657c6d1900834a37664cd3a3f738b3226470979624b01bb299f16a8323f46dab
SSDEEP 48:wmd3J5Ugdwn11z6pd3J/6Bdwn1aQ6/d3J/adwn1xX2:7N/sb/2
TLSH
T13DB1DD011BFA0E96F8F383313A3177566373FC01576B5A5EC382A2850A7279095ADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 beebdd8f5b6b1523d729013e9e13ed72eabc144b2a48082c98af3c18162d7140
MD5 9f8524a8afd2d5d56b841f969235f399
SHA1 babbc94d5c3c5d4d4e9881b44d5ba858aea6fb1f
SHA512 f674c41a36bdd81c69cd5c1c0354c1343bcb6e734c7cba3e0149999c0f03c62f86da395e5980edcb704c78ed7f3e625fd15c881a5a364eb796e05a9e577a137e
SSDEEP 192:K91d66JozGzgCl6mc0dCOv5zboPml8FyjeUx:Ad66JozGzgC1jrboW8Fyjt
TLSH
T198E143A4E628863FC414127BCCA62F414F36388A988E3F19359C659C3D572DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 647abf2b59de60186d1971e3a535709bbb32c9ae67f1524790927b82ede7159a
MD5 1716235486b281c14dd48ca0a67394fd
SHA1 6d32c40c03471b86a9f23b6175a52c2239eb3b0b
SHA512 8d52cbe64de2fbb33af40a2e153c352f047422ecd7941f48997357bdceee2f349ecc530b6b84d55006d84839a02283470eb0b7c7dee7453b348e6cabaf5f928f
SSDEEP 192:K91d66JozGzgCl6mc0d1Ov5zboPml8FyjeU:Ad66JozGzgC1jAboW8Fyj
TLSH
T1B7E132A4E628863FC414127BCCA62F414F36388A988E3F19359C659C2D472DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 1b1cd9a8c98d2d6a7719556a793c492ef1fb2b151f617acf984a3e406a12f41b
MD5 bcf57dbd0f1f1b8cd9b2bc7d5bda066d
SHA1 064a3c760440d6a223b0ad6a36c91b269cf8e9e9
SHA512 60408a323f759ac9059667a2a41844648625a8ec9d0e04c1ccfba007db2159de884fbf1cedc9a6f3f2d39d2f63bd12c830a2982a8273ebca8a55b7ddcd67aa70
SSDEEP 96:KZFW2FRFLF6Fo/dd66JozGzgClKtmc0d/UrSdF95/7bkW60rcE8FyUR6wx2WZ:K91d66JozGzgCl6mc0daOv5zbowb8FyO
TLSH
T1BBC1EC64E6284A3BC445023BCCA52F400E36388BA88E3F1532EC659C3D572DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8c4cf22fde6bbd5e47afaf35a8685080426f88c56d86f144860ffd1c29972c5d
MD5 c7ef77dedb615261c029d4f9ff3f0c2c
SHA1 1d906deed07966638a057a4320c5e90faf6ce373
SHA512 3bec27c47d851d23db147c5fc3cc37dfc98c986b443069ac9c6cf519c4095b697ee997c9f472391890f6305702b641e27c9bde8fb5f25903fefd2e1721a8264a
SSDEEP 192:K91d66JozGzgCl6mc0diOv5zboP2Z8FyjeU:Ad66JozGzgC1jvboeZ8Fyj
TLSH
T1C4E132A4E628863FC414127BCCA62F414F36388A988E3F19359C659C2D572DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b47f7cbdd2945eff0616c72d99985602b4b742ca0a154ba1006c9b01fa15c976
MD5 8b9a291fbfb09d3efedad311252cb82d
SHA1 6061654fd12aa766b779eeee1afa3d7047629001
SHA512 428fb000277416fb4b61064a63df4b20a8a61431be9969ee580fcd82b3e8e3c6aaab1104a6b4eee511069323b0f489076ca58cde6dd528196ad2ce53254c923a
TLSH
T17A217C5C3AB98D6A79C7F2DC7841078E53518E0A44D71C430E02DE8DCDB5ED9326A57E
MD5 SHA1 SHA512 TLSH

Submit Download

16a8f4b4-0cca-4c97-9847-ddc19ac34191

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\16a8f4b4-0cca-4c97-9847-ddc19ac34191
Size 883B
SHA256 af757f9ba9811daa2c4051a2aefdf4543fe0a395f2953818b323af3954ef29f6
MD5 9451a9a278687f9befe1002b18ecc092
SHA1 81c5db4a94e0ebfc46831751cc2a024c14e33ea8
SHA512 6f1eb3e3c64e4e381f355e591f84e210f2ca000d64950ba9cd4b74b3e5b78e4403499f2997650c13c95a0c529a9c51abf85991f9ff8240e370a4cb420b534eba
TLSH
T136110CD1D334B9B2CD68E2ABC59037068BE47523C0CA84143FA44A1C0D6B52EE39A61B
MD5 SHA1 SHA512 TLSH

Submit Download

666ddadf-10aa-4b60-a692-6be38a89625d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\666ddadf-10aa-4b60-a692-6be38a89625d
Size 235B
SHA256 6d838b6d1ac57e23843ee443abc712c492c15f1b266e43f7663b35e7a945e68d
MD5 e0884e32f9e85ab9e61d0fb77c349803
SHA1 aae58244a9ccbb40b5a010553226e6775a0a8053
SHA512 3849dc47cbc5c05fe517744c48971e088c7dc46b9f76c7bc86897568ab42c0b79df059f9234b46d3f80db60d80e5d3b28fdcd100188fe0479386a08a91d48572
TLSH
T11BD097801CC873EE08284F2BF0E0A8C330894C3318B05810DE925A789AB8AD841A1C56
MD5 SHA1 SHA512 TLSH

Submit Download

bf30287a-e3e3-4614-ae48-a4180eb5f300

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\bf30287a-e3e3-4614-ae48-a4180eb5f300
Size 16KB
SHA256 b8ad5977d8b981a8e6d58fad68c876c5d19303a7a36e3d8bb6903395f60f7ac6
MD5 93649e6502798673eade5177a92ab4d0
SHA1 35ef9191133130ce7913014880b2126030857980
SHA512 e42f664c144f28a58db5bf119024610de5ad215810b1e3cedb7c27d14c08090ba2572a1b56764ecab822f096309fb0fcf938fa6a0180f94dbbafff77b20a94e7
SSDEEP 192:RKR4QISM19BflCvGxcAwJ+r+PDhYc43JsE5b/llgwHFUEsCWbLFiBpDRczxSUwmE:u4QILRaGjcJD3CgoDRclSUwxKi+y
TLSH
T1A372D9565860497A8291E3A894F8BFC3D6F538CF4C028FC997E4BD086DDF06D512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfb4903a-f744-4ee9-be18-5c67e6394677

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\dfb4903a-f744-4ee9-be18-5c67e6394677
Size 886B
SHA256 bd2f3cc8497da23b725b8fa1a54cddbf57df8811d39ce9ccf8c6f19772a29978
MD5 c5d3cc7bda0416bb8f10a4e77d0dcf73
SHA1 ad2a6efff217b5fb29219999082ec45a2dee83f2
SHA512 ad4673d274e79b791812d43e4e4bf1fde6777c3b7a9b79d059f5355368a0f0d5da26a99394c88d73b29efb5204e3a1c7400a3314f6357589550f75bebcd4ff66
TLSH
T10D11CCD186707AB28D78E29BC5E1B7438BE4712390CA09147F658B1C4DAB15FA39A70B
MD5 SHA1 SHA512 TLSH

Submit Download

f10853cf-48b4-42fe-8c1c-036f807d9507

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\f10853cf-48b4-42fe-8c1c-036f807d9507
Size 235B
SHA256 26d5abe96b36945cf18058eca5478fa0c7ff6cd24400986efb6087971eade7b6
MD5 6258fb402ea9cf9c23846e6780b89c78
SHA1 950956d1d8113d247d3a6d80647ebe4faab7fdc0
SHA512 f61f0f5162dbf080aeed833f5a60c5ca977d7b041c74c876894f4fb94a023c041f315101b0f28229bd50c79621cb8e339651b191d1afa8da9675858f930d82dc
TLSH
T1C3D0978224986B9E08100F03B1A068E734444C3360F99860A6510578E9B89C802A1816
MD5 SHA1 SHA512 TLSH

Submit Download

fae60439-0615-4cf9-aa54-f1a97e2c8697

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\fae60439-0615-4cf9-aa54-f1a97e2c8697
Size 2KB
SHA256 bed4d3edba43e823b0f1be8f9463d7a36757c4ee40233b9235fce56946363f59
MD5 ff472bb2b99d4883e77240768b860d15
SHA1 da5a37026bf44348fc153258f61f76d317c90966
SHA512 3e9ca71051c7d8f6a90819dccece3446273f3e8f0317675bde329f0e6f99d236f97654bfcc5d43fe296c02c81b240c9b99c1ce476b7f76117717e260ae2e21de
TLSH
T11C41329C75788C7B8CDAF19EE481338E43A54A4340C619536E51DF4CCC926EE736E92B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\extensions.json
Size 16KB
SHA256 4da5c5fbcc35f2a1c95c9ec52f2ff677a6a921295d09c2c57885056a1f9bd743
MD5 84bfff2e1cd1d33bdcaad885187e3f6b
SHA1 bf9a8d984849c67b32440d06b1e2109aa38c8367
SHA512 043ba28701d9744fb889929163f22889d15ade19f4eba5d373c68cd539e38912ee7451055be2deef7831ecb2969e1522da6125b5c9e80ce467090d9f1cc56c92
SSDEEP 384:FZkI4vXUmldvS8dhWH94zH96oVL4HNL4P8L4H+L4HCL4HRW4hR:cI4fRfXXG4x6+4t4u4k4Q484H
TLSH
T16C72531545049EB8298FA79AAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 8KB
SHA256 dc8c61797438a11bb1f7f769a48b5a29fb09441b4d7a34c61159f319b337c4dc
MD5 255a30896bea49c52aa0abc123b035c5
SHA1 faf1a594889aecedbdf0c9cf25afd267556bd1df
SHA512 8f6de61d9851cbcce44108253fe9e3eb608f537b1574da0e813f770b5aee1afc343006a6e6ecccc10129ac21c284f034b8e587149bbde2e6b5c2adac919bcd90
SSDEEP 96:xHJsNTU9qGqvfbWCIaqObzSoSSl8pdv9j7nq3RWRPUWG92lBw883lv8L4cnA8b1:MdRvfbWCIaqiSSGW8RPPIQBw883lSp
TLSH
T1F7020D785144CF7F74B236BCAC6889715A72013BBAFF68D711BA4885045CF3441EA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 90265ac755409359c31beb4bbe5126edcae02b07d8f8c6cf5fee121fc9e332d0
MD5 23bf7bf3d805a0ab1137996824c337d0
SHA1 7fdb33378c756fae5ddbb8844cd9c30184b33ef1
SHA512 05b7121f07dfcca21ad87db5df078d74eb8d5b153b3d27b0024e5ff9fe8c57171707a39c9f2585fbfbf1240c1f990fc3d009e0a23725e403c49f32a1c73dc941
SSDEEP 96:xHJsUTU9qGqvfClKjwnj21zSpc0SSl8pdv9jRAHCTnq3RHKG924Bw88n8L4cnA8p:MwRvfCl36oc0SSGUHCk9KItBw88ap
TLSH
T169E12E7890088B7F74B677ACAC648971AAB2013BB7BF68D750BA44C4000CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 adc7875ab1e75eaf107f5703b2dec1e28d79fa723299822728e2a92dc10f2a44
MD5 81fd15e61bdc790e596fb8d832814fbc
SHA1 d578a42618f6a11ea10a92734c4e5bb9bd6e0f7d
SHA512 d20ed213aaca688fbff7299e096a9c03f7c7516d64bd37b9d5fd0de5b51a9daced171476c0d4740bd09f76621e909858ed0dace5a222065a7757e77bb5cccfd9
SSDEEP 96:xHJsUTU9qGqvfClIaq1zSoSSl8pdv9j7nq3RHKG924Bw88n8L4cnA8b1:MwRvfClIaqZSSGW9KItBw88ap
TLSH
T16AE11E7891088B7F74B677ACAC688931AAB2013BB7BF68D750B544C4011CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 84809ae1cb798caccf9461a79101b647ef40ff4c4036759f3695e9d7575a528e
MD5 a7817171b03ff3163a58f7b6131e2a9c
SHA1 d9484cf5b4bca02a3e16e1f7abe6e2d6d9837ebd
SHA512 1037b4438cdcde3766a2c2a0f61e69b8b125dad6777b2ac14d2f5a90b72c4b95d022cdb0f6b69369b977bf3c659c31ea81213a832bde3fbfc32507f819a382ec
TLSH
T10B21EA479D2B2EF1BA73D09AC4CE4FF2C95830B18D618CF0D58E4E415A9A81963C561A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 eddb3ecc6b2f7172fe670ef30eea5266ab605a1391d620b332f5cd3ca078d9df
MD5 fc61bb40340e850a291c6711237fbe09
SHA1 277219d07adfceeb6d15c3c8226f1b87a90b4690
SHA512 aeb489d3e7e6a17030de8ddb059ba2c298823079de0a3ad5d0f77f7020daaf208ed25b1cffed0d5dce3f6a583aae5fd65b1325df79f93b3d939512334bbce82c
SSDEEP 49152:BykaRVaAIoW8zN6wlAb+Llx2I0YD4HcjDwF2fXBMnrMau6NssnTj17YRIrIddjxo:EoEfnjFVKcMgU9RY2
TLSH
T14A565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads