175ba47374a454c690258b0d9d25b81c2133d0deccf9e5f1a9993c8ecf24099b

Analysis

user interaction
yes
max time kernel
67s
max time network
67s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-uk
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-uklocale:uk-uaos:windows10-ltsc_2021-x64systemwindows
submitted
26/04/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scripts.lnk
Size 2KB
Sample260426-flcgnsd16x
SHA256 175ba47374a454c690258b0d9d25b81c2133d0deccf9e5f1a9993c8ecf24099b
MD5 12b71bcec9cb8254176a8d2408ba7468
SHA1 93d38ee0a0cc454c0a496ce69a660666db73cdeb
SHA512 c17c706a5cdb77864ae5a88af6407227686fa995db7ec334f7a5a121a9afb4a54ff60a8acfe07622ed3870766d70ec9dbe08739926b2b9113ffff6a5bf1315d7
TLSH
T1EB4140102ADA4722E3FF8CB512FB7660CA29A792FE824A18818500952DA1B15DC34B0F
MD5 SHA1 SHA512 TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5192	firefox.exe
Token: SeDebugPrivilege	5192	firefox.exe
Token: SeManageVolumePrivilege	4904	svchost.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe
5192	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 5192	3024	firefox.exe	85
PID 3024 wrote to memory of 5192	3024	firefox.exe	85
PID 5192 wrote to memory of 1068	5192	firefox.exe	86
PID 5192 wrote to memory of 1068	5192	firefox.exe	86
PID 5192 wrote to memory of 1068	5192	firefox.exe	86
PID 5192 wrote to memory of 3208	5192	firefox.exe	87
PID 5192 wrote to memory of 3208	5192	firefox.exe	87
PID 5192 wrote to memory of 3208	5192	firefox.exe	87
PID 5192 wrote to memory of 3208	5192	firefox.exe	87
PID 5192 wrote to memory of 3036	5192	firefox.exe	88
PID 5192 wrote to memory of 3036	5192	firefox.exe	88
PID 5192 wrote to memory of 3036	5192	firefox.exe	88
PID 5192 wrote to memory of 3036	5192	firefox.exe	88
PID 5192 wrote to memory of 2560	5192	firefox.exe	89
PID 5192 wrote to memory of 2560	5192	firefox.exe	89
PID 5192 wrote to memory of 2560	5192	firefox.exe	89
PID 5192 wrote to memory of 5580	5192	firefox.exe	92
PID 5192 wrote to memory of 5580	5192	firefox.exe	92
PID 5192 wrote to memory of 5580	5192	firefox.exe	92
PID 5192 wrote to memory of 5580	5192	firefox.exe	92
PID 5192 wrote to memory of 4088	5192	firefox.exe	93
PID 5192 wrote to memory of 4088	5192	firefox.exe	93
PID 5192 wrote to memory of 4088	5192	firefox.exe	93
PID 5192 wrote to memory of 4088	5192	firefox.exe	93
PID 5192 wrote to memory of 4092	5192	firefox.exe	94
PID 5192 wrote to memory of 4092	5192	firefox.exe	94
PID 5192 wrote to memory of 4092	5192	firefox.exe	94
PID 5192 wrote to memory of 4092	5192	firefox.exe	94
PID 5192 wrote to memory of 1392	5192	firefox.exe	95
PID 5192 wrote to memory of 1392	5192	firefox.exe	95
PID 5192 wrote to memory of 1392	5192	firefox.exe	95
PID 5192 wrote to memory of 1392	5192	firefox.exe	95
PID 5192 wrote to memory of 976	5192	firefox.exe	96
PID 5192 wrote to memory of 976	5192	firefox.exe	96
PID 5192 wrote to memory of 976	5192	firefox.exe	96
PID 5192 wrote to memory of 976	5192	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Scripts.lnk
1⤵
- Modifies registry class
PID:4240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {7e797519-c34f-44da-84e6-d6daa36d3619} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27136 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {c9527c23-5a29-45cd-bf02-168279cda356} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 27277 -prefMapHandle 3752 -prefMapSize 270279 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {e93e98c8-76a8-42de-b0e0-28b3cd1f1dfd} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27277 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3936 -initialChannelId {baad8d8f-705b-4c0c-a3af-77b09000476e} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34776 -prefMapHandle 4472 -prefMapSize 270279 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4484 -initialChannelId {9bf62220-9bd7-4059-81b2-0dc7726e4606} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4648 -prefsLen 35013 -prefMapHandle 4904 -prefMapSize 270279 -ipcHandle 5016 -initialChannelId {0312b2b6-b61e-4ddc-ab82-666b3faaeeac} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32900 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {21bba647-7490-481e-a64d-53e50b178280} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5328 -prefsLen 32952 -prefMapHandle 5428 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {554c29ca-5eee-4389-944a-f914e6ec6df4} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {f55b3565-9987-4298-ba32-256e9b92494d} -parentPid 5192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fsufqe7.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 36119fec0ea31d65462c6f04188dbbc145dabebb15447cb077b3e5d623fbd80a
MD5 b7a88d2563a00c54112bb0cee720adc1
SHA1 e3f4367b7d6f6af7b3bfb7cd1b393b79ed8e5a99
SHA512 1063e1a83105e4688cc54ffc5ced8c5d68f2eb896767a56152d214d2b9e7fb4d0eea9e071da3daea554cb6e8c2deb2a0ca5c7ddb1c2668efb54027e2b51923df
SSDEEP 384:HbaFrLiO024YjFuhw+5EL1pPsac4j0lpDII+EZgZh:7aAZYjFuK+5EB9sac4ID8LEOL
TLSH
T195527E7EAF0138BA1A27D294D8E95214CE04D6BBEEE2D16606143844C6807BDB4F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 4330a401d7ef1bad22f1af42f2ab9b8785ee31a520eb3199e191442805968dac
MD5 02580b01ecf228879f161722c44fbaf2
SHA1 32d4ad4ad69669988137cf2dc8d5633f8ab6027e
SHA512 8974a0493123d911fcbf6ff0cbe8a4e8a97940328e57a53953a9a0317068c8ae9d71058073deb639c989063f0bad3ccce0a70f72d22a6cdb3001c28cce38e044
SSDEEP 768:l3DlavcbX+LVGcmhusUKwVVF6j0m3yukb7bwbhbNbXbHbXb8bQiYr5LUXPv:5lavcj++UuiYr5LUX
TLSH
T118F22144E71E953FD42902BBDCA60B002F39F88959592FA73A5C64286C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 f23d93e3e078e87546aa033506610d0ddca4677582864ee520e2b63ec516f7cf
MD5 430918659e50a513672a6c3fcedb5098
SHA1 082d0416284d515f89963a0cd60ddabc7d2c3dff
SHA512 e6d43b0d1b9a8f89f8a6f7443148ca4d8e7edb1ef3c108223b8b5bfcc0096756ad64ac314fdfe6546af7ac2ece80eb74680b02c6845e48a2ac8547e23261b329
SSDEEP 96:YFg2FjFIAFRFd/dd66Joz1zgClKtmSSd/UUSdF95/7bkW6BrcELPyUR6Dx2WI:C1d66Joz1zgCl6mSSdPOv5zboBbLPyjI
TLSH
T145C1EC29F628863BC408023BCDA60F511E76395ADC8E3F2532DC244D2D572DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 32a91b6134da3960f668f06703ed10e9c5e69f4a1f0b83f14e729b5aaa033ee8
MD5 734abf841b6636162f6664c52f756e64
SHA1 da309ac03ecb5dd315d14e9875818f58c931a5c4
SHA512 2656e87b9d9c64fdf4479a3ac27b7e069ea064cb804c082a9c1984cf3b02534d0dd9585a4050a3f00c3b579715ed90a742933c4a50b2e1346000d6930c5f4df7
SSDEEP 192:C1d66Joz1zgCl6mSSdNOv5zbovZLPyjNh:Md66Joz1zgC1bkbovZLPyj
TLSH
T1ADE1ED69EA28863BC408527BCDA61F410F35385ADC4E3F2535DC644C2D5B6DE3A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e1c793da858c32628a945c6fde10ddf8e0de69f65c438b0c99b65e20f246991b
MD5 27d18305403c85b41c48f12d88005e9c
SHA1 83144f2702b92fef2857c37782650d1899a972c9
SHA512 b5d28a61aacc1247e9c24e7e5cfe35f00329addc2d036db8a9e90d36ae6630f1e5732cc31d8372f85d52aced34ed847d4bd0e112b9feb2fa99c3e9dd1794060d
TLSH
T1F921ACBC39B94D2A5CC7E2AC7556038E53654E0314C71C830E12EFCDCDC5AD971AA678
MD5 SHA1 SHA512 TLSH

Submit Download

27fc5945-5463-4517-9fa3-374cab6719a5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\27fc5945-5463-4517-9fa3-374cab6719a5
Size 886B
SHA256 277a364df3e1816eed5b7f3398d47ee0bb997d8ef7e81f906e2de11c3483e808
MD5 c36974209dabac3a5296a719a4e1153c
SHA1 0663df4ed3da21616a3207b882d0debdc332a9d7
SHA512 c6b92a79f58c5f56bca7ef377a79550e57edd12fe83ef3a1071e6c2400b509eb9d7d87c145950f8eac037f1fc0c80f14bcfa3e3f016ab3f2b71a00012807f6a8
TLSH
T1141140529A34BDB28C28D3878AE17B434BE07023C4CB78007ED01A1C4DAB51D53E2217
MD5 SHA1 SHA512 TLSH

Submit Download

3e028f40-e837-4197-8119-6f9a21cc8023

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\3e028f40-e837-4197-8119-6f9a21cc8023
Size 883B
SHA256 10329855722b285df23139aa365c1ec20aa2f916976b56b0b14594f2b7e18201
MD5 bd863c9564e0d459bffa21c08d8814a7
SHA1 ac51269381071ec463130d3905cade7a7d7f5512
SHA512 a3bf492af077a79869db61750942750fb5fad4941abd85085d411a6aaacf2c80b729b568b3a9b157287375ff11eac42a32cbcce02f63f8b0e695669397875689
TLSH
T13E110046D675B9B18C6CD34BC9953F435BE87923C4CBA4107DE01E184D6E51D83AB28B
MD5 SHA1 SHA512 TLSH

Submit Download

5d8a7f83-4d09-4d6b-9d8e-1744a22a958c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\5d8a7f83-4d09-4d6b-9d8e-1744a22a958c
Size 16KB
SHA256 14096e8968f95853995d9cb7289c8ef47878f28636c0c4acef4310a6091d6de3
MD5 526bef75912db4dc4055bc17571ecfe0
SHA1 3fb45ee3ce4299f7a9c13d3b2c242910c89e669e
SHA512 98fab504233c12dfc4e3e4c5d62d5d10d65aaf250cdc76e4621db5cb64105a937ac3a2890a134f9455d192a9a2819eae1ebc319c53e17d4cd3f53123d57548dc
SSDEEP 192:qTkYJU+iYQbRbviu1zxjkZ1RJ/WAOQhNCDe4U1VT0BnFj241iYy0yIQKM+NW9E:qJU+rQbRbvigl4Z1PWArh8HcQZZ
TLSH
T19072DA165860457B8691E7A894E8BFC3E5F538CF4C419FCA8BE0BD086DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

893a5b5e-59f9-418d-9adc-b90fa3f7594c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\893a5b5e-59f9-418d-9adc-b90fa3f7594c
Size 2KB
SHA256 c7907993c99863b42dec0da03fe18e1593c88dad22552234f688ce39407d45f5
MD5 09112dce3b1fc1b47322358a2b6469ef
SHA1 91c6d54103d2b7d3a61e41d4ac3229ae96d64a9f
SHA512 3e166ee170fea491ac6d764c9a7af0db4fde9bcb24e9e8683bf98cd12d8d7b55cc4b185ea1c627f4e990ee6873511b35de06f9b25e76797267792a72465e2eae
TLSH
T1524166BC36F84C7A4CCAF25C9481375A9BA09A0344C66C432E90DF4CCC9669A236B56B
MD5 SHA1 SHA512 TLSH

Submit Download

90f82d0b-356c-48d0-ba6a-1945ff91ffa6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\90f82d0b-356c-48d0-ba6a-1945ff91ffa6
Size 235B
SHA256 1dd89f9857ff2514efa78503b7708bf588b9c8910826f46705b180c0cd5318c8
MD5 e0782e6cfc736538f12cfea590ee96cb
SHA1 cc06da3dadcfe68239f0f63a4e18c04233b485f6
SHA512 544995527352fa4860d69f38724390736c12c35163866a8435929b02770035985c0979404e8401e1725207095a6ca9faff46de19407ce887a9cf5dc46df5aefe
TLSH
T1E0D0979028C867BC3A100F02F0E0A8C230848C3310A59CA0C59209788EFDAC5419184A
MD5 SHA1 SHA512 TLSH

Submit Download

b18596b0-11f1-4413-9fde-a604f17beafd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\b18596b0-11f1-4413-9fde-a604f17beafd
Size 235B
SHA256 3a93cb8a2e116afe6283a26cec5df22f76e02713043544d238bbeeda234636ae
MD5 77b3f056848bdafdcb46e537c1ca6811
SHA1 deec1ec344b66fd374cb370b834e8221ba051cf1
SHA512 68e1278c29b75dd2f55ad93489bb882e8cb5bd2a61c84462cd57bf5f4ab3f341e4ba64eb64adb31592692cee2b1b401fb40a118ad6172827f64ced53812a02d8
TLSH
T1A5D09780688873BC0C240F02F0A028C630488C331471685089A249B899BAAF651A2927
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\extensions.json
Size 16KB
SHA256 8c51eecde8c4841fe4943f43f488c2802bdd80162548a096c0243265abfc4cda
MD5 f77c57fae3d73c40d3d141cb89e27fd9
SHA1 8b563500b2b3c56ef90168488c1f86bce8323252
SHA512 9c8a3a3b677541b2e26a4ce37c330fc1cc4b4d32ba6c1ce47492e098ed105bb8b27a246154f7b547e7acbf3c0044c2f13c3aaf83aa504c360055bb52ca4ca469
SSDEEP 384:LkI4vaWUmldvc8dhW794z/96oeL4H9NL4PaL4HnL4HWL4HoN+4hnr:4I4iWRf1Xq4B6n4H4w4r484K+4hr
TLSH
T11672531545049EB8294EA79BAA367E01C37D433B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\prefs-1.js
Size 8KB
SHA256 e8c0a121b25e8fd276d8d507f540f30ef9c91ff9b5df2409a8e734e623aaa94a
MD5 9c913d0b48e6f0728f7e06b19f39622d
SHA1 84742dd02647186b03c2e2565e430125eda63e20
SHA512 8ce98dd8561ee738f457be1a8f7fc09b100d84d76fd0495cefab7835aa78e76fd405f03a66e81d844098e563f57ce1128973d1a58e7a322dd6a8ed218c35c3d6
SSDEEP 96:xHIBTU0qGqldLfcsRObzSZuSSl7dv9j2n4WRN2C31Bw88bt8L4cnqV/qGS:CSRl1fcsRvuSS4RgI1Bw88b5G
TLSH
T1DA020D785404CF7F68B6767CBC2889715AB2013BB6BF68C650B954C50548F3881F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\prefs.js
Size 6KB
SHA256 d934f005441d391fff2c4ffeba5c2e283ef9cf51ad6f8d1f8f9e2f82c3afbaa8
MD5 627e51835b54d4d3f1dafe7c41282a9c
SHA1 bf25a348249e50a0cedbbc7e7cbc14378687087e
SHA512 810811e6c47933c9137b0810e6026e0bfeabd1be64fe12fecb9fe48f6415d831f16d69da0e45b86998d37a410f05e514604dbbf44a646bd17fe6291fc1953cbf
SSDEEP 96:xHIUTU0qGqldLfn8Kdn51zSfSSl7dv9jvn4Hj7Bw88P8L4cnqV/j:C3Rl1f8S5mSScj7Bw88P9
TLSH
T15AE10E7854088F7F64B677ACAC688C716AB2023BBBBF68D750A55484050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\prefs.js
Size 6KB
SHA256 a0156063376db921e220bedf7e1ba16e33cc4dbbac72fadb72c414f505e894cd
MD5 cf4e5eeb173e462106bc8222b306bb77
SHA1 b0bf141dc410d18c9c5c657bddf08e128771bd93
SHA512 d64d5d8950f32bd82862d883a86aef7b5b91a498a5e50a8983410e4e382e9358632e0ab86b4062fcfbd8cd89d66f2497e80e3aca0ab9d11891f92bb798ab11c9
SSDEEP 96:xHIUTU0qGqldLfn8sR1zSZuSSl7dv9j2n4Hj7Bw88P8L4cnqV/j:C3Rl1f8sREuSSxj7Bw88P9
TLSH
T1F0E11E7894088F7F64B677ACAC6888715AB2013BBBBF68D650B554C4054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 a356df4dbacbd90fcf15903367d74c12857443bda22f3942f8e9d1905285b7d2
MD5 3a55fdc2ade710b2c8d2307bb10a4421
SHA1 606a7bff8a89f8df26176def67b2f24591edd417
SHA512 4896bcb0b23d36ddb90989ac742563859dc4c4dfd588df642930457197286e3186511be14fe834d2b392e3edff29c48246751d37e56a9b836471c6e1b7494dfd
SSDEEP 24576:if1InxBq9M42l6EBbXyrWOpDhUxz2AqalrZ3v:ifQgMV6GXyrWKDhUx2AqYrZ3
TLSH
T138F52AF820D2B357F3414033A64593EB21AFD00CA467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4240-1-0x000001E1DEB40000-0x000001E1DEBB9000-memory.dmp

Download

memory/4904-436-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-448-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-402-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-403-0x0000017FCFE40000-0x0000017FCFE41000-memory.dmp

Download

memory/4904-404-0x0000017FCFE30000-0x0000017FCFE31000-memory.dmp

Download

memory/4904-406-0x0000017FCFE40000-0x0000017FCFE41000-memory.dmp

Download

memory/4904-409-0x0000017FCFE30000-0x0000017FCFE31000-memory.dmp

Download

memory/4904-412-0x0000017FCFD70000-0x0000017FCFD71000-memory.dmp

Download

memory/4904-424-0x0000017FCFF70000-0x0000017FCFF71000-memory.dmp

Download

memory/4904-426-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-428-0x0000017FD00B0000-0x0000017FD00B1000-memory.dmp

Download

memory/4904-427-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-429-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-430-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-431-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-432-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-433-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-434-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-435-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-400-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-437-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-438-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-439-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-440-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-441-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-442-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-443-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-444-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-445-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-446-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-447-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-401-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-449-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-450-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-451-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-452-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-453-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-454-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-455-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-456-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-457-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-458-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-459-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-460-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-461-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-462-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-463-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-464-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-465-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-466-0x0000017FCFFA0000-0x0000017FCFFA1000-memory.dmp

Download

memory/4904-467-0x0000017FCFFE0000-0x0000017FCFFE1000-memory.dmp

Download

memory/4904-468-0x0000017FCFFD0000-0x0000017FCFFD1000-memory.dmp

Download

memory/4904-398-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-399-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-397-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-396-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-395-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-394-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-393-0x0000017FD0230000-0x0000017FD0231000-memory.dmp

Download

memory/4904-392-0x0000017FD0200000-0x0000017FD0201000-memory.dmp

Download

memory/4904-376-0x0000017FBFC40000-0x0000017FBFC50000-memory.dmp

Download

memory/4904-623-0x0000017FD01D0000-0x0000017FD01DC000-memory.dmp

Download

memory/4904-360-0x0000017FBFB40000-0x0000017FBFB50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads