hxxp://join[.]a8c[.]com/hacker

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
106s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://join.a8c.com/hacker
Sample260430-srmwtaa17n

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	firefox.exe
Token: SeDebugPrivilege	1088	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe
1088	firefox.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1088	2648	firefox.exe	80
PID 2648 wrote to memory of 1088	2648	firefox.exe	80
PID 1088 wrote to memory of 3108	1088	firefox.exe	81
PID 1088 wrote to memory of 3108	1088	firefox.exe	81
PID 1088 wrote to memory of 3108	1088	firefox.exe	81
PID 1088 wrote to memory of 3460	1088	firefox.exe	82
PID 1088 wrote to memory of 3460	1088	firefox.exe	82
PID 1088 wrote to memory of 3460	1088	firefox.exe	82
PID 1088 wrote to memory of 3460	1088	firefox.exe	82
PID 1088 wrote to memory of 2200	1088	firefox.exe	83
PID 1088 wrote to memory of 2200	1088	firefox.exe	83
PID 1088 wrote to memory of 2200	1088	firefox.exe	83
PID 1088 wrote to memory of 2200	1088	firefox.exe	83
PID 1088 wrote to memory of 3160	1088	firefox.exe	84
PID 1088 wrote to memory of 3160	1088	firefox.exe	84
PID 1088 wrote to memory of 3160	1088	firefox.exe	84
PID 1088 wrote to memory of 2096	1088	firefox.exe	85
PID 1088 wrote to memory of 2096	1088	firefox.exe	85
PID 1088 wrote to memory of 2096	1088	firefox.exe	85
PID 1088 wrote to memory of 2096	1088	firefox.exe	85
PID 1088 wrote to memory of 2244	1088	firefox.exe	86
PID 1088 wrote to memory of 2244	1088	firefox.exe	86
PID 1088 wrote to memory of 2244	1088	firefox.exe	86
PID 1088 wrote to memory of 2244	1088	firefox.exe	86
PID 1088 wrote to memory of 1076	1088	firefox.exe	87
PID 1088 wrote to memory of 1076	1088	firefox.exe	87
PID 1088 wrote to memory of 1076	1088	firefox.exe	87
PID 1088 wrote to memory of 1076	1088	firefox.exe	87
PID 1088 wrote to memory of 1592	1088	firefox.exe	88
PID 1088 wrote to memory of 1592	1088	firefox.exe	88
PID 1088 wrote to memory of 1592	1088	firefox.exe	88
PID 1088 wrote to memory of 1592	1088	firefox.exe	88
PID 1088 wrote to memory of 2988	1088	firefox.exe	89
PID 1088 wrote to memory of 2988	1088	firefox.exe	89
PID 1088 wrote to memory of 2988	1088	firefox.exe	89
PID 1088 wrote to memory of 2988	1088	firefox.exe	89
PID 1088 wrote to memory of 3904	1088	firefox.exe	90
PID 1088 wrote to memory of 3904	1088	firefox.exe	90
PID 1088 wrote to memory of 3904	1088	firefox.exe	90
PID 1088 wrote to memory of 3904	1088	firefox.exe	90
PID 1088 wrote to memory of 2608	1088	firefox.exe	91
PID 1088 wrote to memory of 2608	1088	firefox.exe	91
PID 1088 wrote to memory of 2608	1088	firefox.exe	91
PID 1088 wrote to memory of 2608	1088	firefox.exe	91
PID 1088 wrote to memory of 1856	1088	firefox.exe	92
PID 1088 wrote to memory of 1856	1088	firefox.exe	92
PID 1088 wrote to memory of 1856	1088	firefox.exe	92
PID 1088 wrote to memory of 1856	1088	firefox.exe	92
PID 1088 wrote to memory of 3504	1088	firefox.exe	93
PID 1088 wrote to memory of 3504	1088	firefox.exe	93
PID 1088 wrote to memory of 3504	1088	firefox.exe	93
PID 1088 wrote to memory of 3444	1088	firefox.exe	94
PID 1088 wrote to memory of 3444	1088	firefox.exe	94
PID 1088 wrote to memory of 3444	1088	firefox.exe	94
PID 1088 wrote to memory of 3444	1088	firefox.exe	94
PID 1088 wrote to memory of 4792	1088	firefox.exe	95
PID 1088 wrote to memory of 4792	1088	firefox.exe	95
PID 1088 wrote to memory of 4792	1088	firefox.exe	95
PID 1088 wrote to memory of 4792	1088	firefox.exe	95
PID 1088 wrote to memory of 804	1088	firefox.exe	96
PID 1088 wrote to memory of 804	1088	firefox.exe	96
PID 1088 wrote to memory of 804	1088	firefox.exe	96
PID 1088 wrote to memory of 804	1088	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://join.a8c.com/hacker"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://join.a8c.com/hacker
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {dcd7f5be-371b-45ec-8559-75f9f8da27f0} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {a7a16fc5-8f0b-4680-8844-d87d2f44bae9} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 25164 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3816 -initialChannelId {1f8c8d75-56ab-46cd-8ff7-d17a97c50b03} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {d41dd0f1-a245-4b1c-83a9-1319fff1536c} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4600 -prefsLen 34773 -prefMapHandle 4604 -prefMapSize 270279 -jsInitHandle 4608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3080 -initialChannelId {17225b5d-8c43-4246-b75f-8a931b61e574} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5224 -prefsLen 34903 -prefMapHandle 5228 -prefMapSize 270279 -ipcHandle 5128 -initialChannelId {2c4f590f-7a66-46d6-9c47-d39c9172d99f} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32952 -prefMapHandle 5640 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {ea40f85f-84d5-4fc1-bf02-8cb42853e097} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2736 -prefsLen 32952 -prefMapHandle 2900 -prefMapSize 270279 -jsInitHandle 2772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2976 -initialChannelId {cc89f25f-7014-496c-94ae-22dd88c197f9} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5924 -prefsLen 32952 -prefMapHandle 5928 -prefMapSize 270279 -jsInitHandle 5932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {04017ea5-f0be-4e94-839e-2ab18ea9b758} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6104 -prefsLen 32952 -prefMapHandle 6108 -prefMapSize 270279 -jsInitHandle 6112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6116 -initialChannelId {b111d84d-d90d-440f-8c8f-7833dcd2f595} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6292 -prefsLen 32952 -prefMapHandle 6296 -prefMapSize 270279 -jsInitHandle 6300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6308 -initialChannelId {654f6c38-5c5a-4cb8-9032-daf445d313ad} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6480 -prefsLen 35062 -prefMapHandle 6484 -prefMapSize 270279 -ipcHandle 6492 -initialChannelId {acbc7ed5-9e84-49f6-841e-5040d0af453b} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6300 -prefsLen 35062 -prefMapHandle 6076 -prefMapSize 270279 -ipcHandle 6432 -initialChannelId {ddef00d0-cede-4a22-947a-d83b0fe5a5c5} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:3504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 37014 -prefMapHandle 4940 -prefMapSize 270279 -jsInitHandle 2776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7080 -initialChannelId {c5f777d8-60b9-492b-8880-efbaf3ce6393} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2776 -prefsLen 36718 -prefMapHandle 5028 -prefMapSize 270279 -jsInitHandle 5884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {85bd7eca-b914-4aeb-8446-d24e483647e0} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:4792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6792 -prefsLen 36878 -prefMapHandle 4740 -prefMapSize 270279 -jsInitHandle 5896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {5f1dc42f-483f-44c7-9f5a-b45923ec9c7d} -parentPid 1088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 67a1958d188a032c93604b75893974366731b65d43ecdd241460d7b791f5eef2
MD5 3c11ba15ad5c32bf700e1d7e1206aebd
SHA1 abac2cdf95740e7b4c279beebe53436ea86cd397
SHA512 19dd6f19f529a849502432bddf502356f62ba7a2033da0e5e3a6e776b47a4567796b8223738f120af0d137cf16d664b37fa2871e26c9c7ebaf3bd269b80a95ef
SSDEEP 384:HbaFrLiO024YHFuhw+5EL1pPsac4j0lpDII+1WS:7aAZYHFuK+5EB9sac4ID8Ll
TLSH
T19D527E7E9F0138BA1B2BD1D4D9E95218CE08D6BBEEE2D16605143845C6843B8B8F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 2196ba030f92e7f5a838f340d59d0602a68875b14a2b474aa071a00a1d27869b
MD5 da1293823399d5c8dbcac96aa74d493e
SHA1 26b30c3d6dd15e166c8441e211357cccfaa1032f
SHA512 09c15058aaa0f6c8e8c73d01dcb780eeddadf1d846fb5557f508889abb3a09de670710591a30e218b8f122ceb7d553b17fbb228909fea567801adcf23a44f018
SSDEEP 384:HHMO0iO024YMFuhw+5EL1pPsac4j0lpDII+1ac:nrZYMFuK+5EB9sac4ID8Lp
TLSH
T1DF527D7EAF0138B91A27D1C4DCBD9209CE04E6BBEFE2D05615543844C684779B8FA4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 10KB
SHA256 7c37ffad7260461283e02264f66ef2a24c25a9310fe51a1710c9f810ad4bc25b
MD5 fbe2abf8f9b5cbcfff55ab662a643d58
SHA1 902035fee82bb853405b02e24a1b6a11dc5e170c
SHA512 b456a6398d302dcacf10547ae81f023810367703c33ecfc83bfa66d2f13989952a49bcc1506181209dace534ffda30d37b187f97bbead62e5405fa0a63fb5fea
SSDEEP 96:mBZc6McO5cLsgmcGcDmc45ca3gmcocpmcQ5cx8gmc:
TLSH
T1A522EAF757769574F0924F70948E3454AC33422A58ECC2918A28C8EA47D2BB4F07BF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 16KB
SHA256 3f345faa9e44d064055fb0c575b3ef4b5fa7d5ca7df6ec089e3776ba137d6f75
MD5 02ba3ec361273ff236d751a9b88b786d
SHA1 5101cf51e56a4f1345f0a78d43a19c57452797aa
SHA512 860968548926e2b14719a54a4af8b5232c518406e125455f90e71008cb0e169a5cee4db08309850d5f1168cdbf050b04c7f705980fa40db045eec9190a6cfae5
SSDEEP 96:UP1Zc6oci5cLsTcicKc305ca3TcEcIc05cx8TcKcHmcrD5ce88Wc55cx+Wc+5cSh:a
TLSH
T15072D7F317769578F0A14FB094993454AC37422A48ECC7908A2888EA57D2BB4F47BF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 17KB
SHA256 f0a829cbdf74535ad636eafb71db610f19e1c83defafeec5914c0d057c1adef6
MD5 2408a05c016e2bf8ad68c75000b61cdd
SHA1 56e61820b393c82aeb8cee8b350c749340b53ac2
SHA512 4a84ec4b1032abae49afc8be9fd9f129d4006c9655a9ba43cab10fd430851b3e113b5620ae94ed4e5edd1eb27e63a3cbbe32e4076a3c8dd15b0141716b529cf3
SSDEEP 96:UP1C5cLsTc305ca3Tc05cx8Tc75ce88OcN5cx+Oc+5cS1pcv4nU:m
TLSH
T1A482FAF3173695A8F0A24FB094993444AC37423A58ECCB808E2984E917D17B4A47BF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 17KB
SHA256 1e95c3a4a65409faac947a89f5884a0b552cac6a8453bf8d6abbb710ce6d7feb
MD5 489ab5ac0fe424d3f9fba8efa8100144
SHA1 80d0b72ff600adb71d631e94123e638047ec7235
SHA512 e7d7f9ff14046085bf77b29785eedc86f6aee065981b795b214cc1aed3bb96ae2247a1d13ef0c51b647630ceac114d234410a0ffa6d86ecf7fc001f59f9c23d0
SSDEEP 96:UP1xk1YrC5cLsTcCkQ90X05ca3Tc931SC1tb5ce88OcN5cx+Oc+5cS1pcf4bU:a5
TLSH
T1D58266F31B769569F0A24FB0949D7444A833023A58EC87809E2994EA17D27B4E47BF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 18KB
SHA256 0a77cdd072ec7f3094e4ee5726afab0fc9bd97c42b7ca9926df339155a629b74
MD5 a5c04a8a37a38350409d2a52f6ce890a
SHA1 61b4e3b6e6ebeaf4ac64e67bf1adae650befda4a
SHA512 d681012cc3a50f239f881877148f8bff099d310cb606a27a2d2801f4584f3d0b813f61ce690e0326bbfc4ab311d35972ac01dd81b60437ed04c1c15fe8d484a8
SSDEEP 96:UP19k1YbC5cLsTc9kQ9bX05ca3Tcy3m+WMeb5ce88OcN5cx+Oc+5cS1pcf4XgeK:Ss
TLSH
T11682A6F717729569F0A24FB090993444A833023A58ECCB809E2994EA17D67B4E47BF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f33171913ade51eb8fb58e250323b9b1955fc999399a7883d56fcd31d531bc1b
MD5 a35b753c6519e6eea59c137f7e24e777
SHA1 8e3ee1f4f8635ef170d608152f2b293752c80743
SHA512 54cc6f3b93738a871d5fa1bfa2f4654282ed6ef7a852ec8daa3b2e358305eaa41c4ec50db0a76c032c97a0a1464f24e2cd11441a1cf5868fc78d97bc770e8de3
SSDEEP 192:51d66Joz0dzgCl6mc0dqOv5zboHRZDxyjZgvT:3d66JozQzgC1jzboxZDxyje
TLSH
T1A2E12F64E639867BC018437BCDB61F400F35398A984E3F2975DC64192D972DE3A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 30bd779844e924c840d28bdfb1ea1a4528e95c7d0eb929d2e97c2edb8a67ada8
MD5 ef3c2735926f41b21555f9d0ddff8aff
SHA1 6d0a12b7ad75e21edc2a2d55d3a44bdbbdfbe498
SHA512 fa65b5a2068d127bb41787a8e4bcfa0d490f6cdd60c997ae4366b8ed28111e99447eca09a7afcb1f06db7d386d57633ad1d5a67f30d8642851ccc2a1c17aad69
SSDEEP 192:51d66Joz0dzgCl6mc0dEOv5zboHRZDxyjvvT:3d66JozQzgC1jlboxZDxyjj
TLSH
T1F4E11DA4E628863BC018437BDDA61B410F35398AD84E3F29759C64092D576DE3B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 06d5212df47c1a019f1b2bb5ae16a19e374652c41e52296456f757cebab80297
MD5 9ad0960ddacce2b3f6405d1c2b735a58
SHA1 92c126b5b8e20ae60d6680bda51df2b8b8aff7f2
SHA512 5415192767f9ea2bed8d2fc2064bf7c4831f95d022ec5994ebc2c91c8e965d945cbe42fbea6dff4b338815c62677c37ef17d602e80f2001659c4ce51e59a4a99
SSDEEP 192:iOv5zboHRbDxyjZb1d66Joz0dzgCl6mc0d1vT:BboxbDxyjjd66JozQzgC1jn
TLSH
T139E11EA4E634863BC014437BCDB51B410F36398AD84E3F6A75DC65092D572DE368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 62KB
SHA256 626d07eeff3fbbc7c31bf472c6906cc66daa78e75bc3563d3c9e9a4e18ccc599
MD5 3c23e90b58c4e9ea2b82389d8ee534dd
SHA1 451bdb5d2ab41a16d3b99da8c8148ad79a8fc5f2
SHA512 c51849b801edaa65b029d8c2a39fcd8f65b2d2413cc297cf7a822993c9fbdf1f7c1dea76885169f9f2ee89aad2f4b99abed9a96b7081d464c2af8800745efff7
SSDEEP 768:J6tgSKTzgO/wAFOpsab6aGcmhu9ufuSKU7UWY8205XJIrRVbQbAbvb4bQbOb3bua:igSKTzgO/wAFOpvbHSRYhQFLjVGWPtz
TLSH
T19E530144EB1A553FD82802BA9DD21B103F78F8895A0A2FA73B1C55786D873DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 336d91b41c32b3cc58ded4bf90163a24c13d1297f604dc29283c7407d101869f
MD5 f7025541a3a5a10ca6f880c2f4a79437
SHA1 f55d8681a7acb9724af99d1b6343fe463f3f4093
SHA512 edd0107b7bc8dc38a50ad04e232ea23bda41deb2a8714a2006bb526ec971ece473fec47bf32434034d6b20d465750be4c0cc017f6e72237734aae982a9408b16
SSDEEP 192:ZOv5zboHDDxyjvSq1/66Joz0dzgCl6mc0dz:2bojDxyjL/66JozQzgC1jd
TLSH
T1B8E11DA4E638863BC008437BCDB61B410F35388AD84E3F29759C64092D572EE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\events\events
Size 1KB
SHA256 822522c754a16d0dbbd17a19fc24b450ee1bb1fd7dad399ec5054a3a256bee61
MD5 bf6cdcbfe47f9087d4cf7ba2fad4e69d
SHA1 95945738148e3b516dcc8c7433fb2ef1bf34c552
SHA512 d5ca6b4a20570b7623b5061f03d17de4aa3f7289b3778811f4d904ce0c9eddc44d68e6b26f0a6a9c136f649ba73efe41a4670af04e5cfb41e85074592486081a
TLSH
T1E8214C5C39B98D2A9CABF79CB455028E53518B0B48C71D830D12DFCDCDD5ADA326A839
MD5 SHA1 SHA512 TLSH

Submit Download

343dc5dd-e9ab-472c-ac31-9e74547fd6af

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\343dc5dd-e9ab-472c-ac31-9e74547fd6af
Size 883B
SHA256 77392fc09a795cfa4220ce705652a135c1f46c8cf44fb051e38254e247713b6e
MD5 adec24d5078247852d4dc26193470468
SHA1 2bf2af53b93c4c3e9696748aec61615cdc6b3eb5
SHA512 dce342cd0170f5c36a70d5f0bc2d30d1177ebc4503546050ff8c763dea0b49e1dcbb9e0ae23fcc4b7b0f092d588c6759894059b0fb24a55e73ba3e8f1772de80
TLSH
T12A110080C630B9F2CC68C34F89A13B0287F43123C0CB84243EF14A140DBA92E9396617
MD5 SHA1 SHA512 TLSH

Submit Download

a7edbeba-4a1d-4cfe-8228-2ae6a4ddb034

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\a7edbeba-4a1d-4cfe-8228-2ae6a4ddb034
Size 235B
SHA256 54951a4a006f611bc04bb71418c079da2ecaad9d8f42ff5cfc2927e03d167d6e
MD5 d9ab1bd9397019064231b61ce532940c
SHA1 a10b36f6b262c59d567ef5ebf5c5d218a455711b
SHA512 aa105a9b0dc5557473a40d03fea30b1d85d01dfabe0009fdba3d0d30d4006a6fe91d9ca1115184e030e28713ee921fb70f46213b75086b0e2f25bfe108b198b4
TLSH
T1E2D0979068A8232C88104F0BB0A0B8C230884C3318B6583095620278DEF9EC80162C4B
MD5 SHA1 SHA512 TLSH

Submit Download

c4f90eb9-58fa-457c-bab7-724479d4cea4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\c4f90eb9-58fa-457c-bab7-724479d4cea4
Size 886B
SHA256 e6abaf4031dffdc05339318c7d5d17fc7a748b2866ee9569a72217735fe2647b
MD5 a66a5d4ec212f9ddbaebb4633e090d15
SHA1 67c4da3fcaabeec6d3a0c0c9daa7f016340473da
SHA512 eba901b7a77713fc2460cc15ab63fa5c3b33ea74e3fa4214646c56b0f4bdc5d22b175eddf1c773b3e97010c96f05af8bcf491bb809549d9f6d6d0593847a5b96
TLSH
T1DB1100C1C620BDF28C68C39B85A177024BE47123C0CE0C647EA15B184DAA52E539670B
MD5 SHA1 SHA512 TLSH

Submit Download

c6d5f65a-daf0-45f8-9389-64661389165d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\c6d5f65a-daf0-45f8-9389-64661389165d
Size 2KB
SHA256 34d8a84a70c3ba2ea875b8cd9efbf6064e2720d091b90b7d446e8f757d30f1dd
MD5 197bc2242ab888a75c6d9f79bda552c1
SHA1 d87c2dcfd92dad6135ce424be2d1b3c74791b2c5
SHA512 e76016a39fa05143262f68187a8eca2f4b524d9bf8cc1e5c281445489730347890d3fce54657ee7666759f0d9d7270ddac5f8e617eefc3a365091a4e97d60c03
TLSH
T1DE41215C36789C7B9CCBE69D9082378E97A08A0300C61D932E51DF0C8D966AD736F52B
MD5 SHA1 SHA512 TLSH

Submit Download

c7ab7fc7-27f5-4e09-b66f-7bd42baf0e58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\c7ab7fc7-27f5-4e09-b66f-7bd42baf0e58
Size 235B
SHA256 f73434611472a4cc2abd476e23f0e1c43d69928797a6e23be6e22b0475fa3dc3
MD5 c488f0aea0b4566904058070203b1013
SHA1 f1ff06ed002abc2b253d382c63e380736e1c6a1d
SHA512 80b144987c7d30c38718ca9f04771fb77938807b2799af93b5ef02e0a136df6d5508ebb0200b942a90c3df91d000a489866032dcef54c1a51db217fa5decfcaa
TLSH
T1C7D0978134887B5C08140F03B0E03EC630884C332478E820CBA04678EAF8DC8015282A
MD5 SHA1 SHA512 TLSH

Submit Download

d8b7bd32-e7c2-4558-929c-b81c8e61274c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\d8b7bd32-e7c2-4558-929c-b81c8e61274c
Size 16KB
SHA256 985add5cfd24702bdff854ac1833ea13069e99faa1bb54fc4dfb70d957b6b309
MD5 9d3c2361c37736332cf322b3a3b25099
SHA1 91733ba234e4a6f2b4a3f48639e5211ed6260da7
SHA512 88e77a335bffd7a25c0e53b0a3f3d11c93b71189c406835b7377eebc3da42726cae8f976fde36538f89d4d82791953be6b7d6bbe46a6cd6446009727df9534ef
SSDEEP 192:rytfK21MQvPqQ+pdM3D/AN6jCr5jCVIW1yNVD0ZWvB+1+W2gJJYvXSv0Kg0zhdsR:+t31MQvPqZR4sd5NvXSv0Kg0FdQ/
TLSH
T12972B856586045BE8251E36895B87FC3E6F538CF4C018FCE5BE0BE086EEA16D112788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\extensions.json
Size 16KB
SHA256 53fa2e42008f857f925b4af1fd790f84cf881d295dabfb3d28c9dbe1fea7e13f
MD5 5e7352ac7900ae6e575eb006d6c2d937
SHA1 610babcce2c4e98462c23a6595c998da21a0ba6f
SHA512 81dfe10bb51df1ed5c77f707beec03bd59e0d944ecc7c33c218815a54815d1e07abb1b3b274f7b9aa59247315b38d8b9e6d162a5e5ed0f49dd92e10263748e55
SSDEEP 384:tkI4vgUmldvJ8dhWu94zi96osL4HUL4PwIL4HTxL4HaL4HzZ4hE:OI4YRfqXD4q6J4u4IK4zp4I4l4W
TLSH
T10772331545049EB8294F979BAA367E02C37D433B60845C78F4DD8FC842FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\places.sqlite
Size 5.0MB
SHA256 71a530196372571bdfcba6cba1e3fa948b8beadf7910d02ea304f7e66c3ffd14
MD5 c0a9899a0aaf5a2097468f2fa3712b25
SHA1 9d1045a88a4046b2ec20066d98ffdeba614021a5
SHA512 afb674a0f0f77ed4f4838b31d493e3c6cda9dc68eaba781cabe657b1f6019e737a1550af3d7c12704a92f0c5890160e8cee4b39f1f213dc4509fe7062961d478
SSDEEP 192:M8rJQaXoMXp0VW9FxWpbEvd90ltehSol2xFZja9CYY2BC5SE:M8r54w0VW3xWpbEvL0ltehL6ja9t
TLSH
T12436755F7A251150E8DED231ECE32E19583F70068536BB933994296D4EE0763B91CCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 8KB
SHA256 f1889954a2d81768bd231047f8de598bf90490cde06187f94973545653b412cf
MD5 eb09c37c47ae2393ba4894f50dda1deb
SHA1 cde35046502f614d7f5690823c6e8ffe0778645e
SHA512 87079391f7cd191c7031c5330cc7fdaa9545392cbcaa7dd15ef7429470d5fff64d54538511e47a8d8a7802dcd5d0b6f8527294a46d36b57baca15e584e4ed452
SSDEEP 96:xHABTUHqGqXfz/yObzSLASSlcdv9j+nSWR/nzMkNF/Bw88aoJa8L4cnEVVVEGS:qnRXfz/yBASSpRbMkD/Bw887k2
TLSH
T1B5020F7C5004CB6F68B6376CAC288D715A62023BBAFF6CD710B94885155CF3446F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 12KB
SHA256 5a4df51f6757435b8c5db59721cd28c6afc3531204ac1b1c0a98e2ead568b5f7
MD5 bc1377f3d9df2ce9bafaa3cb0e58deaa
SHA1 c3ead73c330cf89cd2bf3bd15b27a0e521068906
SHA512 d52baa5d918558a432ad956f021cd5637254733a7bf2565eaa7fada74481c17554bcfe9b873c10240bbdf2444e4b56ca24fdcb75f71cde9ddfa3c30ecfb399e3
SSDEEP 192:0nRXfz/yBASSALRbMkDYumBw8OVQD6frYf:e2RbMTdw8Sa
TLSH
T11A42BD3C5054CB2F68B6327DAC2D4DB11961022BBAFFBCD705F88885049DF6542E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 4e636cee6e6e6f50ba1610c1fa23c9e9bd69c1196022594e1f4136d2a504c97e
MD5 0aed4861d9b22908f3f8c1b811c654ca
SHA1 4dc70aeffc7849fbc69d41929245163dce11f192
SHA512 f1544c6b50955d5120b598585b416bbb69b2ec68a5d779b7fadda10f6c9a9fd2f333799c61d807bbf1f0e188b4786e1d8c06e8bfb2f8fad6e222316bd61968a5
SSDEEP 96:xHAUTUHqGqXfUKjNnjh1zSiSSlcdv9jCnSH3MkN/Bw88H8L4cnEVVV5:qaRXfUadzSSc3MkRBw88Xt
TLSH
T17EE11E7890188B6F74B677ACAC688C316AB2013BB7BF68D750B94485014CF3846F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 6937deea895e26ad36a1d6b92164eeb0e5689371883ba2bfc36de7f0be9afc06
MD5 d57a4c1f0b135fd7d9827017cfd57ff9
SHA1 813d028ed4d8c448960e68c467126ff284de3a0d
SHA512 6277eea39ac0490438f5aee71d9bf4b409105c4023bfd597373873845d935eefcc03227d3fb69b2f096d7a28d139537528f2d27b17b594697b242f32ea31a216
SSDEEP 96:xHAUTUHqGqXfU/y1zSLASSlcdv9j+nSH3MkN/Bw88H8L4cnEVVV5:qaRXfU/yiASS83MkRBw88Xt
TLSH
T123E110789018CB6F74B677ACAC6888316AB2013BB7BF68D750B55484055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 79cd989715d236adbcb08bf642d15b0a3c39d4b22d6876eeffe2bd2c097adce6
MD5 74b462896788df859dabffe83661eb9c
SHA1 bae72f00e8c7390ed3e55eae112b902daac0d604
SHA512 ae597709550ab06d98dd5808ea719b2b91c55072a4f44175692fa5002fe7713499de0fc647c4f34ce819425ea5aba3de2781591fc06c8faad7313b366b14cdfc
SSDEEP 96:xHAUTUHqGqXfU/yObzSLASSlcdv9j+nSH3MkN/Bw88H8L4cnEVVV5:qaRXfU/yBASS83MkRBw88Xt
TLSH
T199E120789118CB6F64B6776CAC6888316AB2013BBBBF68D750B544C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 9527680957af4e61710affb5e3ffc812a0d81c4985ffb36efdad7d6395a35b9b
MD5 85945aaac4130d74a3d3be975e8836f4
SHA1 bfb86b5d74379d4c976779eb2c4b679f269c144b
SHA512 13eca891c16b528ad128c9e7a8765ad083aa3699febe039d5563031791bc07ee06f77912bb8d72f0902c87084d5683f25a8ca868bc8e2eb71f0d949abbde0b9a
TLSH
T171613B00FC562DDB28A0C25810E8F99D3EF9990E8E9EE0248A2E8D0D09CD96637FD315
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 9438ea7ad6a22a54d5aad19d2af1dd46b258125a6e186aa7352eb6379009d885
MD5 0458a9ffa77961fc15fa0aba6224c16c
SHA1 c6a1ebab8f444fb793ee03e494e554d9f599c888
SHA512 daf8736cbcbda40fa44c79e9a6b4de6956441f732544671d7bff19d731f89aa9cf51905a777f27612bba54514660af2c4204428a4d23a576a195e1baaef964af
TLSH
T110714C10FC572DD73DA0825800D8F99DABE6454F8E9EA0A88A6E9D1D09CED1727F9311
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 ef0dfd960972d7d3c91cc374aaef47349bea2a344563ae2fcc2d6bf69b7c195d
MD5 1d493fb9ab08ab8816baa2286b591b44
SHA1 beb957cff64b9a715dc3539385f41d10b3e7e1ff
SHA512 d0fdc14b40b108f37eeee8486a31cfba997a95c5f7d6920cadc83a7e59f72fcf0bfbfa9eadeabeaf87123413ac4fd2cb57fef5c387c4b396c17f0b6ad522664b
TLSH
T1D2615D11E8963DD77C9082985064DFBD3BA93D0ECCE79060471E4D5D1DCEDA73AD6214
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 732e61c129576401a9755bfb0a62bacb05811e87a883f7d762146e2fc96cdf3a
MD5 6158aa045b02d946266f389ddc9fa718
SHA1 3e19e078f30ff209c1fbd5dd3123ff23c6da5e5b
SHA512 a58ac218ff4aa6a7de91d9fdfdb6c1b6e8dacaf176f46a7d6daf2e3a8a8d6a541cf8b4551feb9c89cbd38730924914fd768912ee793a4809c1158285aee5852d
TLSH
T101613F01D8963DD739B0815450A9DEAD3BD9390ECCE79064473F4E1D1DCEC692EE5224
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 92dde1ae410aa549ebcf0e13f6835ab39f2c2a4d562cde04bfb6d721545afde5
MD5 ed525e0b714ae6af832e3d736386af12
SHA1 f841a904adf9ab88a90881b234de88e6b1a6ec31
SHA512 59a0e14b753730904df7f0c9648abcb92bf8f4c17c98f07f63e0b5f6369e4558148b3c3196dfbee144286500707f9c8d03d818da601cf0ec77624f4a3676a283
TLSH
T1BE615D10EC962CE739A0825850DDFDAC3EE9950E4DAEA0348E6E8E1D09CD92667F5705
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.1MB
SHA256 107a6686c87f5141ec1ad54325c9212eb8acfc88853d91e5789390c19fe1a44a
MD5 fadc8af703d85166bf32bdc1ce114e7c
SHA1 f465261a2a13fc1c24cdfaa27a4bf2b4d2a0f6bc
SHA512 8fbba4e333455b16c14f2d2afa7f5ad3d8d61c42e9a3ac2ce72c0a21a6f8f6da60bdbcea4ddc47b412dd9490c270112be73f8518ac3f3d7b381a057070e98821
SSDEEP 24576:JgIeyvp5og6+pPS71CPEh12RYCJxaxWVhw4c2:JpHj6+dS7sPEeRYCLaEVFD
TLSH
T11AE52AF82092B357F3418033A64593EB21EFD00C6467CE044BA956E995B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 55b258e75cd175092007bc01fbff00ada46cee98c9f63e76b874c7e2c2fcb600
MD5 9d5e49dae52833df61bafa174cf16075
SHA1 931178f172af1082c4b1dbea002ce814984fb6ce
SHA512 88c705f12a29f519304e8fb8a3db96107b13cb368e219fd703b7b6ad01f791e31bdd4fa5055bba1c9b382acc4fed28efc729b9491c7bd5c9ddfae5140d8a5b18
SSDEEP 49152:b4kBRVaAIoW8zN6wlq2NClx7pusGk2GiFAOXYiLg4nIckUm8PW7oDxtza7s5qPeG:rbDa7sceGCLezyQYi
TLSH
T186565CE420E29252F38544B3719A53FB10EFC01C6076CE44579896FAA5B8CEB4E877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads