hxxps://development[.]trainme[.]com[.]au/

Analysis

user interaction
yes
max time kernel
415s
max time network
412s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://development.trainme.com.au/
Sample260511-e44s7sew9q

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe
Token: SeDebugPrivilege	1136	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe
1136	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1136	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1136	4532	firefox.exe	79
PID 4532 wrote to memory of 1136	4532	firefox.exe	79
PID 1136 wrote to memory of 5296	1136	firefox.exe	80
PID 1136 wrote to memory of 5296	1136	firefox.exe	80
PID 1136 wrote to memory of 5296	1136	firefox.exe	80
PID 1136 wrote to memory of 1144	1136	firefox.exe	81
PID 1136 wrote to memory of 1144	1136	firefox.exe	81
PID 1136 wrote to memory of 1144	1136	firefox.exe	81
PID 1136 wrote to memory of 1144	1136	firefox.exe	81
PID 1136 wrote to memory of 4144	1136	firefox.exe	82
PID 1136 wrote to memory of 4144	1136	firefox.exe	82
PID 1136 wrote to memory of 4144	1136	firefox.exe	82
PID 1136 wrote to memory of 4144	1136	firefox.exe	82
PID 1136 wrote to memory of 5328	1136	firefox.exe	83
PID 1136 wrote to memory of 5328	1136	firefox.exe	83
PID 1136 wrote to memory of 5328	1136	firefox.exe	83
PID 1136 wrote to memory of 5376	1136	firefox.exe	84
PID 1136 wrote to memory of 5376	1136	firefox.exe	84
PID 1136 wrote to memory of 5376	1136	firefox.exe	84
PID 1136 wrote to memory of 5376	1136	firefox.exe	84
PID 1136 wrote to memory of 5444	1136	firefox.exe	85
PID 1136 wrote to memory of 5444	1136	firefox.exe	85
PID 1136 wrote to memory of 5444	1136	firefox.exe	85
PID 1136 wrote to memory of 5444	1136	firefox.exe	85
PID 1136 wrote to memory of 3488	1136	firefox.exe	86
PID 1136 wrote to memory of 3488	1136	firefox.exe	86
PID 1136 wrote to memory of 3488	1136	firefox.exe	86
PID 1136 wrote to memory of 3488	1136	firefox.exe	86
PID 1136 wrote to memory of 1580	1136	firefox.exe	87
PID 1136 wrote to memory of 1580	1136	firefox.exe	87
PID 1136 wrote to memory of 1580	1136	firefox.exe	87
PID 1136 wrote to memory of 1580	1136	firefox.exe	87
PID 1136 wrote to memory of 5008	1136	firefox.exe	88
PID 1136 wrote to memory of 5008	1136	firefox.exe	88
PID 1136 wrote to memory of 5008	1136	firefox.exe	88
PID 1136 wrote to memory of 5008	1136	firefox.exe	88
PID 1136 wrote to memory of 5864	1136	firefox.exe	89
PID 1136 wrote to memory of 5864	1136	firefox.exe	89
PID 1136 wrote to memory of 5864	1136	firefox.exe	89
PID 1136 wrote to memory of 5864	1136	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://development.trainme.com.au/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://development.trainme.com.au/
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27097 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {9bce8f0f-2e46-4f5a-a532-45f0f41fc173} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27133 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2468 -initialChannelId {2b8ca0f8-f867-4153-ade7-f2422787304d} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3712 -prefsLen 25213 -prefMapHandle 3716 -prefMapSize 270279 -jsInitHandle 3720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3728 -initialChannelId {b42f8273-0ef1-4f09-8162-24f7f2d4a85d} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27323 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {421c65af-9ed3-428a-82a4-845a8348dad1} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4496 -prefsLen 34822 -prefMapHandle 4500 -prefMapSize 270279 -jsInitHandle 4504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4512 -initialChannelId {ece8fa65-8d5e-4628-9ecd-59a2790019e3} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5020 -prefsLen 35010 -prefMapHandle 5024 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {75984971-cf64-4c14-a5b1-5f820f985c91} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5452 -prefsLen 32952 -prefMapHandle 5456 -prefMapSize 270279 -jsInitHandle 5460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5424 -initialChannelId {3843507d-bd99-4306-b827-35eceba8a00e} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {5b581555-8109-4b32-bc26-d97773a7ca4d} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 32952 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3076 -initialChannelId {fc224568-808c-450d-88b5-841b162f0af0} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3188 -prefsLen 36717 -prefMapHandle 1736 -prefMapSize 270279 -jsInitHandle 4668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {e1a7ad73-0164-4c6f-825e-f6774933b485} -parentPid 1136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\activity-stream.contile.json
Size 4KB
SHA256 0a929affba01fb1c2bdeba9b8fccd402e4b77392806c0425f9b73e697627bb65
MD5 338fec438a86dfd7e1ef79251e298c3c
SHA1 2a5094ef6cde02150f7385398722e212d983a5de
SHA512 06d33250728d9b39de12f28d85881c53fe039c0503bea24313aea777622d3334b2f1eebb2b022a3c3243f5994daa556d6676bfc72fc36916c40732f8652d0d62
SSDEEP 96:KlutwXQ9/6DEj1ddAev0/wd8DlZhHtI0+XBf9X6WEl:Klut+QdyirdAIGVl3HtI0+X3X6WEl
TLSH
T15CB10AD78874D4579B3263F43C1F378DF10B7186EAD68D4DBB998C06E3D414A80E9A84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 eb0bf7f33b389ab1c28c914486784aad2a6d810231a0ffc4a8be4a2f29c3ce2d
MD5 eb82dd95db61929a5e89a4e971aff510
SHA1 4776af53eec603bdb1ddf101cf476754be2e00fa
SHA512 9fee12c9368b50d148f67ac8e18e74181a020d74faa3114845b7254103ff4d7422a2c57245e8d6c39383141a08bd66720458a01593a80269896bd09d6c31aca0
SSDEEP 384:HHMO0iO024YiFuhw+5EL1pPsac4j0lpDII+rdLdk:nrZYiFuK+5EB9sac4ID8Lo
TLSH
T1C1527E7D6F1138AE1A67D1C4D8AA5204CE08E5BFEFD2D06606543C45CA84778B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 5KB
SHA256 1c0f9ed27b23adb3d85a71011542c625f7fcc612bba2a044b579f54b9646fb84
MD5 fae14d2181f60d150b2df606467870f6
SHA1 adc6d506c590c84fa126e5febd1ee4a9e35d279c
SHA512 517108e2750556059f8238c3a9391cd7ba9e542a312e56130193389a62a95852e0782212199c3456a71647a03e3e2ac52bbf687c246a8f4f87dfd60952115715
SSDEEP 48:eKKdBJ5Ugdw17/7+zLXKdBJ/6Bdw17/7yLpKdBJ/adw17/7AP:z2g7/7K2/97/7u2/N7/7Q
TLSH
T139B1A9024BFA09A5F0F3C7327631B7526673FE00534F865EC28666C94A3236461ADFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9c9ba27ac0fde731f063013347f0d20c299fcfe0d529a4bdfb48b28c6094ad9d
MD5 80e04e5b5e0c27586744dafa7a8f7fd7
SHA1 b3d84ab1bf3717a0d2cdd4f9dca17e00ed28a86b
SHA512 bdc798519aedea07c42779c69eec9845777019bb5d17c62eaf6afd4f757f5a06c0b65e24be7e4cc8ad2b4a0fd742acc78b0a0858d3c80c481a67ab3ae988123e
SSDEEP 192:07Ov5zboHy3hyjHvn1d66Joz0dzgCl6mc0d:1boS3hyj9d66JozQzgC1j
TLSH
T1EFE11E64EA28863BD419027BCCA61F414F35384A9C4E3F1936EC645C2D472EE3B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3c1afcb92428f901e8f1de997d38bfbf6dfddd30432977da4dfdd4a99bf538c3
MD5 819f98603f491817e7ebba4aa0d3dce0
SHA1 1bec0a814d30e2b8ae92a1639a2f150cd23549c6
SHA512 317a7ca8125211076f07150d9e86742a2765edfc27cc37fc003bc464f798e2e01d884f08ec81101836a117d48b3aa36d3a066ec66ad46b2058bfabeaad446a9b
SSDEEP 192:21d66Joz0dzgCl6mc0de7Ov5zboHtZ3hyjHv:Qd66JozQzgC1jBboNZ3hyj
TLSH
T167E11E64EA28867BD419027BCCB61F404F35394A984E3F1936EC645C2D472EE3B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 43015e327dc351f004b1e0f00024ad41de9c96ebf868b788fc7d2468bb64cbb8
MD5 1ef6c8a77e86a99a7340cedffedc4eb8
SHA1 ec52952d13c6f1acbde77b182310c1f0250a662e
SHA512 8387f432d6aa4853dfc3677db0171f0de5dc56275fb03be6ad25786ceb81942a450cb5096f9c93e7d2c3e17e27d97771a8e1451a80a11bbe723251bf0a9eb6d8
SSDEEP 96:iFN2FWFRF7F3/dd66Joz0dzgClKtmc0d/U17SdF95/7bkW6QXjrcE3hyUR6Jzx2S:21d66Joz0dzgCl6mc0dm7Ov5zboob3ha
TLSH
T100C1EB64FA294A3BD409023BCCB61F501F35394A988E3F1932EC245D2D562EE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5ba4cbde6a86bd4f4fd1eed5db3557e0209ae3f57cc2e483eda80bab9fef83c3
MD5 d150e000b3696d8742959ea9efb110f8
SHA1 2d7d44341dca8b87a67c7bf9e767d32636186510
SHA512 cbbf08d5843d019fd4be84c5421bf5331c947d206fc54183413a5a25323e67e2505aeb3d966f8c3600be22488c5a4b415d367b4a70dae1387850ee89a41571d1
TLSH
T1F021AC4C39B84D6A9DC7FBACB449028E634A8E0704D71C434D22DE8CCD86ED9326A87C
MD5 SHA1 SHA512 TLSH

Submit Download

27cf2bff-da5e-4084-af93-bf271efe671e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\27cf2bff-da5e-4084-af93-bf271efe671e
Size 16KB
SHA256 86b1b3313bdec3177b188918614ded9104f5acb8369eed1c9f86c3362183a4c8
MD5 056781f8ff5606dabd2b4c22b0e7c0cd
SHA1 bb4290912a885a18f33e1de22efcfef262632766
SHA512 7215eb75c8d6f1990e910a8836bb2fd0991ea4494c89ea9e11a41dc2716c95036855d63b29056760189a360563d3790440e591ab226af4c25fb579a7b6c0bb57
SSDEEP 192:oixEVXOSKYtb3ijjzqiOb7a84xevRhxnzJLUF124mkfXQXgDgPOb11z7BsDvObjU:vxGOSK2b3ijjU794x33PgvUjoMs7
TLSH
T11672C816186049BA9251E36898FCBFC3E6F528CF4C418FCA9BE4BD486DDE06D512784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bfe7f4f-c955-4655-86d0-4e0e57c739e1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\3bfe7f4f-c955-4655-86d0-4e0e57c739e1
Size 883B
SHA256 6f001e680ebee76112bb559ac92609f03a6bf5c9b73242dfa9777ee5b18aeea5
MD5 243f3f64d3675b2637705c57a872b186
SHA1 ebddcbeb9e2eae3b6b37be6bb033f04d09d8671d
SHA512 2c1b5d83ccea482552574746c9b01cb4f0daf9b362d553732b23012c37b36bb455a8da3bdf83ff3b0c0970feb29bb446b74f2ea2514df174f9a764af2c521544
TLSH
T1231100A19634F9F2DC3C928B85653F169BE4792380C645183EB19D080F7A12EE35A34B
MD5 SHA1 SHA512 TLSH

Submit Download

5803cfeb-2fe2-4241-8ade-bdb595da97d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\5803cfeb-2fe2-4241-8ade-bdb595da97d7
Size 235B
SHA256 61bd6c462b80b284f10335a8eaf5395fcbf9bea7891119e86bb2c60c9add51f1
MD5 364204cab0e9a3e5678f7ed1cef6af04
SHA1 4b24ebf840f061310b491a61668c4ce5f556abc6
SHA512 3a03acb33b228896542bb9aebcfb02115ab82ed008be2f6c3b6662c2624a0cbad5498cfcce8f6a5f4b90841ff7aebd6489f895df311e822a1ea1d7b732b4cb41
TLSH
T194D097C0348C673C08200F07B0E06AD330484C3314B89820DA6005B8CAFD9C40262817
MD5 SHA1 SHA512 TLSH

Submit Download

886a8688-83c4-4da6-a5a6-430812120e00

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\886a8688-83c4-4da6-a5a6-430812120e00
Size 2KB
SHA256 40a89e52c869d7094a9e64e22d226f0a424d1717bc1b2806048f0745c5c13f4b
MD5 92b261890bf04deeeeaa0ecf1a8b13dc
SHA1 2e5e76bf47dc9a72a37b970927cfd98df603350f
SHA512 ad0fa457c2a67b67a4a69a7676fe9ceadb1c9d59c31beb99256ada60eb40c0099b73c75cc5a0c54452bf16fa844d7d39807d94125439153f7deace7a248a988a
TLSH
T16141336C39756C7AACDAE25D9441338F57708A1340C61C932E51DE0C8D856EE336F52B
MD5 SHA1 SHA512 TLSH

Submit Download

a53a0aa9-65ac-48e2-a088-15210557348f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\a53a0aa9-65ac-48e2-a088-15210557348f
Size 886B
SHA256 2adfb3280a9c686059435e658b609f38250d86486f5bfa26094fb74568d5369f
MD5 a71a5bc27a5a65dd18de67c36565ae02
SHA1 397bf9df26ac31cd04fc0c2b49c8b4bd60669ea6
SHA512 6db69324b2ffb58958b549c503459508451669b2961f5db5692e6ba957a64568c0d4d52329766e5721f45d961b892a9d23404c0da3fa098a6fb79f8566f9b9df
TLSH
T1FA1127529964BCF39C7CD28785F17B529BE07513C0C509187EA09E0C0F6A16FA35B317
MD5 SHA1 SHA512 TLSH

Submit Download

ff77d16e-0e9f-4c37-bbec-218ef533ab32

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\ff77d16e-0e9f-4c37-bbec-218ef533ab32
Size 235B
SHA256 83a2d97d4bf36f8c6ce4457c0e6cff0971e13457b8697f9a7a19ab84ed859dd4
MD5 c8d2d61b91a7b7c1f1f3e062e8035eae
SHA1 38916c9b76ab1730a91fd85c749c02e4b1c8f7b5
SHA512 36ab8857cfab7bbc34c0af565eb318edcea84cb808d55733f1ea9fe7bff1498914c106a43d9a8b848375e51d5febdb5283898016604839d9611b50d123ef36f5
TLSH
T164D0978014C8632E48110F06F0E06AC23144CC331C706820D6600834CEFD9CA8126C27
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\extensions.json
Size 16KB
SHA256 ee9225c3762d9e533507f46d15b04b60d18893f07cd94098d89445d6cc8b3048
MD5 29a0db1834296ff3531ce1f7b1266025
SHA1 6b5d6b267c01643c74ffc2fd71c1bcfc337a3f91
SHA512 fcec20307153c6979ff377cf39b41c27b092528ef6fe2dcdbd817b38f52f73a80ba38bb5d212f0771f2b2c18453ac382c744e2cc0e187c29a2900339eca85bc3
SSDEEP 384:CkI4vDUmldvG8dhWa94zY96oRL4H5L4P1L4HtQL4HVL4Hq54hU:1I47RfrXX4Y6y4R494NS414u4+
TLSH
T1C272431545048EB8298FA79BAA367E01C37D473B60855C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 11KB
SHA256 b964543db31cff01b325b1dd13037486d3b5c90b17549a9edab9dfb959809590
MD5 4f0f253fcfd9d13a89b5a7535f0c11cd
SHA1 fa29adbb599124d032206f153636d0a1e0205e8c
SHA512 1c341e26acf21b02ba24b1f568cb0df19a20ef5d96963652cdb83c06213b4592b83cc0b48c87fdf7012fcbf40d0d4fc0ce7b0b777f7c218526f916995e2033e4
SSDEEP 192:UzCRvf/hVmSS/LR4aYzMzzmBw88SrrerIXAD:hmREogwCf/S
TLSH
T12942DF3850408B7F61B33A7DEC294AB059AA413BB6FFBCD645F89492045CF2441F6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 8KB
SHA256 76212de5e2726fd27a6584202cf8ea3c5d4e6205ed79e5af762f2df78c7566cc
MD5 2c187f19932009ec41f3dca7891176be
SHA1 52d5842453f80742c7ff6a9a3a950d1b629f3709
SHA512 8f23e03fb16521738686910759ed73c672d1c05945fbda6a1f79aef23e871838647d32ee37387413b67d6f4a0accc2f344bab8e7d8eded1bab8a638e2c26ad13
SSDEEP 96:xHiZTUAPqGqcUf/hVObzSrSSlrdv9jPnHWRcA+riDYzM9Bw88DAG8L4cnHVqZ:UzCRvf/hVVSSUR4aYzM9Bw88EdM
TLSH
T128020F385104CB7FB5B63B6CAC288A716AB2013BB6FF68D650B954C5054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 d9471aa1f19d346ce433ec229040e8afe337a84ae404e25b751a149af36e7fc2
MD5 a4956dcc7bcdc0c23c64e3f689449101
SHA1 93f1c2e8ec7ffbbb0e033f0ba981dfbc76b7954a
SHA512 7801f9d22e7a9a236fba6c5c97f777ca40dd993cad9226308b045eba404ad014f18b7aa897c1d35feaa6d6f6e84a97e500dbdbb036fde99968d27b335a380d87
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zSuHaSSlrdv9jDnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNgL6SStCaYzMgBw88qL
TLSH
T1D2E11E3894088F7F74B6776CAC6888316AB2413BB7BF68C650B95484054CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 fd78c29bcb66f701bcd1858c6f868604b4cb729a2ae9506d821db86692ee8030
MD5 2475ec48aff38e5d9506da31da1f28fe
SHA1 5554f7c011b98465243eca4e06df9e9a773fcf63
SHA512 492ed9b714669df0694310dd006c2111d703abe1c146421d108deb8abf491d55b7331d0f06317f26408c955e63f8f55d45b50e1dc9a7111336193958e6f4fed5
SSDEEP 96:xHiUTUAPqGqcUfChV1zSrSSlrdv9jPnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfChVGSSlCaYzMgBw88qL
TLSH
T1A5E12F3894088B7F75B67B6CAC6888316AB2413BB7BF68C650B95484054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 528b50cf5a711c1e188a86ac69b022913a07f218e130eba4ad0f86e137a214a8
MD5 092808089990de3b132fc55793d4079f
SHA1 83ce8ad6fed7018afa3baf92841dfc3c7cc61c32
SHA512 1f6b5a6e711dd22eb9932b387824d8b2bc9b011bcf0d008d126c20775b872429a7b4ed09bb5c4f0bc833dad0cafe4bdc77adbccef692551f7fccbd8708e01280
TLSH
T10021F84B8C3A2DA3FB26602ED0456FF5D26B302185B4DCE0E6DC07064A0CA0A768D28D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 131b411d5d95654d43a94bc81f8c563d1916e8d922bfcc369c01f6f8be326626
MD5 9d70ae1a17030a2c61db43da33096e5f
SHA1 1f3d8beeb47998ad4024af78f4f22cb61f836520
SHA512 5774f3db5cffcea2c3e25ad7f2b217650a6623a3ea64c87e95da10c1e401622043de1f2c3cd17276375011431310a80455eb4c5a6b5da0a9bceece634994039d
TLSH
T17621F84B883A2DA3FB16602ED0095FF5D26B3021C5B4DCE0E6DC07064A0CA0A768D28D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 12c3d816058d42015a4b7e4663ceef39bf2c9a379c87e2f4dbc96415a89154d6
MD5 50e3a5a23090b27be76ef89268c04475
SHA1 aa8a051b4e37286a67515e6954304a5cf5aeb529
SHA512 6d6ce9499a6cf427e85d0b55da2c065f9e4aa629ad55af6562e46be0406c835561c1fccc0b3a4f8376f44932c169db0c6ea6eefe3d0ed5f2b45de437a901572a
SSDEEP 24576:vCWk+tIYI0LMrT63BDcYrVQpM9dQ49tQ8lQyQH:vjv7LG6pcYrVEM9dn9tQ+QyQ
TLSH
T155F52AF820D2B357F3414033A64593EB21AFD00CA467CE044BA956E995B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads