hxxps://mandrillapp[.]com/track/click/31633473/images[.]google[.]com[.]pa?p=eyJzIjoicDhId3ZkNWdzOFhTOFdDYXV5Y1dONXZyQVBzIiwidiI6MiwicCI6IntcInVcIjozMTYzMzQ3MyxcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2ltYWdlcy5nb29nbGUuY29tLnBhXFxcL3VybD9xPWh0dHBzJTNBJTJGJTJGaWFudGhlamV3ZWxsZXIuY28uemElMkZ3ZWxsLWtub3duJTJGYWNtZS1jaGFsbGVuZ2UlMkZlaXYmc2E9RCZzbnR6PTEmdXNnPUFPdlZhdzNBWUlmU05xZWZpNjdxZ2RJaXZubFYjODc2MzQ1OThGYW1pbHk9WlhKcGJpNXpZMmgzWVhKclFHUnZkQzUzYVM1bmIzWT1cIixcImlkXCI6XCIyMWYwNGU3NjZhNGY0ODY0OGY3ZDEzNzk4NWRkMDkzN1wiLFwidXJsX2lkc1wiOltcIjQ0NDYzNmVjNTBmNzE5YjI1ZDQ5MzJmMWNhOGExYWVmNmRmYzA1ZGFcIl0sXCJtc2dfdHNcIjoxNzc3Mjk1Nzg5fSJ9

Analysis

user interaction
yes
max time kernel
148s
max time network
159s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/04/2026, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mandrillapp.com/track/click/31633473/images.google.com.pa?p=eyJzIjoicDhId3ZkNWdzOFhTOFdDYXV5Y1dONXZyQVBzIiwidiI6MiwicCI6IntcInVcIjozMTYzMzQ3MyxcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2ltYWdlcy5nb29nbGUuY29tLnBhXFxcL3VybD9xPWh0dHBzJTNBJTJGJTJGaWFudGhlamV3ZWxsZXIuY28uemElMkZ3ZWxsLWtub3duJTJGYWNtZS1jaGFsbGVuZ2UlMkZlaXYmc2E9RCZzbnR6PTEmdXNnPUFPdlZhdzNBWUlmU05xZWZpNjdxZ2RJaXZubFYjODc2MzQ1OThGYW1pbHk9WlhKcGJpNXpZMmgzWVhKclFHUnZkQzUzYVM1bmIzWT1cIixcImlkXCI6XCIyMWYwNGU3NjZhNGY0ODY0OGY3ZDEzNzk4NWRkMDkzN1wiLFwidXJsX2lkc1wiOltcIjQ0NDYzNmVjNTBmNzE5YjI1ZDQ5MzJmMWNhOGExYWVmNmRmYzA1ZGFcIl0sXCJtc2dfdHNcIjoxNzc3Mjk1Nzg5fSJ9
Sample260427-r7sassd16w

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe
Token: SeDebugPrivilege	4892	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe
4892	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4892	4888	firefox.exe	84
PID 4888 wrote to memory of 4892	4888	firefox.exe	84
PID 4892 wrote to memory of 1632	4892	firefox.exe	85
PID 4892 wrote to memory of 1632	4892	firefox.exe	85
PID 4892 wrote to memory of 1632	4892	firefox.exe	85
PID 4892 wrote to memory of 4972	4892	firefox.exe	86
PID 4892 wrote to memory of 4972	4892	firefox.exe	86
PID 4892 wrote to memory of 4972	4892	firefox.exe	86
PID 4892 wrote to memory of 4972	4892	firefox.exe	86
PID 4892 wrote to memory of 544	4892	firefox.exe	87
PID 4892 wrote to memory of 544	4892	firefox.exe	87
PID 4892 wrote to memory of 544	4892	firefox.exe	87
PID 4892 wrote to memory of 544	4892	firefox.exe	87
PID 4892 wrote to memory of 4176	4892	firefox.exe	88
PID 4892 wrote to memory of 4176	4892	firefox.exe	88
PID 4892 wrote to memory of 4176	4892	firefox.exe	88
PID 4892 wrote to memory of 4240	4892	firefox.exe	89
PID 4892 wrote to memory of 4240	4892	firefox.exe	89
PID 4892 wrote to memory of 4240	4892	firefox.exe	89
PID 4892 wrote to memory of 4240	4892	firefox.exe	89
PID 4892 wrote to memory of 2388	4892	firefox.exe	91
PID 4892 wrote to memory of 2388	4892	firefox.exe	91
PID 4892 wrote to memory of 2388	4892	firefox.exe	91
PID 4892 wrote to memory of 2388	4892	firefox.exe	91
PID 4892 wrote to memory of 3840	4892	firefox.exe	92
PID 4892 wrote to memory of 3840	4892	firefox.exe	92
PID 4892 wrote to memory of 3840	4892	firefox.exe	92
PID 4892 wrote to memory of 3840	4892	firefox.exe	92
PID 4892 wrote to memory of 5768	4892	firefox.exe	93
PID 4892 wrote to memory of 5768	4892	firefox.exe	93
PID 4892 wrote to memory of 5768	4892	firefox.exe	93
PID 4892 wrote to memory of 5768	4892	firefox.exe	93
PID 4892 wrote to memory of 1868	4892	firefox.exe	94
PID 4892 wrote to memory of 1868	4892	firefox.exe	94
PID 4892 wrote to memory of 1868	4892	firefox.exe	94
PID 4892 wrote to memory of 1868	4892	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://mandrillapp.com/track/click/31633473/images.google.com.pa?p=eyJzIjoicDhId3ZkNWdzOFhTOFdDYXV5Y1dONXZyQVBzIiwidiI6MiwicCI6IntcInVcIjozMTYzMzQ3MyxcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2ltYWdlcy5nb29nbGUuY29tLnBhXFxcL3VybD9xPWh0dHBzJTNBJTJGJTJGaWFudGhlamV3ZWxsZXIuY28uemElMkZ3ZWxsLWtub3duJTJGYWNtZS1jaGFsbGVuZ2UlMkZlaXYmc2E9RCZzbnR6PTEmdXNnPUFPdlZhdzNBWUlmU05xZWZpNjdxZ2RJaXZubFYjODc2MzQ1OThGYW1pbHk9WlhKcGJpNXpZMmgzWVhKclFHUnZkQzUzYVM1bmIzWT1cIixcImlkXCI6XCIyMWYwNGU3NjZhNGY0ODY0OGY3ZDEzNzk4NWRkMDkzN1wiLFwidXJsX2lkc1wiOltcIjQ0NDYzNmVjNTBmNzE5YjI1ZDQ5MzJmMWNhOGExYWVmNmRmYzA1ZGFcIl0sXCJtc2dfdHNcIjoxNzc3Mjk1Nzg5fSJ9"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://mandrillapp.com/track/click/31633473/images.google.com.pa?p=eyJzIjoicDhId3ZkNWdzOFhTOFdDYXV5Y1dONXZyQVBzIiwidiI6MiwicCI6IntcInVcIjozMTYzMzQ3MyxcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2ltYWdlcy5nb29nbGUuY29tLnBhXFxcL3VybD9xPWh0dHBzJTNBJTJGJTJGaWFudGhlamV3ZWxsZXIuY28uemElMkZ3ZWxsLWtub3duJTJGYWNtZS1jaGFsbGVuZ2UlMkZlaXYmc2E9RCZzbnR6PTEmdXNnPUFPdlZhdzNBWUlmU05xZWZpNjdxZ2RJaXZubFYjODc2MzQ1OThGYW1pbHk9WlhKcGJpNXpZMmgzWVhKclFHUnZkQzUzYVM1bmIzWT1cIixcImlkXCI6XCIyMWYwNGU3NjZhNGY0ODY0OGY3ZDEzNzk4NWRkMDkzN1wiLFwidXJsX2lkc1wiOltcIjQ0NDYzNmVjNTBmNzE5YjI1ZDQ5MzJmMWNhOGExYWVmNmRmYzA1ZGFcIl0sXCJtc2dfdHNcIjoxNzc3Mjk1Nzg5fSJ9
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27100 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 1932 -initialChannelId {ece895a7-ebdd-4edc-9af3-9e242ed8acba} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27136 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {9f86e5e3-7cb3-409b-9d04-511c4e66a680} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 25164 -prefMapHandle 3932 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3944 -initialChannelId {28860a83-0b10-4ac5-bd21-a28ea8659e84} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4092 -prefsLen 27277 -prefMapHandle 4100 -prefMapSize 270279 -ipcHandle 4168 -initialChannelId {6ee83120-03b1-4043-a4f7-f890f1bc5c49} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3044 -prefsLen 34776 -prefMapHandle 3232 -prefMapSize 270279 -jsInitHandle 3000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3960 -initialChannelId {2d0d06d5-e2e7-4fca-81b2-7a0c52ba6295} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5208 -prefsLen 35013 -prefMapHandle 5212 -prefMapSize 270279 -ipcHandle 5192 -initialChannelId {c3eb0344-591e-4bee-99f9-bc62a5d8a1a9} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5316 -prefsLen 32900 -prefMapHandle 5320 -prefMapSize 270279 -jsInitHandle 5324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {dd11139d-99cf-4932-9bfe-f149943633fa} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 32900 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5060 -initialChannelId {0ce19823-103e-490a-aa7f-96082786769f} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32900 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5772 -initialChannelId {f5548f50-3948-4aaf-8c90-20347c0aaf20} -parentPid 4892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42wc9zy9.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 f355b84fa82274b68c0f366fdbfb1298af9649d8e71864fa833cc145d2a8b133
MD5 65cb45d2230d0bfaef1ca9a473958b7e
SHA1 3577c50f6f2dbc5152e0bcc76989ec46a2dd3257
SHA512 be73a95ddc669324089c540ca26bab3f1cf9907dcc2fd12116bf3de867fb813700657f835696e2c93b7554d6df97ce0dce29794538059b554d67ed79e5841462
SSDEEP 384:HbaFrLiO024YaFuhw+5EL1pPsac4j0lpDII+sr9:7aAZYaFuK+5EB9sac4ID8Lg
TLSH
T1D9527E7E9F0138BA1A2BD2D4D9EE5205CE04D6BBEEE2D16605143844C68477CF4F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c727027a-3cae-4430-8866-3c46cdbade09.zip

Path C:\Users\Admin\AppData\Local\Temp\c727027a-3cae-4430-8866-3c46cdbade09.zip
Size 3.7MB
SHA256 41f88315ccb5feca6d1f0ca29ee131700bfe0f0a4a0cb4cc56912f7525275fab
MD5 3161f12ccf7dae28d5ba50957dcb38ab
SHA1 28750e8ab50cbeb7918f8b0e2c64df1d12a6f7f5
SHA512 f8a64ea32e684e0c7ca84f7faed743c74b31f194a8f8412cc41162c89e6c7a93dfbb90dc8041ce8e5dc101522c06ac68a4a57c12ad68baaa26072a9327b452d3
SSDEEP 98304:yLr0Cmjpv8wpUBBQBMEfINmTn7ylp5MAU:ewrtUQBMEfINmT7+MD
TLSH
T17E06E035DE9C1E08C98F83FA850C2FC29B4C4F668054A95B7E6A9571DFB31A21B47B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4ef4455ed311e72be007cb5d7fc419b428f57d09db49f7467ca5d93f2818b301
MD5 982565e97285316946306c33e7bc2f44
SHA1 e2a910d3e6c5b7464edadf91a9386cae8dbe3473
SHA512 9d5dbb938ce0bf874be13c785e06edbfa91f93fc45add91e030eb3040e3119235dbd4162d037db29cc72dd383aecd7648a550e2c534fb2d8e587dc6e91ca4975
SSDEEP 96:+SdF95/7bkW6BrcPyUR6rWZmFPQFBwFtFr/dd66Joz1zgClKtmc0d/UcWI:+Ov5zboBCyjCK1d66Joz1zgCl6mc0dGI
TLSH
T1ACB1DB28F229463FC419423ACCA21B400E36395AA89E7F1A36EC745D3D673CD768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f9a658fa7168381129e47af876384f5d45104c3f903f4e1925e5d535323bd0dc
MD5 b726b2f57653b16357cbf98bbc5dc911
SHA1 3d8aca8e3517d4714bf998821058e1b319abf931
SHA512 7ae76f28a52db303cb49d96d7e3cba31a9a68c2f0477c712d916b690d22ef9e4d3a7603a1582fe43bc5ef435ea5df114c127933200947992becf49f6bb434347
SSDEEP 192:51/66Joz1zgCl6mc0d9lWOv5zboA7IzvyjBQSV:3/66Joz1zgC1jDboIyvyjn
TLSH
T177E1F0A8E638963FC404027BDCA51F410F76389A984E7F2A36DC650C2D572DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bf975ae63d13074726fad0fea6dfaecfa9d4f669f3e1b1ad2b1184ca8c6f008e
MD5 2133d194f72ca47b7dc660dba98bfe7c
SHA1 83a2e19111cdfb203dc139c7b7c9716a113d5ede
SHA512 e2941c4cf401a2f45575957bcbca02f90b5bfb133e41d15260f77b3f9741278701e32528b97923484bcb93c834ca1f754d4d49d249ba027a25af643304726b16
SSDEEP 192:71d66Joz1zgCl6mc0dilWOv5zborZIzvyjBQjS:5d66Joz1zgC1jqborZyvyjv
TLSH
T131E100A4EA39963FC404027BCCA61F414F39389A984E3F1A36DD650C2D572DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 be76977a3391e93db1d722b52ebc6381ea338c0e5a96321a634b7a14307e7e1f
MD5 06484bc4e6166b0e709ab1ac3218289e
SHA1 d9cf65f15f7c6fb82dabe9267cb9cb28f99d067f
SHA512 7cf9ee5dc2b7c7496632fbacb40bf9a3b25cb719f1aa97d6d84c444a08b4894ea9af1e0f843e40163fccf6ddfebd11d31764d0cbe180091b48f0d7ab635cf83d
SSDEEP 768:/P4jnos2IcUxFjy6Gcmhuc5mjKWqJFG+53E1rmb8b2bYb5bub7b5bXbY/Fe20MVe:Ijnos2IcUxFmmjP/Fe20MVHTVY
TLSH
T182231144EB1E953FD42802BADCA10B002F79F889591A2FA7375C55682C872DC3D9E0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 6561546d342b2b28469851610e89d90e6ea2c5f681540d21bd2e969eb085fe75
MD5 b3d71db159844646b0a2a09d7989a4ec
SHA1 de4af6ad0aafcf539cdc9dd70dbc93b71956eb66
SHA512 6567cb14008256672b479a44fe965fd806195225c0ec927515e33d6593dcd679cd4f075a7b2e95116e968e68626d2a660c9bf4472fecddc64cdc9ed9131f1c9a
SSDEEP 768:zjnos2IcUxFjy6Gcmhuc5mjKWqJFG+53E1rmb8b2bYb5bub7b5bXbY/Fe20MVHTv:zjnos2IcUxFmmjP/Fe20MVHTVR
TLSH
T1B7231144EB1E953FD42802BADCA10B002F79F889591A2FA7375C55682C872DC3D9E0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

919834a8-01cb-4df5-9ebc-8ecca4aba3b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\919834a8-01cb-4df5-9ebc-8ecca4aba3b1
Size 2KB
SHA256 7199e3030cd0301399217a4972183a3b2d2dea7bf7a15e8ddbbc2aba3375f27b
MD5 f73ef0722381c05a9678a5327fdadb61
SHA1 ccc99e04fb54be008cab1d13de09172c71c1bf47
SHA512 0a49d3b0aecb16428da4b34f34fabc42317650caaaf90c296a1150dda156c82eee014f0cdcff81c6db4ecaaf7c4c907dfe3aeb367f045759efa40392bff28e0b
TLSH
T11A5187658170D87EC87DA31BDC253B838BF3140A508B294E9EEC9E0A157FC1DD359645
MD5 SHA1 SHA512 TLSH

Submit Download

a6c37388-1831-4480-9712-615c04ddd313

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\a6c37388-1831-4480-9712-615c04ddd313
Size 886B
SHA256 6f339a921b8b0b3f7dcbd44519c9925723b98b7fe15383e54b731a2bc59e0bce
MD5 6c61b3cae8cb6be301365833cfc7b6d6
SHA1 a5477f988672685dcdc60e1a959ee69eb5d8ca7b
SHA512 8d9ed9a693f180a14db7bd0ceccac8469687ae5743eaca217a9085d009d1bebe2116b02d14658f6f710909fadb96566457f31fce1f2bbcc7bb9e4347c890c452
TLSH
T1AC1100908671B9B2CC68D297D4E17B4387E4311380CA69083E954B080CFB22EA3A634F
MD5 SHA1 SHA512 TLSH

Submit Download

b6b450b8-1ddd-461c-b20b-1e7f9e1ddb72

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\b6b450b8-1ddd-461c-b20b-1e7f9e1ddb72
Size 2KB
SHA256 efc9b3b3416d59e509f5c8d4ed0f01aa17a19ee4c3d5598f5b31b007151451a3
MD5 3672ddc2ea5e50de1492a6d92d9bde80
SHA1 46925e255cf9676bcd2f28f1580a14f8454483ff
SHA512 79cacd31c75ee0fd5af1764d89d24c08eda520d9bf75132efe454a8c88b0ae9865a2cd0f54caccc39b0247d67e0b780c157075fbedf62ca680223942c097a82d
TLSH
T1E241445C36BC5D7A8CCBF59D9482378E93A0590300C628832E52DF0C8D9779D73AA4AB
MD5 SHA1 SHA512 TLSH

Submit Download

bed95526-0a63-4b30-84f0-47ca59456335

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\bed95526-0a63-4b30-84f0-47ca59456335
Size 235B
SHA256 62e266553db54f2823926b68f4c2fd49182cbe09f1e1ad359ec0293a12d0c49c
MD5 4a28c668addeb2c9e061c7129a3c8eca
SHA1 e44c6618ed08b2efb7136e697c100e1d70df99cd
SHA512 a91860e0c5874e11d2dbc6837b843e10307d788226bd6558e5b36a1df7c1b198784b512e246438cfdbc625f6eaf1ec60ca31a48e765442344e7aef33306daf45
TLSH
T16BD0978124A8A76C48100F0BF0E828C630548C3320F0A830856046788EFEEC48121A2A
MD5 SHA1 SHA512 TLSH

Submit Download

d5cb75ae-d425-4a72-bc3e-877754205486

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\d5cb75ae-d425-4a72-bc3e-877754205486
Size 883B
SHA256 7b7a9b465fefd716e71029b713cef2a16d12228747ec04fc70546ca7266fdbd2
MD5 29116c9b5c6a7ee57be630d84309ad89
SHA1 2c489e75067f43600ad9a67229269781fb52707e
SHA512 bfcd964da97d49ca769aa77034128a821aa186abfce73f85861a7fe5a663c939edbf137b6ede4d09e3ea187e1a8be590d43c4922c1dca46d9f2dab9f9eaeaf09
TLSH
T15211C0C08771B9B2CC68D34BC5957B4387E4352380CAA5143EF55A080DBB51DD7AA28B
MD5 SHA1 SHA512 TLSH

Submit Download

ee85fa44-9474-45dc-ad25-e4f0383de35c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\datareporting\glean\pending_pings\ee85fa44-9474-45dc-ad25-e4f0383de35c
Size 235B
SHA256 4bf47a39937ec398cbd956807c8deb73a3cb15ae03b30b4f150bc2f6cd19d676
MD5 ce1ad42ac781b49b95570eb2fba37af8
SHA1 08923bbedecacdb130dddd8cf3fa95b09f1da5f5
SHA512 6ff1e1f786b8f49b4822dfea2d225a7f0e1efb6859e3e2b6d92180d22bd463fa9385e7c100e3fcdd0ce9fd7104ecde14067b7d9d9010537732e5e0d3b55a8b3d
TLSH
T1DED0978018D86B3D4C200F0BF0F12AC630848C371560A81096B000B49AB9EC40251867
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\extensions.json
Size 16KB
SHA256 46b69337a0f2869d3d7431008ea5801ff9a7b4e062aa2be6af86bee5f7e0dc53
MD5 7f57ee46915654c2d6e1f1cde1bbb705
SHA1 2f24c11bf8b987a3b9c087f2eee3a6a71ba12012
SHA512 8d63995620aae0fbb1cae4126267076735387dc3f6171068112be563f1abe68f8c6cc8552de083ae7f04c55223eac254b2901273f18cdc8464d46def6b9fe76b
SSDEEP 384:ZkI4vYUmldvS8dhW+94zg96orL4HIL4PpL4HnL4HQL4Hog4h/:6I4ARfHXD4I6Q4q4J4r4y494V
TLSH
T11472311545049EB8298EA78BAA367E01C37D473B60845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\prefs-1.js
Size 12KB
SHA256 4c47a35d24daf7a490c6ab0604aa1832a169b2d8d6c325eb6cf7d467b5653dfd
MD5 337a2940ee694bcbc47394c92d302b53
SHA1 4edbd1c9fad84389735253ed02ca30da79ef31db
SHA512 f39ea15cb297da2fb8a317a9738bb9589c8ca4de1c36607457ce98ab88b99e8a9e64ad0da672ff5b9cb837e8cff07013215691e8f4874a525b45643789e37778
SSDEEP 192:sh8ERMfgBEwSSlLRY57tmBw88uVE/kJnjiqK:s6yRY57GwClRK
TLSH
T19842BC785441CB3F24F7327D6C264AE06A614137B7BFBCD706B8849145ACF2441EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\prefs-1.js
Size 8KB
SHA256 160fe030bfeaffd952420e170c590a060eab7f943b6d85feea1b4a3393645780
MD5 a6b2e8489239c1bab7d3ab23746c403d
SHA1 cbcb02ebe9314f15cadc4dac299997411f6a4b54
SHA512 6020f457819b7291a0427f7e9ccac0f7d7cf5fa22a1020fe7f1a590687f6f99382778239b4ab26485f86b943581a806ec41887ece30e57d39548e2a9eada2fb7
SSDEEP 96:xHbh8lTUIJqGqMfgBEObzSSSSladv9jYnnWRCxhI639Q0Bw88aqL8L4cn+VNifSK:1h8ERMfgBEwSSqRY5rBw88XnjiqK
TLSH
T19A02FE789044CF7F78B6366C6C2989B15A72013BB7BF68D710B94485055CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\prefs-1.js
Size 6KB
SHA256 7b092c2ebbc06cb5a870e3cb3b3368087f77a36055b8da6a1082a196299a899b
MD5 508dc6347f6368e5faed5646ec5d4f04
SHA1 591c1b9533051873b47314e9aea41f21ba02cee5
SHA512 02c49c24e1e56bc27f8bc9ce9cd60b71cd1e42ca2833ba8c739918886aaee13a7ffd52e98a2484a1411ce96473dbb9e8bc6e3f8faeed2c1a88e787caa389707e
SSDEEP 96:xHbh8UTUIJqGqMfZBE1zSSSSladv9jYnnHNhI6395Bw88P8L4cn+VvfSAv:1h8dRMfZBEzSSjf55Bw88DJqK
TLSH
T144E11E789008CB7F74B6776C6C6888715AB2013BBBBF68C750B54484055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\prefs.js
Size 6KB
SHA256 508fac36b95ff2b06907a5f814f6aac57fd8c7f76408692861fb86a9b36dbed8
MD5 31ed90b600aa4f14e86670e2d0467d0e
SHA1 58e734f02c64291e46e5fbbf77261654b65caaa3
SHA512 62440b5fdd0cc9fa21614359146125e1ead20fb772a7dd4d19b76e31095f52cc61a518d94f7685ef2a395217539c1a7842b99e154bf70d02acc19b57f2165fa1
SSDEEP 96:xHbh8UTUIJqGqMfZKjenjh1zShSSladv9jJnnHNhI6395Bw88P8L4cn+VvfSAv:1h8dRMfZttgSSOf55Bw88DJqK
TLSH
T12AE11E789408CB7F74B6776C6C6888715AB2013B7BBF68C710B54484055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\prefs.js
Size 6KB
SHA256 3ec50fcc9ebcd6a010cf9beedeb81da730cf8b306cf80fe80923ced4515d2b8e
MD5 bbe7283da79247b312175550278abee0
SHA1 bdd4dd9e02cdcdcc5630d46c1a59aa05eee37aac
SHA512 d37c748e7d6ee41dc580882aef887ce3b143e3ecdc775f4be4017dc9eaac9f9c8dcc447fe0dd8354f7805424444f84db9a8ad3feb1881559ab8348bc85c4f6fe
SSDEEP 96:xHbh8UTUIJqGqMfZBEObzSSSSladv9jYnnHNhI6395Bw88P8L4cn+VvfSAv:1h8dRMfZBEwSSjf55Bw88DJqK
TLSH
T1BDE10D789108CB7F74B6766C6C6888715AB2013BBBBF68C710B54484055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 986e07c43dc55e6b019d8d11d4a709b9179caec8cdeaa97b9288c4200f053a70
MD5 d5bfdca163a72ec497715599d16d6c21
SHA1 d077914df0bdf0b76b2bec91752543b783623fd6
SHA512 249418b3a9120fb9b238b29c4af711da8496387823d4664703b1acd31bd1099c33ae79275a58f6899f5055f44efef00f2b2b5536bc4f6d35b4c1bc4062308072
TLSH
T1E841E9BF88391EE6E710C10DBD844BA1DB273411087E48A0E9859E84E67F65B538A31A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.6MB
SHA256 0e73ea13a10c166ae670e96f3dfc1e7e11e541c82d605d2f9a80f7e542d56440
MD5 8459b5b6268b218378fcc21ce11fb07b
SHA1 4e809181cef721c2eac26959f94aacb33a3ae28c
SHA512 ecfe2e77971dd50e3947527a737483ee1bfcc48a2bfdc30a544619cf5f25be1e388a12a852d33d5c51a56edf00a63d6cf3f11a381465b933895fc5131798864f
SSDEEP 24576:2Nwnl209jHKab9DuyO6FDqX+RIq0XRaR6fS+zVOybfL:2W9jKab9D7O6JquREgRRuYyX
TLSH
T174062AF860D1A243F3424073B64593EB21EFD00C6027DE0847A956E9A479CEF9E56B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42wc9zy9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 10.4MB
SHA256 31e895057ad87f2c3a65208859d37443e4b02330061a86fac9133dc3c15c415e
MD5 16c9a43432a7560c9f88e3fe7229c347
SHA1 5a4c38d0a55e8b78fe8b4c459511f34288377ae1
SHA512 a238349f433d6507c9db1f66b06b909ce4d58e2db47f4ccf8a3a38770ff96d5d09610a456bbf8b2bea9f43c2935ce986253ad3a003e455c2a266a7d282056586
SSDEEP 49152:gvkpRVaAQoW8zN6wlIeCZkxLUDpvk1zqcwBTBLB3r/Cau6NfnlnN8fF7o3E+AZfQ:IMSU+WftNaHM94jX2A
TLSH
T18EB66C9270D0D692EB4146F6F34F13DB317FC18C20A5C98007B8BAA968565DBEE5F3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads