hxxp://loser[.]freetls[.]fastly

Resubmissions

21/04/2026, 00:43

260421-a23qxagw7k3

21/04/2026, 00:41

260421-a2aecsat6z1

Analysis

user interaction
yes
max time kernel
42s
max time network
43s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://loser.freetls.fastly
Sample260421-a2aecsat6z

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	firefox.exe
Token: SeDebugPrivilege	1352	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe
1352	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1352	2488	firefox.exe	80
PID 2488 wrote to memory of 1352	2488	firefox.exe	80
PID 1352 wrote to memory of 4124	1352	firefox.exe	81
PID 1352 wrote to memory of 4124	1352	firefox.exe	81
PID 1352 wrote to memory of 4124	1352	firefox.exe	81
PID 1352 wrote to memory of 764	1352	firefox.exe	82
PID 1352 wrote to memory of 764	1352	firefox.exe	82
PID 1352 wrote to memory of 764	1352	firefox.exe	82
PID 1352 wrote to memory of 764	1352	firefox.exe	82
PID 1352 wrote to memory of 4988	1352	firefox.exe	83
PID 1352 wrote to memory of 4988	1352	firefox.exe	83
PID 1352 wrote to memory of 4988	1352	firefox.exe	83
PID 1352 wrote to memory of 4988	1352	firefox.exe	83
PID 1352 wrote to memory of 1872	1352	firefox.exe	84
PID 1352 wrote to memory of 1872	1352	firefox.exe	84
PID 1352 wrote to memory of 1872	1352	firefox.exe	84
PID 1352 wrote to memory of 4380	1352	firefox.exe	85
PID 1352 wrote to memory of 4380	1352	firefox.exe	85
PID 1352 wrote to memory of 4380	1352	firefox.exe	85
PID 1352 wrote to memory of 4380	1352	firefox.exe	85
PID 1352 wrote to memory of 1880	1352	firefox.exe	86
PID 1352 wrote to memory of 1880	1352	firefox.exe	86
PID 1352 wrote to memory of 1880	1352	firefox.exe	86
PID 1352 wrote to memory of 1880	1352	firefox.exe	86
PID 1352 wrote to memory of 2204	1352	firefox.exe	87
PID 1352 wrote to memory of 2204	1352	firefox.exe	87
PID 1352 wrote to memory of 2204	1352	firefox.exe	87
PID 1352 wrote to memory of 2204	1352	firefox.exe	87
PID 1352 wrote to memory of 2956	1352	firefox.exe	88
PID 1352 wrote to memory of 2956	1352	firefox.exe	88
PID 1352 wrote to memory of 2956	1352	firefox.exe	88
PID 1352 wrote to memory of 2956	1352	firefox.exe	88
PID 1352 wrote to memory of 1700	1352	firefox.exe	89
PID 1352 wrote to memory of 1700	1352	firefox.exe	89
PID 1352 wrote to memory of 1700	1352	firefox.exe	89
PID 1352 wrote to memory of 1700	1352	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://loser.freetls.fastly"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://loser.freetls.fastly
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 1948 -initialChannelId {b5f8e657-f7ba-4671-b7cb-9e2cc6460b51} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {81d7a020-e92f-47de-a827-9f7c33e97117} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25213 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {8f808acf-5e48-4edd-9fcb-946c6de79567} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4040 -prefsLen 27323 -prefMapHandle 4044 -prefMapSize 270279 -ipcHandle 4116 -initialChannelId {f7214902-95d7-43fe-8f62-5256847c2be5} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3084 -prefsLen 34822 -prefMapHandle 2740 -prefMapSize 270279 -jsInitHandle 2772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2700 -initialChannelId {e92ce828-ca2c-45e3-8143-196d521adf44} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5044 -prefsLen 34903 -prefMapHandle 5048 -prefMapSize 270279 -ipcHandle 5016 -initialChannelId {2ae266ed-e18d-451f-9e30-a92e90a0b69b} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 32845 -prefMapHandle 5644 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2780 -initialChannelId {32d1014a-9511-43f4-a1e3-9ad6c65ee01d} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32845 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {1a2bc79a-d16d-4571-9c52-dc42f0f4b2d0} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5924 -prefsLen 32845 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {e706b18e-dbe6-43c6-9fd6-6b66afb91348} -parentPid 1352 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1352" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\activity-stream.discovery_stream.json.tmp
Size 22KB
SHA256 fe2c61ee4829295bd32bad57d5286014ff56e07a428a84489d7f42d4139a2f87
MD5 b23e6225528b31c08365097bbd8bf004
SHA1 0e50aee2fd67d3e1d944ae79e0aee46c31b0a8de
SHA512 dee6a7f314e14cbf33dff2c4bb3f817d2c547ce62eb6fed6c5b358db1abe6a403a093eb7bb329cb5f108c3d6193b2c1c2ead12e14f0f9eabcd8e8e819511e642
SSDEEP 384:dyatBe1eWdCXTDz1i4DOzb6PJFR4XhVRpBjXu+JtdMw:dyKd1jmbpXhPfa+jh
TLSH
T18AA20BA352B8F5FB0B907BC72C4BB5476BE24295E74402CDECEDC91C809D6D4123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 5950553e00bf188ee83ef245e4b818edc688abb39e217eb467147688f2c8a581
MD5 67c8885b791f19c3d18fc67173de47ad
SHA1 9c3604dafe7dec5f88e62bff3755eb2964a2554a
SHA512 01e0454289ba3f3ff149f15a7d6f2ddc2f4175e0e3238e0ec903db2d9248eceec183bc0f6e0ca75cc176032e4ad219c50685cd2064f84e3fc3663b5462308bdb
SSDEEP 768:ymvWvIIKsVqGcmhu8E9RMgvpES/brbmbZbMbX:4IIKmE9/
TLSH
T1D6D20244EB2A913FD41512BBDCA51B002F78F88A59192FA73A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 d7794d90e778230b08d8dc77274dcbe43b7f3752d0d4b4e699f67e4f5c245b55
MD5 cd1dd4e206f196b12275a678069f4d75
SHA1 e50e4d6dab20235bcfb7e71da522122ffbf57e79
SHA512 143476582fee8db6ae8ed5981f2351191f791cefd6862c98f43954f9650048a89e625f7c1e5486a7f5a95567cb31b71096ad621a335241151969a0944a08813b
SSDEEP 768:EotmnIIKsVqGcmhu8E9RMgvpES/brbmbZbMbX:8IIKmE9/
TLSH
T170D2F144EB2A913FD41502BBDCA51B042F78F88A591D2FA73A4C64686C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\events\events
Size 1KB
SHA256 726ba5d06d77873e22f97d781607262b22a4df328ffd99262d2256eae9bdc9a1
MD5 0e7386ac0172b545dd825d4b06075cd4
SHA1 8dfc2c9756722d46054083692f5749d8469aff4a
SHA512 b4eb042abf8387f26acd5428262fb98e606f4e4883cb35eb71b971bb9b0e2ad40afa3a0c4e0bb1e38dfd3c13528ec12628fb6155f65076030951c7e5a6ba3497
TLSH
T1F9216A6C39B9CD2AAC97E69D7540038E53518E0A55871D430E13DE8CCCA5EE9326A47C
MD5 SHA1 SHA512 TLSH

Submit Download

3fce1280-a517-49cd-b21d-5b50dbe1d203

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\3fce1280-a517-49cd-b21d-5b50dbe1d203
Size 871B
SHA256 e18d3a2376f2d56e97a9b509d4494ad0ccb4054e414464bbe12a0e6aebf8eca2
MD5 8f4fa202e23a99c2db5625ae30cb17a0
SHA1 a1200a3b77f0c9c86193b39a5fdcae7bf2e4ea89
SHA512 5ea7d524dede53ff3ddc140ccca9cad2ca678c81bb66058e1b29933c0fd83ae254f541ad5a2c19af0049e0bf24cbd73a8b884368a84d307404825859562b8977
TLSH
T1DA11EF81C730B5F2CD28D34F86A63B215BF4752380CE44283DA19E140D7E92EE796617
MD5 SHA1 SHA512 TLSH

Submit Download

49fd848c-b579-43ea-86c9-2eb98a42bd56

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\49fd848c-b579-43ea-86c9-2eb98a42bd56
Size 235B
SHA256 205420c89696e91292caf266823280d2d9634d8d22cc76b882bd1debd4ad6909
MD5 1f3d3b3e1549ba79cd08d5a0211a5477
SHA1 50f180ef1b25ad937cf4e84c3f6f01e6a4b0c8bf
SHA512 4f1054618ab66766995589f6012ec530095db28426d2accb90eab3a16c5abf5de189b6603c03859d81aa6cca33f822212730bf8081f0eb8d01bd2477247e15fb
TLSH
T119D0979A24C8675E08080F06F0A068C630984C3B5071D8109A514278F9BEEC8025192B
MD5 SHA1 SHA512 TLSH

Submit Download

6368cc65-18ca-4af7-8d2c-5520659d9374

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\6368cc65-18ca-4af7-8d2c-5520659d9374
Size 886B
SHA256 e414100d6ace3770aaf60f6b84dfdfb348e31e5c64ed9a79ee8a57d77f4806f8
MD5 fc0069816edeb4a491839fd679bcef39
SHA1 ffd71cc4c9ecf6908a8ed18f24a41a96a40625f0
SHA512 6a0f7de0741322505effa7ae07b43fdde37a2c80438a0d288d88bdc1b02f1cbf56d77d5e514b97acb622ccc624f8b55d555171e668ba72d06223326b46470076
TLSH
T17111C080C674B5F2C978D39B86A137425BE47123C0CE0C187EA18A184DBA51E9397617
MD5 SHA1 SHA512 TLSH

Submit Download

9f8dd797-d20a-4625-a0a5-a7bc3b160175

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\9f8dd797-d20a-4625-a0a5-a7bc3b160175
Size 235B
SHA256 535a91d5395a0161291cf1bda12e9a060fb6d40af8db8c8e887e3109f25ce48e
MD5 405a0c72e0a9f4573d8fd31b61582488
SHA1 77ff41d7627a86ed86b164898751f972d944a279
SHA512 9fcbbdc95d8aea4b980b15621dcb793cff27da0e805e3d3c9cfae4d393ccf7a70449a453a2a4a20c66930092ba10b32d025fd6b3cd4054725d290c48fa714698
TLSH
T193D097807898736E88240F1AF0E12EC630444C3764A56820D59141749DFAFCC4222C0B
MD5 SHA1 SHA512 TLSH

Submit Download

d5f2b20c-316e-4c7e-98f3-ad5d3bc39d92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\d5f2b20c-316e-4c7e-98f3-ad5d3bc39d92
Size 2KB
SHA256 81b0616057dde95bec6b47f5bcd8e121ba6ba3528ff508d68b4324a5ed62cb4d
MD5 79a1f3fa68a029965de2609b93c0a3dd
SHA1 a0f17ed1e7f19da3b0581ebc3ec21580a80a3301
SHA512 3f2002f8867329463e90aea66bae2d169d1b7a407522bb4947744908136d043d53d622bc2a384524a2eaa1920197777ae3b8ec8240d4e40fc7ffab4ab87dbf71
TLSH
T13441479C75785CBB9CCEE54D9482334DA7619B4340CA1D832E52CF0CCC966DD736A42B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 7KB
SHA256 c61ef18c5c45a936d1a67422fa2e3c44a85160e8b955cde26c43e2c9ce5694b6
MD5 3c620aaaae821f40234d054388c92223
SHA1 e2faa5e9edb2a6ef2a3e59b0e068423fdfb8e1fc
SHA512 61e7d1b9d806ab84e33ccf2b75b3c2e6ea79d14c69d8a437dc7e4f88db0a9814b6e2c425cf41cf7c5dc160ad059b4854de068e61cc02ab1660b3a0ccc1ed2941
SSDEEP 96:xHANTUHqGqXfUGIObzSBiSSlcdv9jsS5nSH3MkNNrQBw88H8L4cnEVV75:qrRXfUGI3iSS93MkTrQBw88Xf
TLSH
T17DF1207D9004CB6F74B637ACAC6889305AB2013BB7BF58D700BA5485055CF3481F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 bc6787e8d3e81a4c296d8c5c4ef64d39b49392e90031d3f3250c7d8b54d031ea
MD5 4fd4b8eeca1e5832b6f3f22f13b0ee4c
SHA1 cb32d9f70253b0ddea2d4a021d81e5421f793f44
SHA512 ffcb04fef9c2809a0d381312fa830a26b1c054836d5fe2625a3d335f92ff58688f0d0825af22e256c84e9a121bae198e254b13189472252a252dd1c09f873256
SSDEEP 96:xHAUTUHqGqXfUGI1zSBiSSlcdv9jsS5nSH3MkN/Bw88H8L4cnEVVV5:qaRXfUGIEiSS93MkRBw88Xt
TLSH
T142E110789018CB6F74B677ACAC6888316AB2013BBBBF68D750B54485055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 3ff15ebfbb4b92dbca133e7d790739dfa9809574bdee917793f703c17ff51066
MD5 77b424fdaa669375740319c2461f4148
SHA1 e96f2ec80d702c944b646f18dea83f211602b12d
SHA512 140d3a402dc16be19765d6bfa118cb3b7eabb6c9a49f1e9d22421d6cdedb917f9cd8e2de81271e47b520563032ef6b614d75489afff043e257dbbd97c6678403
SSDEEP 96:xHAUTUHqGqXfUKjNnjh1zSPiSSlcdv9jsS5nSH3MkN/Bw88H8L4cnEVVV5:qaRXfUadSiSS93MkRBw88Xt
TLSH
T183E100789018CB6F74B677AC6C688C316AB2013BB7BF68D750B54485055CF3882F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e4e5a3684f090795897b146477d0702d92bb6913912f35cdda70b68c51c23e0b
MD5 b2f0fdffdfc210072e13d95d71268932
SHA1 27fb754eb815bbfd368d67188cf62e6ad98a071a
SHA512 a9ab9766bf269a3a52b251664a3f0bb3409d0c077d02312a0f716b3b591d58973a02efe886a466e91a5f31a9f3fda360d15675fae43f6e94c851e58de963bb8e
TLSH
T17221EA96945F2DF0BA61914DE0484BE393A8303284F51C70C44D4F4625EFD9B3396739
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads