hxxp://celebrated-fudge-7f6414[.]netlify[.]app

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://celebrated-fudge-7f6414.netlify.app
Sample260511-2m2c3sbs9x

Score

6^/10

google persistence phishing

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
32	4236	firefox.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe
Token: SeDebugPrivilege	4236	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe
4236	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4236	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4236	1828	firefox.exe	80
PID 1828 wrote to memory of 4236	1828	firefox.exe	80
PID 4236 wrote to memory of 2380	4236	firefox.exe	81
PID 4236 wrote to memory of 2380	4236	firefox.exe	81
PID 4236 wrote to memory of 2380	4236	firefox.exe	81
PID 4236 wrote to memory of 3880	4236	firefox.exe	82
PID 4236 wrote to memory of 3880	4236	firefox.exe	82
PID 4236 wrote to memory of 3880	4236	firefox.exe	82
PID 4236 wrote to memory of 3880	4236	firefox.exe	82
PID 4236 wrote to memory of 4280	4236	firefox.exe	83
PID 4236 wrote to memory of 4280	4236	firefox.exe	83
PID 4236 wrote to memory of 4280	4236	firefox.exe	83
PID 4236 wrote to memory of 4280	4236	firefox.exe	83
PID 4236 wrote to memory of 1164	4236	firefox.exe	84
PID 4236 wrote to memory of 1164	4236	firefox.exe	84
PID 4236 wrote to memory of 1164	4236	firefox.exe	84
PID 4236 wrote to memory of 4424	4236	firefox.exe	85
PID 4236 wrote to memory of 4424	4236	firefox.exe	85
PID 4236 wrote to memory of 4424	4236	firefox.exe	85
PID 4236 wrote to memory of 4424	4236	firefox.exe	85
PID 4236 wrote to memory of 4068	4236	firefox.exe	86
PID 4236 wrote to memory of 4068	4236	firefox.exe	86
PID 4236 wrote to memory of 4068	4236	firefox.exe	86
PID 4236 wrote to memory of 4068	4236	firefox.exe	86
PID 4236 wrote to memory of 4408	4236	firefox.exe	87
PID 4236 wrote to memory of 4408	4236	firefox.exe	87
PID 4236 wrote to memory of 4408	4236	firefox.exe	87
PID 4236 wrote to memory of 4408	4236	firefox.exe	87
PID 4236 wrote to memory of 3104	4236	firefox.exe	88
PID 4236 wrote to memory of 3104	4236	firefox.exe	88
PID 4236 wrote to memory of 3104	4236	firefox.exe	88
PID 4236 wrote to memory of 3104	4236	firefox.exe	88
PID 4236 wrote to memory of 2536	4236	firefox.exe	89
PID 4236 wrote to memory of 2536	4236	firefox.exe	89
PID 4236 wrote to memory of 2536	4236	firefox.exe	89
PID 4236 wrote to memory of 2536	4236	firefox.exe	89
PID 4236 wrote to memory of 2400	4236	firefox.exe	90
PID 4236 wrote to memory of 2400	4236	firefox.exe	90
PID 4236 wrote to memory of 2400	4236	firefox.exe	90
PID 4236 wrote to memory of 2400	4236	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://celebrated-fudge-7f6414.netlify.app"
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://celebrated-fudge-7f6414.netlify.app
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {6018575a-213c-4a05-9bbc-4d66363fb4be} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {de521a88-fd4b-4d17-98e2-53e6aac2811a} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 25213 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {710926cf-9d11-44bc-85f8-68a4d71b0754} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27323 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {dd7e65b0-cb2f-4960-a3fd-97b47edde798} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2820 -prefsLen 34822 -prefMapHandle 2764 -prefMapSize 270279 -jsInitHandle 2768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2752 -initialChannelId {68a20842-3ede-48bf-9e9c-4d482a564ee9} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 32819 -prefMapHandle 5056 -prefMapSize 270279 -jsInitHandle 5060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {e959ec15-5d90-452a-bbfa-8635d0f1d455} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4876 -prefsLen 35010 -prefMapHandle 4888 -prefMapSize 270279 -ipcHandle 2748 -initialChannelId {01e2134e-a383-4f45-aa20-6b0b90f3c773} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
    3⤵
    - Checks processor information in registry
    PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 32952 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {ef933ebe-9776-4959-8310-40d6b98c7d74} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {7d4ca229-7740-495b-91cb-15a1f8a1e79a} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6012 -prefsLen 32952 -prefMapHandle 6016 -prefMapSize 270279 -jsInitHandle 6020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6028 -initialChannelId {fc3cfb7f-a779-4d9e-8b4d-c5d7949d0b34} -parentPid 4236 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4236" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 aa8ef4d610bc9d3fc1cad11364315dd53cd275f2e71be73736b8a402b0b0826c
MD5 01e705c03f3b3850fa0c887f0dcc0536
SHA1 df14b43bbd3c0afed7e925063a025c333fa8ee4e
SHA512 d863c7a46ea5701fe8458c26a1605ada8ff95eeb917dc3b12eabf872f8c1f037dae391512ffc132b02ad5618d587deb98be83b8422a4f04b68467095d4d5346c
SSDEEP 384:HHMO0iO024YIo6J+Sl1xDnZBPsac4j0lpDII+NdLidLx:nrZYIo0+Sl7zZlsac4ID8Lo
TLSH
T124528DBD9F0138E91A27D1D0D9BD93058D08B6BBEFE280661A543C44CA487B9F4E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd4a952d-8398-4166-b0e3-25d02e9f9dda.zip

Path C:\Users\Admin\AppData\Local\Temp\bd4a952d-8398-4166-b0e3-25d02e9f9dda.zip
Size 3.8MB
SHA256 6ae235b8ff5729383d3cf219320341b1456ad9c47696a519535abde34bc06004
MD5 22d280b2b7cf41f372676e1ad87a2788
SHA1 c191fa824f41a7785a4e4423e3bb19debeb9fe76
SHA512 0dcee546cd38ec992b9d4b722c96e5c20d42ec3efdf4c48b865ef1002662e6ddd274fcf259649fda5d9516e567c041e36b8bda2723a9eec852738708ec15043c
SSDEEP 49152:5trtdv2tUMTenCTqL2NQTpkMXjumT8XwQzqiUlUsPPMLvzhOF3myTIvIeOX2hxNr:5tr1C4FtkMp89JUlUEPMZOPTLmhxNsK
TLSH
T19A06E135F67C9708CDCF83BA810E2FD29C4C5F6680D8A57B6A6AA5715CA31E21F448CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bc4b887c4f579075cc6c04cc9d0ee8f4a39ac1430630d6e3f85ea370cc711b8e
MD5 57d96577a660f68fe8d1ff1324ae9ea5
SHA1 d9b0a75c1048c36930f9a8a01ffcf0113a879324
SHA512 ec3ca44f9aacad0f5648c2ca6d5edc15ac597692ac7715c5660091e8830e6f51b44c75831627bcad3944901f9eaeecc3d557083c697c2d1a897149f544b5e415
SSDEEP 192:d1d66Joz0dzgCl6mc0dZOv5zbotZDxyjvQ4:7d66JozQzgC1jIbotZDxyjL
TLSH
T19FE101A4E638863FC004437BCCA61F400F35399A9C4E3F2975AD64182C576DE3A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8f7aac0e00354303c04f5306f288bc65a65eec4b9bac61a4328daea5d9275268
MD5 f8e3cc4b94171c8fcfa807d9d7554bf9
SHA1 1ce85d00a34c2c2a96439fbf857f354cab255b26
SHA512 5d7d280420fbd1ff28c0371227d0a324e3a5eda39b03984fb98f8b6d428542c0955f5e196083f8aa94925066dd3dbb310217cdf3451b127a893b9b5fe46ec057
SSDEEP 192:iOv5zboobDxyjvxO1d66Joz0dzgCl6mc0d:BboobDxyj6d66JozQzgC1j
TLSH
T100D1EAA4E638863BC448423BCDB51B400F31399BD84E3F2975ED64192D572EE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 48KB
SHA256 3c2bd056156c133527ab0889b26d1c643dc01bc905895e5e0d248f7c9040ae3d
MD5 a48e918b5b038389c442ac56746fb183
SHA1 8da4a34627adfbdfbacca8fbe5562aa1d44b3461
SHA512 4c1c5a4338c4efb7ee78ec09e73c260b9ba87abaf1bf9238eb1dc88a31ed8aa1e40ace94ab30d8fdda90f01d685b5a624c9e20e5b4c4341726ef3a84e2fa18cf
SSDEEP 768:J4KyAo1ElyFp6Gcmhu9BcKquPn3y58E5v7ebNb3bPbVb/bxbabjb7bHNbddzvwdJ:JyAo1ElyocLNbddzvwdJ
TLSH
T1DA23F144EB2E953FD42802BADCA50B002F79F88959592FA73B5C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 48KB
SHA256 18906da9c56f06babe9ce6eb765b79b71c3366f548502d2896660dbe5c744f03
MD5 6ab5c4e70b3ab68aa2b1530f01a8ffda
SHA1 fe984e65d884db0bf42773e69cc0a997d43b908a
SHA512 04251e6077b083d7d72c0b7ce6cacefc597f24a977ba6e410a3eeb88ed205cef662bc6b6068c58b52ba218bcf47425407521555bef77681aa1ae5c7bbfa74fd0
SSDEEP 768:nmw4KyAo1ElyFp6Gcmhu9BcKquPn3y58E5v7ebNb3bPbVb/bxbabjb7bHNbddzvm:DyAo1ElyocLNbddzvwdp
TLSH
T10A23F144EB2E953FD42802BADCA50B002F79F88959592FA73B5C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 48KB
SHA256 71db7d940e3d6792ce7a100239ab6ee25acf926af6d29e3fe62a56ac0a63ed2e
MD5 b3bf84d682e913f1c9fa3e324eb9376f
SHA1 197e3bc1ab833aa83d066e85e4f630dc4eff87f3
SHA512 09e179a0a73d9284eb6c6169a4f0bfa7ea8c675f18fede644022ec16c4f9dd22ece1a82d689014ebdc4eeb55a072c175314fb514d5f2da46cfd87ea93402bc0a
SSDEEP 768:AyAo1ElyFp6Gcmhu9BcKquPn3y58E5v7ebNb3bPbVb/bxbabjb7bHNbddzvwdREH:AyAo1ElyocLNbddzvwdY
TLSH
T1D723F144EB2E953FD42802BADCA50B002F79F88959592FA73B5C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\events\events
Size 1KB
SHA256 19c38814bc2aab8f5e5190ca78d8aa07c029fafb2f319c2299fee58fcb42b2a2
MD5 26facf9d371934bc07f3190ef32d7f24
SHA1 c4c57486d84213431d1bfa2d15234d051c016316
SHA512 b13d0491fb7368abe55333ab726b94b75c4a9c8a2220792c8d02ba95eefd51e22b5b05905d7d3c1b123f8b551e5dde0df5486f11598e9ba07d7fc5bf019bc16c
TLSH
T1BC216DCC39F98D6A9ADBE2ACF440028E53554E1708D71D430D52DE8CCDC5BD9326A439
MD5 SHA1 SHA512 TLSH

Submit Download

41faacf3-4675-42c5-a450-8a32a0eb41a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\41faacf3-4675-42c5-a450-8a32a0eb41a9
Size 2KB
SHA256 dc92c633968a3437de4301a6284170ecf0d4816d8837e4bbdaf244fecbbf097a
MD5 cc5c3ddeb379d51350d7ff2e121a9c3a
SHA1 0fb2477bcf414a6be3953b71daeec53dadf9675d
SHA512 7c7d1e797c31e4d12e1d27e463998bf48beafdefd840cfdbee3ed6b240d5ca0283e08132a1152ad57b977900acde0ef4a8f5bcdc1874c26552e7a6013040e09c
TLSH
T1784136AC76789CBB98CAF24DD051375D53A08B0350CE2D532E51DE0C8C966EE336B42B
MD5 SHA1 SHA512 TLSH

Submit Download

69c3ef7e-8e1b-4046-b6e4-c63ecbc7cb0c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\69c3ef7e-8e1b-4046-b6e4-c63ecbc7cb0c
Size 883B
SHA256 a7b6ee947f53103ef0e2864534bd4461c7bc60446c025d1e0f88ca47a5e510c0
MD5 69f351e98aba944add2d0f6736bcd2de
SHA1 88cb1739290572a90acbccc8885fe28768638658
SHA512 6fdefb97e247fae767c50a03d552938eb0feec93a3c8c1c72b7eed465759b92f75cf1e9c6ece0e0b532150cec2682be6c8bcb646927e31b16e6e7f8cd90c1449
TLSH
T12811C081D730B5B2CC28C28F85A53B156BF47123C0CA45243EB1CE140D7E92ED36A65B
MD5 SHA1 SHA512 TLSH

Submit Download

7bd30180-d9a1-47e3-bc6a-371984195f7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\7bd30180-d9a1-47e3-bc6a-371984195f7a
Size 886B
SHA256 5965361d388f809dc3fe278a73b3b9a72df8d6920928ad221aa6268fb886cf52
MD5 4860679bd2d1b36f8dfcb81c8fd48ffe
SHA1 474fcb18f039de3233c0269f1cb65e4bbefd0532
SHA512 a87e38663677fc177e3ad61c678e813b48f41429aa19507206b53aa7410c144f9882cefeacd27633dcef8b82cb990c0fa77bc4eb246d7972f3b765bfb33fa410
TLSH
T11911E7818670B5F39C6DD34F89F1374547A47123C0CE49147D714E144DBA51EA75761B
MD5 SHA1 SHA512 TLSH

Submit Download

80cb7941-49a6-4305-b6ac-f93258c8a606

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\80cb7941-49a6-4305-b6ac-f93258c8a606
Size 235B
SHA256 5ed901d807c29106cf51f37f678c8dc9d915e4a0a61a5dcd73d321cba27c6137
MD5 b7335f6c0dc1e8e8d841b950a68b9b38
SHA1 0602ffdf46be5a9242108ce4c36fa627fa68c83a
SHA512 8dea6cbc238ed12326417ddc7f6595573180ca574f5aab45f469c1fda8ad3d6066ea62b352305b392de37216501436d68a197e898aa1663f8836f6d3181aa839
TLSH
T1A4D0A79168A8679D0D248F07F0E169C731944C3364B4A860DDA14578A9F9EC99256D1A
MD5 SHA1 SHA512 TLSH

Submit Download

f7f04bb0-62ee-4f8d-9faf-872f3331dc9d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\f7f04bb0-62ee-4f8d-9faf-872f3331dc9d
Size 16KB
SHA256 dc5defd3f4b227de03205b368c3003b4280680e376c65c5768ffcdf1b36f63ed
MD5 d3df0610e1770d740dbc7e5eb1e1b78f
SHA1 a10f54cd991f4a1033daf2d0806357639623aef4
SHA512 63e716d31be45b8504570b1516c8e9496a16e05c433f3d94c090d275f8480c2f3caad9a58d8b5f779a77d1ba3e81803c801420995b5f2a54e65b1a39b431c0c2
SSDEEP 192:fbd4suje6tzUBO0p52TM1tZYRellaMUEWRX79JChfxecEhxF85sI1J1ksAtR0nrp:R4szKzUZOTLzxeqI/QR0nr1YJS5
TLSH
T14772C956582045BE8691E35894F87FC3E6F538CF4C418FCE5BE4BE086DEA06D112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb1d3dd0-0b14-4c56-8a07-e60fb3ec1aee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\fb1d3dd0-0b14-4c56-8a07-e60fb3ec1aee
Size 235B
SHA256 11efff26ce6a8ff95ee8bf8106aff2ee5ed1376f03ed52801465468517e825f9
MD5 c452f2696c4aee519d494bb9dc9e7fc8
SHA1 4a61ed46af56175b5d963ba482a860fda83a998b
SHA512 6ebc5a701df32f0ad3346d6453f82aaca918e3c0d1990a8e1f7b0f7fe9f982faaa8b95ade15c84a5d0e5d2876e04c8946ad21ac4108c162fb91e6f6c37201460
TLSH
T1AAD097902488675E18000F03F0E06CE231A64C37A0B0BCA0CA50467889F9ED4021280B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\extensions.json
Size 16KB
SHA256 d28460b30e1258d98b1ab888771ef9fafa834e4ca9f8a5cd8a1b0f458852bb3d
MD5 25f74bf6a6747c602c41e49f78a6a5fb
SHA1 07a878405561ce67b35496ea3a8fdc4ff87bbf92
SHA512 a47181efd1c552e14bf7c2f4c07e6777b0e6ae5b53e275b541202494b57e4aad7cbdb16c4b2aa52ff8bb82453be5fad8d0f717c1fa0a6af173cf29d3253f9829
SSDEEP 384:tkI4vgUmldvJ8dhWu94zi96osL4HUL4PwIL4HTxL4HaL4HpJJ4h8:OI4YRfqXD4q6J4u4IK4zp4I4x4O
TLSH
T1E672331545049EB8298F979BAA367E01C37D433B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 8KB
SHA256 0059e7119925b9ded6dad468fa43058f81ea36684e673f357cdd414391199c13
MD5 1c3a8f24d5f6ea0beb2b192a89d250cc
SHA1 ace3da46f69989855798d974c98fdbd9dccb5b85
SHA512 1708aad5bfd4909296fc11887d7b24f7d24ff262618ff430fc99a2135c99e70287d53bda56bde93c56eb8c2a782d290f8dfd61c6b8f22066475307c778d73ecc
SSDEEP 96:xHA1TUHqGqXf161ObzSGSSlcdv9jOnSWRvzMkNgBw88kmks8L4cnEVVVEGS:qzRXf161ESSpR7MkyBw88eq2
TLSH
T13A020FBC5104CF6F65B236BCAC2849705A72013BBBBF68D710B94489455CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 7KB
SHA256 bb6d370f4d09b78feae88aaf0e395940f605d9ce99426d1fe3ecb8fbd59f2024
MD5 8e839f80cceefe712f886957ec68b747
SHA1 57ebef625522137bf2b9196ca8d4b6bdb294b91d
SHA512 c99b062beb482f7a51d3e66e257b395a8f7ff87327d2fc752345b626509f3a37f4421fb3a660ee0f8426875b39ea1b85c899924da34ed7bf62b983859c83a169
SSDEEP 96:xHAUTUHqGqXfU61ObzSGSSlcdv9jOnSH3MkN/Bw88H8L4cnEVVVEGS:qaRXfU61ESS83MkRBw88X2
TLSH
T1CBE1207890188F6F64B677BCAC6888316AB2013BBBBF68D750B54484055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 af6b0571934f691889e9ef7953f5358f08365a50a3f54c6a42b66c139a38a2f3
MD5 255acc3c88247fb4efc313503f63a6ae
SHA1 6ce063b981636a2ce85fb2fa571cf860a37153d0
SHA512 61dc50b86d4bb7fa99ef541d8620fa616f41dc0b3b1dc030751c8912c32a5d89f652b49a22ac54af6f99077bf4d5225d7046418d96df9a8342ac0834d66df3ee
SSDEEP 96:xHAUTUHqGqXfUKjNnjh1zSUSSlcdv9jNjnSH3MkN/Bw88H8L4cnEVVV5:qaRXfUadpSScA3MkRBw88Xt
TLSH
T16AE120789018CB6F74B677ACAC688C316AB2013BB7BF68D750B94485055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 12KB
SHA256 4d4c982987a0074a180a358e3bf15c629d4f026397aac567e5e8c666a87bd3bb
MD5 422042276632f01f81e02bbcb142cabb
SHA1 0120df532abe8325cbc1b85a75da698aa66ed829
SHA512 06c13adc1318b9930ff1cc6d5acec082e57019df1dcc5487894000e3775fc564cd5def2c6086187c93689cd7848fbb98a8ec7b0a007852f3106fcaeeca72f316
SSDEEP 96:xHi1TUHqGqXf161ObzSGSSlcdv9jOnSpwoDRvzMkNMUMmBw88SqfTtyL72S8L4cO:0zRXf161ESSALR7MkxMmBw88SKtyL75l
TLSH
T19F42CD7C51148F3F66B2327DEC254AB019620137BABFBCD705F8849A489CF6441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 4db322095261367d69d396c3f5e60a765921e3dc95169c596815214963aeb572
MD5 56c415f1b7fd4508016ea10f82a57e2c
SHA1 12df86085a1b5ffbf0cfa669f6eacb37e286c428
SHA512 8e93d3c049874b93b9185304f32490d6bbccdfc232cb7327c0a12057f9a7782a4c7eba741ba9d4fa162da88d506408182153cadcd09222544dbd8217089c12c4
SSDEEP 96:xHAUTUHqGqXfU611zSGSSlcdv9jOnSH3MkN/Bw88H8L4cnEVVV5:qaRXfU61XSS83MkRBw88Xt
TLSH
T1AAE11F789008CB6F64B677BCAC6888316AB2013BBBBF68D750B54485055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 fc6b519623f8a6e1c61b1e2c27345c6c695eada7606de51e221e95df055fa11f
MD5 fd7be3cb27f95a8f5e1f49a1245f139a
SHA1 1b976f460dff0d58e48529c66ae9f7e9baef98e7
SHA512 12d436e996ca200593c2d2ff678b2a16e3d63c0bd5243212d598f31a956796340eb59ff8a3f7168ec362e0c518711cdeac450e0c2d5f328fabdbeedb46ca6b4b
TLSH
T12921B957468F2ED6335112A9E4458BE65A85343384F7A0B0814EAB8A1E9F45D328E128
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 1651c1262625ba3aa0fccb5bc7fcd531f7edfef8b2df41908b6e6065556060ed
MD5 3805f5e110c178b19ac881b39510bf76
SHA1 20bd6a66927ecfe7ba78faa8ce7746c4b5e84d3e
SHA512 c8a71195caa1ae715453e7f6165f6be6ef50fbcb2bf1f9273167fcff4e4d5dc227acd542f8faf7d69debc2315555cc62ea78535783e94c7f525432e632e5a6fc
TLSH
T1BC21E957854F2FE6334102A8F0484FE65B813433C4F7A0F0814D6B8A1D9F05D328D528
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 8.0MB
SHA256 e3f556cf19a6e870fd9a90f4e62a24abb9cd71e80d4d9f5ba3ff6119c28cc23c
MD5 c9dce344eb5e217b6d968a1ab7670628
SHA1 61ed22aed36c910c315a59754544ffb71c483272
SHA512 bf2f07f5aac9d71fa3cf349f72342190d53e0b26f53e732ac24f4c60f804af966f4a0fe78eec55dbef0fd9f7b6e77b804debdf87121eca170e3e696d34be36d0
SSDEEP 49152:e4kzRVaAIoW8zN6wlll1flxXeuX1XbTc26DWY2eCteigXMQPuFr6NsZFmRg67s/x:W+NsZr67sceNqj31m40+I
TLSH
T1F1867DA131E283D2DB4580F3B15F53DF206FC19C20F689481B18B26D9A675DBDE9B368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads