0e586b10e3ae4e746186d3e9fc6e6d53af573f249f82447c57e0b0c3fd8dd269

Resubmissions

09/05/2026, 10:53

260509-my8h7sax4k3

09/05/2026, 10:50

260509-mxdbnsax2m6

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
remote (1).pyw
Size 14KB
Sample260509-mxdbnsax2m
SHA256 0e586b10e3ae4e746186d3e9fc6e6d53af573f249f82447c57e0b0c3fd8dd269
MD5 23d5e50e0aaa255f33c3725044dfa72b
SHA1 9357c09d38dbcde2021eb5a3779d93bc51c5834a
SHA512 3a9c6b76feb8d0dfcbd68f461d108ff8f56b273810ba84113c2b14ea631a7e3ef2d9edf2932d891f473e99fae388a32af3f5b27f2be00f8799a1fe4ac4d2ca7b
SSDEEP 192:dS9Sy4QeOXhqHLvJq87sBUkV69FWST3BbKfmLD5vAvYwvuvYYWNL9n6N3vGjYngc:dWDeOXhqHLB9QSTBHhYFVcvig
TLSH
T19F6253F1C8E90816B703E10E79C1B19195557B07BB06242575AC72A8AFEC5B4E0F5EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3940	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	firefox.exe
Token: SeDebugPrivilege	4688	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3940	OpenWith.exe
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe
4688	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4688	2712	firefox.exe	84
PID 2712 wrote to memory of 4688	2712	firefox.exe	84
PID 4688 wrote to memory of 3732	4688	firefox.exe	85
PID 4688 wrote to memory of 3732	4688	firefox.exe	85
PID 4688 wrote to memory of 3732	4688	firefox.exe	85
PID 4688 wrote to memory of 4276	4688	firefox.exe	86
PID 4688 wrote to memory of 4276	4688	firefox.exe	86
PID 4688 wrote to memory of 4276	4688	firefox.exe	86
PID 4688 wrote to memory of 4276	4688	firefox.exe	86
PID 4688 wrote to memory of 376	4688	firefox.exe	87
PID 4688 wrote to memory of 376	4688	firefox.exe	87
PID 4688 wrote to memory of 376	4688	firefox.exe	87
PID 4688 wrote to memory of 376	4688	firefox.exe	87
PID 4688 wrote to memory of 4236	4688	firefox.exe	88
PID 4688 wrote to memory of 4236	4688	firefox.exe	88
PID 4688 wrote to memory of 4236	4688	firefox.exe	88
PID 4688 wrote to memory of 2276	4688	firefox.exe	89
PID 4688 wrote to memory of 2276	4688	firefox.exe	89
PID 4688 wrote to memory of 2276	4688	firefox.exe	89
PID 4688 wrote to memory of 2276	4688	firefox.exe	89
PID 4688 wrote to memory of 2776	4688	firefox.exe	90
PID 4688 wrote to memory of 2776	4688	firefox.exe	90
PID 4688 wrote to memory of 2776	4688	firefox.exe	90
PID 4688 wrote to memory of 2776	4688	firefox.exe	90
PID 4688 wrote to memory of 4316	4688	firefox.exe	91
PID 4688 wrote to memory of 4316	4688	firefox.exe	91
PID 4688 wrote to memory of 4316	4688	firefox.exe	91
PID 4688 wrote to memory of 4316	4688	firefox.exe	91
PID 4688 wrote to memory of 4424	4688	firefox.exe	92
PID 4688 wrote to memory of 4424	4688	firefox.exe	92
PID 4688 wrote to memory of 4424	4688	firefox.exe	92
PID 4688 wrote to memory of 4424	4688	firefox.exe	92
PID 4688 wrote to memory of 4336	4688	firefox.exe	93
PID 4688 wrote to memory of 4336	4688	firefox.exe	93
PID 4688 wrote to memory of 4336	4688	firefox.exe	93
PID 4688 wrote to memory of 4336	4688	firefox.exe	93
PID 4688 wrote to memory of 1656	4688	firefox.exe	94
PID 4688 wrote to memory of 1656	4688	firefox.exe	94
PID 4688 wrote to memory of 1656	4688	firefox.exe	94
PID 4688 wrote to memory of 1656	4688	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\remote (1).pyw"
1⤵
- Modifies registry class
PID:756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4336

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {77e8e898-573c-4800-b079-a3a7b72bd67b} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {ea4ba9d3-5a59-4057-9a2d-492164bc74ac} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27274 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {214d0484-f4cf-4403-98b7-37e3cf94e295} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3928 -prefsLen 27274 -prefMapHandle 3932 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {34edecc7-d670-4958-a1c1-02ecb5f0b039} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3156 -prefsLen 34773 -prefMapHandle 3160 -prefMapSize 270279 -jsInitHandle 2672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4556 -initialChannelId {fa2661b3-d032-455b-bed2-ea6cb73e44fa} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 34822 -prefMapHandle 4876 -prefMapSize 270279 -ipcHandle 4980 -initialChannelId {56862ac7-a46f-4be8-af66-b61689fb75fa} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4812 -prefsLen 32952 -prefMapHandle 4212 -prefMapSize 270279 -jsInitHandle 4916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {1a09a361-12ea-490a-8185-df052c14a1bb} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 32952 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {91121101-6c64-409f-b5a5-2b24480fceba} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 32952 -prefMapHandle 5844 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5856 -initialChannelId {522de5ec-dd7a-4c02-b90e-86408f92c6d3} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6420 -prefsLen 36758 -prefMapHandle 6424 -prefMapSize 270279 -jsInitHandle 6428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6332 -initialChannelId {bfaeb939-ab33-4f2e-94ca-f7db37d109c9} -parentPid 4688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 57fe9aaca56ba025653c512cfad829138393f440aced2379ebd4299c6780610a
MD5 e8a3b1a52b6eb9d5efbdedaa5b678a15
SHA1 009a28b4c9f0e033c78b95d0630f89e2cafa77df
SHA512 e9faeab5f3e6ca8cb184b363e578fac5146357afcfc77ed104537ce8d7fce4530b495c2042a4a5c843910c6601b93cb40d3a2d4f94a8199eddaf2b17fae6b314
SSDEEP 384:HHMO0iO024YdFuhw+5EL1pPsac4j0lpDII+xIj3Ij5:nrZYdFuK+5EB9sac4ID8Lf
TLSH
T1CE528E7DAF1138BA1A27D194DDAE5218CE04E6BFEFD2D05206543844C680778F8F64EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 964612712cc36ba69f8a00e87c972348d8bda80d4d40621379bb9f74bb13cb1b
MD5 abf9286f6aa2aee8441ae318172cd09f
SHA1 06ad7b00a1457811cb78b2a40d6ea13d7e53a3f7
SHA512 8904ae93c46995d1a10667e267d9c2ab5569668f2b9005aebc086268bf604b97d661869a2b1a34058897850ee6f6a0d6d2b741006c93ec660a4c36bd91dae2ab
SSDEEP 192:qOv5zbooZRJyjtxhg1d66Joz0dzgCl6mc0dz:JbooZRJyjEd66JozQzgC1jd
TLSH
T1ABD1CD65F629863FC448027BDCB61F401E35389B984E3F2932DC641D2D562DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4bdeca4e42cac9089fc098605886a55c3871e159849ccec598bd74f3182786b7
MD5 f66b8f2832f03e70c564b6ed55de2804
SHA1 988cbe7666125f504bb063bae327ec3d0952d8af
SHA512 867911a6a80976704f0732f6ebedffd44b7b12103f96ecdfcda844d4921cec18ff28ac78d0324382d73699636d7ae215f7436336d2d9e5bf3a675826d7f337b1
SSDEEP 192:dOv5zboHdZRJyj9ySg1d66Joz0dzgCl6mc0dz:Sbo9ZRJyjEd66JozQzgC1jd
TLSH
T163E1FD64E6288A3FC404037BDCA61F410F35385BD84E3F1976ED65182D5A2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5882f3bf2f4e93c240b289fc15b851a975995c0b3860db12b99dcc4caf788f32
MD5 b2735714f5a9368a462cd6bd820a3639
SHA1 743567e070ab9d98dd99fd434c16cd7c4c5aa1f9
SHA512 ab7fc0be75cdc229fbc00a6affb7be56d3b25aa380ac94bb8352ce3945611a6a2982d806a5a566529067434f1a62bd9c22ec2e1f2da9887666db6bd3f4b445ac
TLSH
T1CD216A9C3AF84D6A9997E2ACF44102CE53658E0605C71D434D12DFCDEC95BDD31AA43A
MD5 SHA1 SHA512 TLSH

Submit Download

15a5b994-c608-4fa5-b3da-284eb487605d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\15a5b994-c608-4fa5-b3da-284eb487605d
Size 235B
SHA256 8f03f9810b72846981119e965e34338d286b531f0793e79355d47543b9847d38
MD5 140f5c42bf1d483b0d6137058ca9dfda
SHA1 bdcf14d13c146012963ec8ac89378fd0c76deed1
SHA512 ed736f15d240862759cac41bd63c0b371d9bc803feebbe0a9db617be03fb4572fafb393695e4d5b5fd1c7d713e89c3588e90730e22f750058627f23b5008bec1
TLSH
T102D09784149C337D48149F0AF0E06AC330848C37307498209A5106749BFDAC40251807
MD5 SHA1 SHA512 TLSH

Submit Download

22120f2a-0076-42f8-a6ab-d11e30640a31

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\22120f2a-0076-42f8-a6ab-d11e30640a31
Size 2KB
SHA256 18c78c69cdb984c0a21a03e7f576d4b1e596462c67b51f5f4e4f423a0810fdf9
MD5 6a4fb2957f76c56f4de8af58a2c4e72a
SHA1 9b4a7de4673ef16a3bb670d0db9d618823a22567
SHA512 27e6d6ee923fb9109352a59460cbad78a8e8576a4b68f2ee55fc5c7e1559897d16a227cec63a3937c8280eafb6e992931d49ec40091aa695812d05e3fa05f118
TLSH
T15D41316C75789C7FECCAF69D9482328E53A04A0340C61C832E91DF0C8D9A7DD736A427
MD5 SHA1 SHA512 TLSH

Submit Download

4f620f4e-1111-4140-b20d-07b9a97e8855

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\4f620f4e-1111-4140-b20d-07b9a97e8855
Size 235B
SHA256 dae6d8779d893808e8f271fa54f6aaea22aa7a5cbc593a3e1938667e304f6bfc
MD5 c0ab806d62804661cb4e130c5b7b2abe
SHA1 09b266271a5824dcac4b08623c5511a4a4b5a71d
SHA512 466a8f0744d7ba6e3b382d553e53fe98b05b2531bbed39a6d2f9454297dda00a5b0cfb1947bfd972ae0f67055edcb1470c413f7712f1c7b21eecb93aebe34ff1
TLSH
T105D097946C88EB7C08200F1BF0A07CCF30A44C3320709830C96080389AF89CA622181F
MD5 SHA1 SHA512 TLSH

Submit Download

9f9f23c3-b34a-4f51-841a-080cfc099495

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\9f9f23c3-b34a-4f51-841a-080cfc099495
Size 886B
SHA256 9aa7f7082d5ca763022d4d725db53d7ed0818ad470c090630de890bd9d4006fb
MD5 75098fd2edd0ccbc81e119392a745310
SHA1 1b8486184822b1ab0dcb835231506c9e5cbd2d7e
SHA512 119c5b9b4e305820f94fb79ef3b7c042e98dc8a12bf1e51f93d25e975a4198e48b4b02e5d142cabd112a099be4c9ce83932e272b2f80aaabbe8bd5a9d0789c1e
TLSH
T1AD114001A631BA73CC2882CBC5D1BB4286F47023C0CA0918BEE08B280DBE51EA366607
MD5 SHA1 SHA512 TLSH

Submit Download

c8d84623-7063-41b4-8b17-35678e66d5ab

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\c8d84623-7063-41b4-8b17-35678e66d5ab
Size 883B
SHA256 caeaf920ebfe288a2f81be01703ea99295caa8892c756ae02338e5ec07c04510
MD5 f8ab19d90e425689fad38acbf957ee8c
SHA1 ed87aad2e490676ffdc4dcc9f115553824c6f5ed
SHA512 0cffb6535e9dcfe339139ce4733708754237bbea396d757564cfb11b81579fbf6f9e0854ae795e0c9034a64d14209b866509383a05d8bec7ad3e3d7238a020e5
TLSH
T171110041A3357A73CC68928FC4D57B425BF43423C0CA48143EE58A140D7EA1EE367607
MD5 SHA1 SHA512 TLSH

Submit Download

feb31c69-290d-48e5-995a-9874502d6133

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\feb31c69-290d-48e5-995a-9874502d6133
Size 16KB
SHA256 d326cf9ecf8722a9baf1d509e7c11c73a01b46db8d9e91de5ca9ada5082120c7
MD5 3b8c92fe7011e77f90b01c28deee3d90
SHA1 5f36f6f47269e919a93411281cce16eebd6cb2ba
SHA512 a46c0fb431fac00f45328f0120de9f3f7d9d62edc01f7bff54e15fe6240bdf8dedbe73b9041c32410c0946969715db2293df3380c1a7a5f7ddfbf3c0bec9d643
SSDEEP 192:sWuJYhCg0xZkBSm51xIC+U0UTyuvbeznv/nJUAfjDUrtiTUupESdI6X2L0kXjK1x:sWnhxcmO5z46GL0kXjK1SKyClg/K
TLSH
T16572AA56582049BB8291E39894F8BFC3E5F528CF4C415FCD9BE4BE086DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\extensions.json
Size 16KB
SHA256 497aada7fdf64a62b39c65a572a2e3feeaf500a3f792951b9a016cf25509aaad
MD5 1798f120b2f51b16ddd8608386c24110
SHA1 7253a7e1d2d3c372da199cd8f53f0f5c4140508d
SHA512 b546426ae15dd9f17a63d32583670d1dbb2a6bcacf14e0f99f9a14843f0c494abf46595f6d13615b2851414113d18cb89b6e74f4322c7fc43c69fa42855eab7b
SSDEEP 384:MkI4voUmldvM8dhW894z896osRL4HmL4PKL4HGL4HJL4Hu34hq:DI4QRfVX94U67J4s4A4M4B4Y40
TLSH
T1A572331545049EB8298E979BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs-1.js
Size 7KB
SHA256 3b3e9171fd3a5e43b6a48a4873ff469f81a9677a9bb947a0197aa3a5cf8b3a09
MD5 76013aa94d6cfe4e9538079d0781d7fc
SHA1 c1c3fae1b1fe2e0bc104a1c89270c29e6691fa23
SHA512 b7c048ed46f412149ce12c39eec90407587b9490eff761a46784f692c8dfe56d9c3f5254ce843d35c80fe705d40c654326acef768f578c3517e4d41700fc4976
SSDEEP 96:xHHJUTUtBoqGqV0fYOlObzSzSSlldv9j/nYtHFLkBw88H8L4cnZhLMsGS:njRmfYOltSSeFoBw886j
TLSH
T1D9E1227854088F7F64B677ACAC6889316AB2013B7BBF68C750B544C4015CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 186529efa370fc73889ba8688a2092df4d0b26e821b67d9a4e4d2d7b57ded08a
MD5 3831ac3c9b35b015138df1d745a4a2c7
SHA1 bbf0ed91da2d57160a4095c22413d17255ca82a6
SHA512 379579cb007f294bb2c48bd90f10ebc5581f1ab3f288da2b340a86f518861bec92f2e0fc56e6d15060f1be5bf7268c1359057f67af95acded068fe430979dcef
SSDEEP 96:xHHJUTUtBoqGqV0fYKjzDnjb1zSeSSlldv9j2nYtHFLkBw88H8L4cnZhLMR:njRmfYcDf7SSDFoBw886s
TLSH
T132E11F7894188F7FA4B677ACAC6488316AB2413B7BBF68C750B544C5054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 8KB
SHA256 852f91190c5396fb24ec6da504121063feab06a13835256d03c86f38f5493e73
MD5 8700c3075d9ed0053a94563aa6d11a13
SHA1 5d82b46a1818ca6d16980152d4d5fcdee70b2464
SHA512 d75e2583d5ad0d77ff59963a37db261b1aa2747b8c81accab3a53570de3d8edfc5e22d68c139ee4e9d8a4c27749907be85d893b1d3d27151f1a936e845067d1f
SSDEEP 96:xHHJFTUtBoqGqV0fQOlObzSzSSlldv9j/nYtWRTxLBNBw881EW8L4cnZhLMsGS:nORmfQOltSSrRVlNBw88q5j
TLSH
T156021D785108CB7F64B276ACAC648D715AB2013BB6BF68C710B944C5114CF7846FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 5968f55c1c7838de6c46675e92d13374fd46f762b8c94a4ac5072444a9e2813e
MD5 ede91979f4e358cf154d6d145120e8d6
SHA1 b7318110f9af3b16862a7acf86329d43a2ac0ed9
SHA512 e7826c3cad0a54b56a22e1bdcaf41ad3d65a79c8a89cbcb5296544a29069beef6df8441940270ca86cddc6428da27e33e5f46bad9ba89d78cfb53d70739fd6a2
SSDEEP 96:xHHJUTUtBoqGqV0fYOl1zSzSSlldv9j/nYtHFLkBw88H8L4cnZhLMR:njRmfYOlWSSeFoBw886s
TLSH
T109E1117854088F7F64B677ACAC6889716AB2013BBBBF68C750B544C4054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 8803c3e81583dd3d4170430d03307e4067ad3c7689f2fddeac3115a8f5794212
MD5 4fcffeb223a44dc025903664891958f1
SHA1 cae85b509add1fd0495123e5d8fd0a1cdb89a755
SHA512 9e4ea04a34b974fc29297a4b9006f0ef8593bd203e9d253d3380b34ac10b327dabdba8777de410662db735ed6eff0cd542cccea707494b5d3aa49ee8873b9a5b
SSDEEP 96:R2M/jtS946ysS2weJ8g7k5SMZk1f8W8QU3goS27GvJ4l:Rd/Y946wK8gwSMZk5yLfzl
TLSH
T1A3B17C63D41CF983D9F8B5E500D14A87E37B6084D7E145D09718053B915A3D63BDC6B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 fe97cae2c6efd8d3244b878fc1a7bfda3b087d0ca1f5a331282210e95d6c2167
MD5 fccd2aa8ff2e0c5583b3c1748511fcfd
SHA1 3448b025b8e74b45386d1d4d6a5c81b14f09ecf9
SHA512 e0e361afc219a75f8d73fa3c519129971bd6a71c5d105c170dcca342980f9220c57049290400b8274bbeb148e236f9a32fc3edc4f539537fff958fd241e3a675
SSDEEP 96:y2M/jtS946yYAZ8J8h7BQyMZkWf8W8Q73goS2ev97JID:yd/Y946Pqw8hVMZk4FLSvMD
TLSH
T158B17C63D42CEA86E8F878A600D64A87E3B75484D7E44590D614063B905B3DA3ACC9BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8ff1f172ff229555c7dd98167bdf2aec6ac668a63782d0fd5fdf94eb745e5b42
MD5 4572ffccf4a93e5eb3950bd5dea7cd83
SHA1 c082b3434db1318d89b02bdae84b71f56407fc29
SHA512 00e8c19f554a084279c83b7667c086dff30a8608857242dfbb0fdfc51a4378d53a638a5b82c56ef05b786a907032c1b3df0f08eb07a21f753a39946727c442fd
TLSH
T11A21DA47FD7F78B22386C14791C9AFD4E78560A5817CB8F0D879970119C865D328E34C
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads