hxxps://u6719092[.]ct[.]sendgrid[.]net/ls/click%3Fupn=u001[.]8TT0Gc-2BiIb-2FLtLPf7HYfsK7DXsnUFJeJ9KlUfuUDX9j9ZZEwRp-2FxAuk81kiA40-2BA94K8Vi5-2FD5MMkGUox1MAUKQI84V5EtFe8jEs1-2FEjx3-2BqhOHocrAhkRSWSgFVgywT499X_OWtYN6KMPHLwU3CB0yCpEmDr6ImESDNt4fCe0bTbbD0LJWn1KyOQtGE2GnNEnwlgQEDPNIArGRrr6FieNSOLyjiQlaZlcS2pep-2BRA07sXXbJD-2Bf-2BoejQKDvv993XtTKOHGa-2FOesN2ll81h1hL2XLV9iZvDLMjASCiYibxrnU7dKm8abHig5NR0toKUsBjjq46jWBYBh9W8PXr7bhTl4yuQ-3D-3D

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
8s
max time network
11s
platform
windows11-21h2_x64
resource
win11-20260130-fr
resource tags

arch:x64arch:x86image:win11-20260130-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
05/05/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u6719092.ct.sendgrid.net/ls/click%3Fupn=u001.8TT0Gc-2BiIb-2FLtLPf7HYfsK7DXsnUFJeJ9KlUfuUDX9j9ZZEwRp-2FxAuk81kiA40-2BA94K8Vi5-2FD5MMkGUox1MAUKQI84V5EtFe8jEs1-2FEjx3-2BqhOHocrAhkRSWSgFVgywT499X_OWtYN6KMPHLwU3CB0yCpEmDr6ImESDNt4fCe0bTbbD0LJWn1KyOQtGE2GnNEnwlgQEDPNIArGRrr6FieNSOLyjiQlaZlcS2pep-2BRA07sXXbJD-2Bf-2BoejQKDvv993XtTKOHGa-2FOesN2ll81h1hL2XLV9iZvDLMjASCiYibxrnU7dKm8abHig5NR0toKUsBjjq46jWBYBh9W8PXr7bhTl4yuQ-3D-3D
Sample260505-jchh4set9k

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1640	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1640	4820	firefox.exe	79
PID 4820 wrote to memory of 1640	4820	firefox.exe	79
PID 1640 wrote to memory of 2592	1640	firefox.exe	80
PID 1640 wrote to memory of 2592	1640	firefox.exe	80
PID 1640 wrote to memory of 2592	1640	firefox.exe	80
PID 1640 wrote to memory of 3272	1640	firefox.exe	81
PID 1640 wrote to memory of 3272	1640	firefox.exe	81
PID 1640 wrote to memory of 3272	1640	firefox.exe	81
PID 1640 wrote to memory of 3272	1640	firefox.exe	81
PID 1640 wrote to memory of 3888	1640	firefox.exe	82
PID 1640 wrote to memory of 3888	1640	firefox.exe	82
PID 1640 wrote to memory of 3888	1640	firefox.exe	82
PID 1640 wrote to memory of 3888	1640	firefox.exe	82
PID 1640 wrote to memory of 1396	1640	firefox.exe	83
PID 1640 wrote to memory of 1396	1640	firefox.exe	83
PID 1640 wrote to memory of 1396	1640	firefox.exe	83
PID 1640 wrote to memory of 1984	1640	firefox.exe	84
PID 1640 wrote to memory of 1984	1640	firefox.exe	84
PID 1640 wrote to memory of 1984	1640	firefox.exe	84
PID 1640 wrote to memory of 1984	1640	firefox.exe	84
PID 1640 wrote to memory of 4792	1640	firefox.exe	85
PID 1640 wrote to memory of 4792	1640	firefox.exe	85
PID 1640 wrote to memory of 4792	1640	firefox.exe	85
PID 1640 wrote to memory of 4792	1640	firefox.exe	85
PID 1640 wrote to memory of 580	1640	firefox.exe	86
PID 1640 wrote to memory of 580	1640	firefox.exe	86
PID 1640 wrote to memory of 580	1640	firefox.exe	86
PID 1640 wrote to memory of 580	1640	firefox.exe	86
PID 1640 wrote to memory of 1996	1640	firefox.exe	87
PID 1640 wrote to memory of 1996	1640	firefox.exe	87
PID 1640 wrote to memory of 1996	1640	firefox.exe	87
PID 1640 wrote to memory of 1996	1640	firefox.exe	87
PID 1640 wrote to memory of 2156	1640	firefox.exe	88
PID 1640 wrote to memory of 2156	1640	firefox.exe	88
PID 1640 wrote to memory of 2156	1640	firefox.exe	88
PID 1640 wrote to memory of 2156	1640	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://u6719092.ct.sendgrid.net/ls/click%3Fupn=u001.8TT0Gc-2BiIb-2FLtLPf7HYfsK7DXsnUFJeJ9KlUfuUDX9j9ZZEwRp-2FxAuk81kiA40-2BA94K8Vi5-2FD5MMkGUox1MAUKQI84V5EtFe8jEs1-2FEjx3-2BqhOHocrAhkRSWSgFVgywT499X_OWtYN6KMPHLwU3CB0yCpEmDr6ImESDNt4fCe0bTbbD0LJWn1KyOQtGE2GnNEnwlgQEDPNIArGRrr6FieNSOLyjiQlaZlcS2pep-2BRA07sXXbJD-2Bf-2BoejQKDvv993XtTKOHGa-2FOesN2ll81h1hL2XLV9iZvDLMjASCiYibxrnU7dKm8abHig5NR0toKUsBjjq46jWBYBh9W8PXr7bhTl4yuQ-3D-3D"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://u6719092.ct.sendgrid.net/ls/click%3Fupn=u001.8TT0Gc-2BiIb-2FLtLPf7HYfsK7DXsnUFJeJ9KlUfuUDX9j9ZZEwRp-2FxAuk81kiA40-2BA94K8Vi5-2FD5MMkGUox1MAUKQI84V5EtFe8jEs1-2FEjx3-2BqhOHocrAhkRSWSgFVgywT499X_OWtYN6KMPHLwU3CB0yCpEmDr6ImESDNt4fCe0bTbbD0LJWn1KyOQtGE2GnNEnwlgQEDPNIArGRrr6FieNSOLyjiQlaZlcS2pep-2BRA07sXXbJD-2Bf-2BoejQKDvv993XtTKOHGa-2FOesN2ll81h1hL2XLV9iZvDLMjASCiYibxrnU7dKm8abHig5NR0toKUsBjjq46jWBYBh9W8PXr7bhTl4yuQ-3D-3D
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {570d951a-c070-4b46-8bec-6d7f3bf7efe7} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {ae92d9ab-f0a2-4ee1-a860-171da36f446e} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 25164 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {2fc2bdc0-f912-44f6-87dd-3198ae656879} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27274 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {e5c4c849-1f89-461b-9755-94bde7bcfe65} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34773 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {bb6a24a3-060b-433e-945b-81074237f7d0} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3216 -prefsLen 35010 -prefMapHandle 3220 -prefMapSize 270279 -ipcHandle 2632 -initialChannelId {52638cb9-a9e2-40ac-be68-4ed84eb7ee82} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 32952 -prefMapHandle 2968 -prefMapSize 270279 -jsInitHandle 2972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4692 -initialChannelId {2ef44e8c-713b-4a5b-b243-6fa8056c2262} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4340 -initialChannelId {db818e8f-eec4-4e10-a3f5-86407be8285e} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32952 -prefMapHandle 5036 -prefMapSize 270279 -jsInitHandle 2812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5856 -initialChannelId {55ff351e-cdf3-43af-9996-55043a00bece} -parentPid 1640 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1640" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 cd6c2aa0ac435f6e946372498cab0adf2c5f8ca5c5b0050c4c75f2040dad4259
MD5 13b6643eaa824b89b0e80948414600c1
SHA1 aef83751d07688de12bfb6229f57711ad147aa14
SHA512 d328f5424a16eff27f18270cf83ba27a623e119a9a5ea3afab249df375f825087562674b068e485a65bba6737351a92ab2f34d1b0b261326cc2a9bb86833c225
SSDEEP 192:ZOv5zboH2ZDxyjvwz1d66Joz0dzgCl6mc0d:2boWZDxyjQd66JozQzgC1j
TLSH
T1B1E11CA4E628863FC014437BCDB61B410F39399A984E3F29759C64192D572EE378E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 953fca4fa1272aeffc5a79a2368d86a6345ab03e6f643c7e1cce76ed042d7718
MD5 e78fec9ca19dd595a933d95723d1863b
SHA1 4d841423dbf0a5a85187b03809930c3f7cb69e1a
SHA512 8c5e644b19a8d1c41dd2243579ff0a829026c9d4db27e9138ebcfc0af6727bc81dbc16d7a3dcc9887d29cd5e38b661f7da634d9a26a0ec08a6d48e2daf573e40
SSDEEP 192:U1d66Joz0dzgCl6mc0dtOv5zbo/MDxyjvw:ed66JozQzgC1j8bo/MDxyj
TLSH
T133E10CA4E628863FC004837BCDB61F410F35395B984E3F29759D64192D5B2EE368E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e03734d186e2c8e812cc076a6e0912e0036411fb24258c8e731ebf0d4f00ac19
MD5 040b6922c8867a7615b0ac809d8753ef
SHA1 06a2da6f1fd9d19a578266d28aa9a898946a127c
SHA512 c7677d4574a1c738203757b81037d7a390c4d8d512cbbb51cc7e126dcc0e26191df84bf7aa30a0a349d27bba5d90fe80121530fcb4a931197e7eef2bbfe773ea
TLSH
T18A21A95C39F84D2AA9DBE69C7444028E63A18E030DC71C630D42DF8CCCC5AD9322E83E
MD5 SHA1 SHA512 TLSH

Submit Download

2689bc8e-a69c-45aa-ac35-084355af9175

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\2689bc8e-a69c-45aa-ac35-084355af9175
Size 886B
SHA256 16124adfcb08b6dc3925a7fc46f91a28fa281f97a675a3164b1ad0caf0c5b784
MD5 a67f8ed8b0ab6f959a2f14b14ca62522
SHA1 8ef78e12b68a483e7be289300130065a745b2286
SHA512 01c04ee8df1015a45576d7eb68b00088033d44d5652f9420020f657336abe5f0cc891a6d8b394f7466b1f5613831166cdc34a5ad142164086b6c0db19826da9d
TLSH
T1BB11E3D18674B5B28878D38B85F577024BF47123C0CF4D187DA58A244DBB52EA397B17
MD5 SHA1 SHA512 TLSH

Submit Download

5a1bfcb1-2d73-41a4-9a60-e9811ee363f5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\5a1bfcb1-2d73-41a4-9a60-e9811ee363f5
Size 235B
SHA256 e5d0cc3cc088a4208a80fb1a0c116b12375899e2971211b1a31325ae19685f65
MD5 8ecbeb4c4c3da56e644f3b63a69091aa
SHA1 bd7aeb72be53c4e475a75645410d95fe3430304e
SHA512 4eb107b44ef18b7a843915094faa8a89f7af4a4c438a9af587fc8bc51e8b21641079874dcbfaab9e0357aca25084d393cf3289b910fb23de958b34604e8ad9e4
TLSH
T1C1D0978428E8635C08140F07F0A029CB30588C332062A820DA600134C9BFDC8139196A
MD5 SHA1 SHA512 TLSH

Submit Download

5d6a45d6-a332-4428-aeec-95d40951051b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\5d6a45d6-a332-4428-aeec-95d40951051b
Size 883B
SHA256 46a8d8251ac0d74ade204b0b35cb72766504fbeaa404a5038108af7dfa9a3b47
MD5 a8eda3e0788f1c944e450d7294cbd128
SHA1 9335a3aab111b0fafe77a18109955deb9c05dacb
SHA512 bd9be89b9ccddf8f5da9eca94e6189a7a1f23ae44294dbaa685ff515e2278fa115b59b8ac8da7c89a82a908e1ac4f56f9047f9406d248336ff03b216cd60a2eb
TLSH
T149110CC1D630B5F2CC38C38F89A137026BF4362380CE88143EA58A240D7B92EA796617
MD5 SHA1 SHA512 TLSH

Submit Download

936da7c3-a56f-42b3-b1a1-bb8f1603db67

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\936da7c3-a56f-42b3-b1a1-bb8f1603db67
Size 2KB
SHA256 accd17182e0a2b2ee257199db6fd672de7ed9f8f2e12c8cd91bfca69661e94f6
MD5 1f0a90f43f715849675a336f2f50eb5d
SHA1 4ab704d7d0196efef93557233bf1613f0f581e51
SHA512 83a4d0be16097495529826c6f29012cf4fce419a7ce674a9eea7a4ec613ad73cfe5c7b61efc593bdaf409423e06f5f4ad0be8baf234f75e187d9d8699073bc6f
TLSH
T15441216C35785D7F98CBE79D9482338E67608A1340C62D936E52CF0C8C966ED737A827
MD5 SHA1 SHA512 TLSH

Submit Download

b5337fc9-7825-4c26-b4a7-6c980f379c07

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\b5337fc9-7825-4c26-b4a7-6c980f379c07
Size 235B
SHA256 8a80ae5bfb386f2639faea218ef3875f44eeb32584369c817c753783f17f00e4
MD5 4c85345205f007a87d6b772f6059148c
SHA1 2131e6cf0753264809db7cbedefa080fae7d7ba1
SHA512 68768c86cc234805f5fc8577421a4f0c5735945187dd0bb1eda962d41804f72f9ede9008c6cd2fe8d306645f52d955864014f7e5dd4ccaa4df0812ed6f6cb74b
TLSH
T184D097802CD8AB2D0C100F16F0F0B9C230844C3314B26820DB614974DABCACC4291C0A
MD5 SHA1 SHA512 TLSH

Submit Download

e258ebc0-ec3f-4981-b107-d591d6dc5190

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\e258ebc0-ec3f-4981-b107-d591d6dc5190
Size 16KB
SHA256 a7aeec8082667b8ffc7b53b69baccadd6b1bcdcaebf377a3acebe2604efc42d4
MD5 f5194e556825a7b41f301c27ab816533
SHA1 403725b094660b5b64a02601f952f88f11b181dc
SHA512 67e9e181b17f3dbdf279199c0f4ed035f201e2a9f85f32718ea2d095ee22f36cc3edef95e9fdd03c5fa0cce64ce009cb2c89626b10abff928076087ad52dbb8c
SSDEEP 192:NjGss8k2isCt19BMzQO30i7zxj7Kuu1PmMJ6HundvKq5Us9ya3kGcpN/2FSXWqWQ:FsZFiEO30i7lj7KZ1EHunrNytjz
TLSH
T17472C9565860457E8691E36895FC7FC3E6F538CF4C018FCA5BE4BE086EEA06D112788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 c7d7ee35cedc4ecde307ec5f8103bdf1ec5ff20da1c7626317c6b464d2c1fdb0
MD5 6478ab455abed0246374b2fffe66a9b9
SHA1 dfaa918087cafb78a5d6be48c582113c21a16f96
SHA512 f474df3eb92dfbe5b2ceada97b60a8c2de56fa746aee61d8e1d2aad5de8ccb1a91d6a31f93ae35de7882857d6d013fb45f18d4f98285dded8f824704956cb0a9
SSDEEP 96:xHAUTUHqGqXfUKjNnjh1zS0SSlcdv9jynSH3MkN/Bw88H8L4cnEVVV5:qaRXfUadNSSM3MkRBw88Xt
TLSH
T131E110789018CB6F74B677ACAC688C316AB2013BB7BF68D750B54485055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.5MB
SHA256 8fb920cc821ae56f1d28ebf90a046aaf023b33a094d3155c1bb84701c6a0c445
MD5 1d0881799186e286db446e5c6121a2fa
SHA1 e908ac5b038360553b81b7d9591f6b528fe9e2e7
SHA512 69fb72d1de3e944c7f82e92686e9fac661d92109ab59c9100a78af9ca4253cefd80d6915e4fdc00cd5a7ddbaa7b4b84a564789a9f4a1e7493fed5e0dbfd754c1
SSDEEP 24576:9gIeyvp5og6+pPS71CVEh12RYCJNiQWcTkhXjCLpAu:9pHj6+dS7sVEeRYCzoSkMiu
TLSH
T1C9063BF860D1A243F3424073B64593EB21EFD00C6027DE0847A956E9A479CEF9E56B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads