021f53c2328113f02db282d7bde017efcf807b1021173e497c06711a15d7f98f

Analysis

user interaction
yes
max time kernel
898s
max time network
433s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iajq0rJqUmx7.exe
Size 1.4MB
Sample260503-bza4jsd13m
SHA256 021f53c2328113f02db282d7bde017efcf807b1021173e497c06711a15d7f98f
MD5 8b923746242130bc39f9566cf8ab60dc
SHA1 430ef7824759dc2295eb6cc5591bf2558c71e350
SHA512 981a338cdb8ee7fa15fcec8e10e2abb21af0eb653f15c0cec041144c9bedb9df4af513605c3533b815e981023b0c76eb804f0adc4d63be846baf22b7f69d6c7b
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizfmQDc06WogeOfQr0W:itMzLAVStcdiT7FoR2A0W
TLSH
T11A65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
99	772	firefox.exe

Executes dropped EXE 2 IoCs

pid	Process
1720	iajq0rJqUmx7.exe
4076	iajq0rJqUmx7.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
90	api.gofile.io
93	api.gofile.io
94	api.gofile.io
96	api.gofile.io

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\iajq0rJqUmx7.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\iajq0rJqUmx7.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	772	firefox.exe
Token: SeDebugPrivilege	772	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe
772	firefox.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 772	4228	firefox.exe	93
PID 4228 wrote to memory of 772	4228	firefox.exe	93
PID 772 wrote to memory of 2060	772	firefox.exe	94
PID 772 wrote to memory of 2060	772	firefox.exe	94
PID 772 wrote to memory of 2060	772	firefox.exe	94
PID 772 wrote to memory of 2708	772	firefox.exe	95
PID 772 wrote to memory of 2708	772	firefox.exe	95
PID 772 wrote to memory of 2708	772	firefox.exe	95
PID 772 wrote to memory of 2708	772	firefox.exe	95
PID 772 wrote to memory of 3348	772	firefox.exe	96
PID 772 wrote to memory of 3348	772	firefox.exe	96
PID 772 wrote to memory of 3348	772	firefox.exe	96
PID 772 wrote to memory of 3348	772	firefox.exe	96
PID 772 wrote to memory of 3828	772	firefox.exe	97
PID 772 wrote to memory of 3828	772	firefox.exe	97
PID 772 wrote to memory of 3828	772	firefox.exe	97
PID 772 wrote to memory of 4440	772	firefox.exe	98
PID 772 wrote to memory of 4440	772	firefox.exe	98
PID 772 wrote to memory of 4440	772	firefox.exe	98
PID 772 wrote to memory of 4440	772	firefox.exe	98
PID 772 wrote to memory of 5536	772	firefox.exe	99
PID 772 wrote to memory of 5536	772	firefox.exe	99
PID 772 wrote to memory of 5536	772	firefox.exe	99
PID 772 wrote to memory of 5536	772	firefox.exe	99
PID 772 wrote to memory of 5604	772	firefox.exe	100
PID 772 wrote to memory of 5604	772	firefox.exe	100
PID 772 wrote to memory of 5604	772	firefox.exe	100
PID 772 wrote to memory of 5604	772	firefox.exe	100
PID 772 wrote to memory of 5616	772	firefox.exe	101
PID 772 wrote to memory of 5616	772	firefox.exe	101
PID 772 wrote to memory of 5616	772	firefox.exe	101
PID 772 wrote to memory of 5616	772	firefox.exe	101
PID 772 wrote to memory of 5624	772	firefox.exe	102
PID 772 wrote to memory of 5624	772	firefox.exe	102
PID 772 wrote to memory of 5624	772	firefox.exe	102
PID 772 wrote to memory of 5624	772	firefox.exe	102
PID 772 wrote to memory of 5264	772	firefox.exe	112
PID 772 wrote to memory of 5264	772	firefox.exe	112
PID 772 wrote to memory of 5264	772	firefox.exe	112
PID 772 wrote to memory of 5264	772	firefox.exe	112
PID 772 wrote to memory of 1720	772	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\iajq0rJqUmx7.exe
"C:\Users\Admin\AppData\Local\Temp\iajq0rJqUmx7.exe"
1⤵
PID:2304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {8a9466d1-1334-4b2b-b64c-d59a84e057ad} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2352 -initialChannelId {a09c5aca-bf41-4b65-ac01-d9808f7dc4fb} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 27276 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {cf2bee75-d43f-4226-bb9a-2bd64318e881} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27276 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {79da0ffd-e6fb-449b-a4e6-577d0db79175} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4604 -prefsLen 34775 -prefMapHandle 4608 -prefMapSize 270279 -jsInitHandle 4612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4620 -initialChannelId {17100281-46d5-4867-b818-d65bf0085c08} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5072 -prefsLen 35012 -prefMapHandle 5076 -prefMapSize 270279 -ipcHandle 5084 -initialChannelId {517afc5b-3ffc-4a40-8696-67dcb4c6a037} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32952 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {8cd6c2e4-c1d1-45b4-aa9f-b5faa3d1ad6b} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5444 -prefsLen 32952 -prefMapHandle 5448 -prefMapSize 270279 -jsInitHandle 5452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {83768b82-f95a-46b4-aa11-85ee17e26a15} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {71502f99-ab00-4261-b010-5e2195f8cf88} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3036 -prefsLen 36718 -prefMapHandle 6280 -prefMapSize 270279 -jsInitHandle 6324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6288 -initialChannelId {cf828667-5ad6-449e-b192-d596afa31758} -parentPid 772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5264
- - C:\Users\Admin\Downloads\iajq0rJqUmx7.exe
    "C:\Users\Admin\Downloads\iajq0rJqUmx7.exe"
    3⤵
    - Executes dropped EXE
    PID:1720

C:\Users\Admin\Downloads\iajq0rJqUmx7.exe
"C:\Users\Admin\Downloads\iajq0rJqUmx7.exe"
1⤵
- Executes dropped EXE
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\14tbp3gd.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 d3b9aa7beba89e764533fbefdd0f403189ee7f427a58ca525609cc36373e46a4
MD5 ba1c286da6f66f0183a10cfe06aa8a57
SHA1 157406c0c6c6069ae06ce80081db100b11ef905b
SHA512 1fefb2b701ad91de9a57052de472d6def62a776c9d8efbab68c26f1aa47e257398d21d2fdbaa4fcd4a4f93fc54626625b22c45b59523d71d3118ad56ee33cd17
SSDEEP 384:HHMO0iO024YQFuhw+5EL1pPsac4j0lpDII+698M98Y:nrZYQFuK+5EB9sac4ID8LO
TLSH
T158528E7D5F1138BA1A27D284DDA95218CE08E6BBEFD2D05616043C45C684778B8F54DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 53c63b549d94288a3bfdb23f401184e2eba29f3e5d066944ae07731b0b6f8d52
MD5 0c669356d93e6958b48dceee8ae17526
SHA1 581f9a4613564d41a15cf586af8987d19b1887ed
SHA512 8dc34b65e57d295d2ba021391934126bcfa87823d97bac3e991bd25e5a088964b7a737b5a552624896109adb923c05f71f065506e2c57dbac545336b741a3c84
SSDEEP 768:K37nSyeo81mGcmhumKYRZqMIfmsb/b4b5bYbE/:gnSyeoYpmm
TLSH
T192D21280EB1E953FD41512BBDCA50B041F79B88A99192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 f87dc8b830578cbeff32ff862ad8802d75dcd55dd1414cd9d8ec776b517d4d44
MD5 6295f85aa78c9bc21e171e7d3c12c999
SHA1 ebf7830416ee0fcc8ecb4dcae2f4777314702be6
SHA512 67ee53bbd82bdaa22fbc83daa299296e729d671240aee0a4cd9db92c9d82dac58c497c3d505e49454fb0d63c1d3ad9f360c45215bdafbc6ddef66931dccd8fc8
SSDEEP 768:xQ7nSyeo81mGcmhumKYRZqMIfmsb/b4b5bYbE/:OnSyeoYpmm
TLSH
T178D21284EB1E953FD41512BBDCA50B041F78B88A99192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 33KB
SHA256 0ba5215ab6081e3bd6186e55cf9545bcfcb876de3efca3fc308d96ab8e2b0c2e
MD5 0c08f216171fc82428aa10a24c6cb871
SHA1 153744a50d41afee5bf59024649c2210e6ef2437
SHA512 2a81f9d89e8fbb489007b98df1272971cadb9bd3b8966256032b61a860f066462a3b37bb4d741f238d05c9c6a0dda658043e46cb62b461a1d85d2b1f984e43ce
SSDEEP 768:nByN8ZsxbW+GcmhuXoKDvYdMIfnKbpbLbPb5byeE/:sN8ZsxBoj7
TLSH
T11AF23384EB1E953FD41512BBDCA60B002F78B88A59192F973A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bc8ce73ad6998e4885135d9082acec959955279e1825c993132dd8d9557ebcfb
MD5 1c7b34f2203302cd5e8475ab61e5e54b
SHA1 4ce30383b14b05861ebd7c4e22c0b5fffe2adfcd
SHA512 482c48a0a393d73cab089fc99faf784afae54775acd3d8ebb2cc171e390519f3dcbea7f89463b28533b3b24dc90104f58f6a35d87dfa571026a863b7679d8f98
TLSH
T19A216A9C39F88D2AA8D7F2587844028E631A4E0345C71C430D03EECDCDC9AD9316E4B9
MD5 SHA1 SHA512 TLSH

Submit Download

0418b4b9-15e9-4599-9af7-dda15f98ab07

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\0418b4b9-15e9-4599-9af7-dda15f98ab07
Size 235B
SHA256 1c63ad866b5129d210dcf5f878d52435e214ee13a482a2cca5a6803dbee58be9
MD5 a76a1b47f015f07001eff508c67f6b0c
SHA1 252ee2c5da8d247fabddf24e029929f6140b34f8
SHA512 cc92626020033e4ceeae7953ee4cd4239289ce9287f4cba1592672d2749fa72a7e303dd561fcaf61387cc36d1582298c38fbd2ca3de6449c69d197423b8c2270
TLSH
T142D097C02888275D0C040F12F1E128C2309A4C3394606810CA60093499FADC8426180F
MD5 SHA1 SHA512 TLSH

Submit Download

b197b414-6597-4d9a-8003-0a92bf65a2a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\b197b414-6597-4d9a-8003-0a92bf65a2a6
Size 6KB
SHA256 654679d7950c06709e2c3cde779ea43a911c344d56097c108abe06a1ede75bb5
MD5 44164c0fe49c4a9d23e75c36609d3c67
SHA1 deb4b48ec2af9415ad57e60758d42436f9c89fdd
SHA512 678d9a5d8a95fcacfa510496bbf987df1ffa71c6dd66459ce5695e5e7f12ec16b0b93735acbcbe3f03366a157f40bccbcf10ae99ab3025c56c4410bb3cb6f374
SSDEEP 96:wgTvSNxb0U1fnUJLDUm1wbh6Mp/n1dq9aAQw1kgM0z8/yoMMXjxr6ERHMQmoBmNL:wgTvCbVkGAitS7b4LnZEWfA
TLSH
T13BD1CCFECD1250433A76F62EF4A9FEAB005A293149C8879D6BFC483A32D69B71117305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cae8aebe-2667-42cf-a59e-d3a27a4617e8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\cae8aebe-2667-42cf-a59e-d3a27a4617e8
Size 886B
SHA256 67bc30f09fa9ec7b7d096f50786f277beb04792e4cb0e7f083863aa048039983
MD5 7445b4b400c9340f3db81ca838bea67d
SHA1 aa5881c44d1360f3d5793f53d98068085a6a79e2
SHA512 1307975c39e1f43cf7b271ee422699aa5b31f9e04a07119bb20f63759f522c92ddf928128b33c09c3804424353416282b9d340becc241eb8c84bd20cba010488
TLSH
T1EF112392962075B28D7DD297D4A17B428BF87123C0CA0A147F545F1C4DAA01FA39B207
MD5 SHA1 SHA512 TLSH

Submit Download

db300a96-c032-4e55-bbfc-3000f2ae02b7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\db300a96-c032-4e55-bbfc-3000f2ae02b7
Size 2KB
SHA256 bdd4db2572cfba5be703cbe8aff272221387f0de4df7e90a6a6ffe3c67be0113
MD5 7311744f15ffb2e966479681035f50c2
SHA1 8afd049a3a7c041f734c79f6bdfc5bed0d359704
SHA512 b0035ccf062d2c672297547d769412904bd54a1189a44e57d62cb739a4461325505ab590338da13dece8127ac3db5f0789e1cd1c5ba650f4a6b60eb43dd869ae
TLSH
T1D44151DD35784C7A8C8BF25DD092338F8360AA0340C219832E51DF0CCD966DA336E52B
MD5 SHA1 SHA512 TLSH

Submit Download

de9fbebd-0677-4162-a120-92ead972fb03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\de9fbebd-0677-4162-a120-92ead972fb03
Size 235B
SHA256 fba551f5f124213f01a87bf49f5b807ff849575bef4b925dadf577d2e25dfa84
MD5 36b211bdd1336a6223abfa65be3afa14
SHA1 e495e5f5642f6348f5d1fe4c21dcdb9180cf1dc7
SHA512 1e4ff0221599984a5d5950a6d9e8ac35e66f53176364906a28868df979516b290926469dd48f5a431366fd68393dd4ecdb61d91266fb9268ed29852dec9fc153
TLSH
T196D097843888273C88182F47B0E038C231484C3314B09860E5A040B4C9FD9C8C152CA6
MD5 SHA1 SHA512 TLSH

Submit Download

e0f52c92-4635-470a-b443-39897a237e4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\e0f52c92-4635-470a-b443-39897a237e4e
Size 871B
SHA256 7539366890a5d43b54b8eb28b52799f7d99f2155f41a08563f0b4a2eef07ed61
MD5 4eb05e060164414531b44f6fb8f10093
SHA1 9a6c4238e1dd411f30c35b31f59439ce7f26de50
SHA512 d39c9f1d99051929fb4d92aa6469b50dab30d464f88d7e592a931faf8272f73c9ce1742f62b0ae205b5090cfc511f0ef6d64f7a2de976255b1632191445f4a16
TLSH
T1C911EF91C23475B2CE68E29BC4A53B469BF47663C0CA48043EB51F284D6E12AD3AB307
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\extensions.json
Size 16KB
SHA256 1910efdd24b5a6616072b97b59ca4cbcde017f35f869214aeb18e6f241ee0f7f
MD5 801c4b426389af0f495d3d7f26cce649
SHA1 fffd15c36e108f3951d0fa66ff400eeddd43b3b1
SHA512 942fdab63a6da62acc6550036df4c3f06f1fe37a52936db7c25ab3a848c6e944ee1df2e0f9b4ca6d2e9c008f6d926eb9537d7ecb59ce0ab2d4de4544febfaf61
SSDEEP 384:FZkI4vXUmldvS8dhWH94zH96oVL4HNL4P8L4H+L4HCL4H4l4h8:cI4fRfXXG4x6+4t4u4k4Q4E4K
TLSH
T1F972431545049EB8298F979AAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 11KB
SHA256 1d779da04d63bf860ee2f8c825db33451598ad4048a4a10f146f8c4318994de1
MD5 738e10bb38eca65ad5062a9a1c2f9172
SHA1 6ace93d52c55fb28e3fb962ae8ff17eb5095612a
SHA512 ec4aaee5940498d775334d4c10debf2afe9a14e20ab7c5550840478e97a58bf15856933a19fcba003dfcbfc56ed6eaf4a17230c8194d818a7ad51d66206b90ec
SSDEEP 192:MVCRvf9gmqSSGgXLRAIV0mBw8OyDmDAT+:bPERZVnwq3K
TLSH
T1A342CF3C51448B3F24F2327EAC2549A56A660127BAFFBCD305FA84D504DCF2441E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 8KB
SHA256 48e845f04705df939285b769f2fa4fc69ec9a2f9394ab309c624b26c07f9be0d
MD5 56fb76346603e846938564fd2c9deee1
SHA1 f05b5fd8d4b421cc6088576abde36bf75e179118
SHA512 144e2c7635aef9bc0ac0edb103b0cbe1acc7332b5248a2dda263754980f772213ce7a6e41cf320bdc25d57c0cf98020a52f613a7c0bbd9bcbdf5dfa45c8b5c28
SSDEEP 96:xHJslTU9qGqvf9gmObzSwSSl8pdv9jpnq3RWRFWG923Bw88cYbn8L4cnArAGS:MFRvf9gmqSSGg8RAImBw88jY
TLSH
T1ED02FE785004CF7F74B2776CAC2849715A66013BBABF68D710BA84C5019CF3851FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 d74510589fef305976dc36f53e2cff3bb8afeaa409b2f7389f689011b9fca9ae
MD5 f0ed193dd66d3eeb9074461c5b66342f
SHA1 473a48ea5d734af95a57958267b25c67772e7f35
SHA512 107d6d65de85b64a0f5db4682fe08a2c78421a0a203ba1a8d9575192b89fb557d9cc46b1428355a8ca944a575522dd80e0b5fb0f70258623ded76847f1b9c134
SSDEEP 96:xHJsUTU9qGqvfClKjwnj21zSp2JjSSl8pdv9jgnq3RHKG924Bw88n8L4cnA8b1:MwRvfCl36o2JjSSGz9KItBw88ap
TLSH
T1B8E10E7891088B7F74B677ACAC648931AAB2013BB7BF68D750BA44C5050CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 2d67cfb5d2b19c5a38b200bdf218ce80dedb92b925bf92e2536e321b05475ed6
MD5 39eb1c802d1baa98dc28f0cca508d8ac
SHA1 5b6345b59212a0022f25831efb7faf7b81e63b89
SHA512 c90b1bc9aed35f2ae866202583f380427c052db164d29b5d0e94349689fd3c8e087706392f7f38da0b75ea6deb0606cdaa6e11d62d2c4d6093a5e99e19f3a234
SSDEEP 96:xHJsUTU9qGqvfClgm1zSwSSl8pdv9jpnq3RHKG924Bw88n8L4cnA8b1:MwRvfClgmNSSGg9KItBw88ap
TLSH
T1A3E11F7891088B7F74B6776CAC6889716AB2013BBBBF68D710B644C5014CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 7KB
SHA256 b0d79195b0f50646918a2578d7b94ce1e22ee54809a20f2c39295ec80c82779c
MD5 175e99d05c7b890a0ef4fcc480566b4d
SHA1 d9a473e16870e68e9d5382adf25ac148f4d16f60
SHA512 b9dd5508cc8139910c46b2130bbe749bf5a384cfd703e05774e6aa8bc53683be970178f91172affce4e20b686924362992f5cfe469274c7bfff3cb52f8dda256
SSDEEP 96:xHJsUTU9qGqvfClgmObzSwSSl8pdv9jpnq3RHKG924Bw88n8L4cnA8bAGS:MwRvfClgmqSSGg9KItBw88ai
TLSH
T1D0E1107891088B7F74B6776CAC6889316AB2013BBBBF68D750B644C4015CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 81446459ec06342773e1d47fb3ff79576670aa0fec4a7854131a3e537ae3609b
MD5 a09990da6c11db552242a485b4db5fbe
SHA1 af435c66de0b860ea4c7c60b3bf3b54bea7a71d1
SHA512 ae21f1cdb1abc7adb59f6c65e728ea5cf6c2a2a124c89650fff7dea296d7734e99a0df66c6445f66ccbe7e600915948a1d2151c071b39a715d4a2c778e2141cf
TLSH
T18B21E757FD6A3DA7BB01E166C19C8FF0C54120328DD808B0D5AD1C4100C662D334E925
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.0MB
SHA256 a79fca13640ad58bca0a95435a16df4bf8d174ebaf06611a9a79ebe33832ba33
MD5 2c9cccf9810d4ea12c39b3cf1a26ef71
SHA1 e62dc419e9385d1785245a7fc0f7b00791b7908b
SHA512 201c0f9869b8b7de19aac11c695f2b75c9df1d35fc949d389b73d33f0db1f6e95bee892173860ec3d79eb677c37a26f3548a1078a666b85ef28014cf15fc0bbb
SSDEEP 49152:tyk6RVaAIoW8zN6wla0ePlx4zubonrRYI3EVCdNK1LTvuOGUJCw7F18mS8OLeIQj:Vz4bLVQ6kkv/KTz
TLSH
T14D565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA5B8CEB4E877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iajq0rJqUmx7.hekPz0cL.exe.part

Path C:\Users\Admin\Downloads\iajq0rJqUmx7.hekPz0cL.exe.part
Size 1.4MB
SHA256 021f53c2328113f02db282d7bde017efcf807b1021173e497c06711a15d7f98f
MD5 8b923746242130bc39f9566cf8ab60dc
SHA1 430ef7824759dc2295eb6cc5591bf2558c71e350
SHA512 981a338cdb8ee7fa15fcec8e10e2abb21af0eb653f15c0cec041144c9bedb9df4af513605c3533b815e981023b0c76eb804f0adc4d63be846baf22b7f69d6c7b
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizfmQDc06WogeOfQr0W:itMzLAVStcdiT7FoR2A0W
TLSH
T11A65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads