hxxp://cdn[.]polyfill[.]io

Analysis

max time kernel
148s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/05/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cdn.polyfill.io
Sample260511-rlcm8ab161

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	firefox.exe
Token: SeDebugPrivilege	3416	firefox.exe
Token: SeDebugPrivilege	3416	firefox.exe
Token: SeDebugPrivilege	3416	firefox.exe
Token: SeDebugPrivilege	3416	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe
3416	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3416	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3416	4568	firefox.exe	82
PID 4568 wrote to memory of 3416	4568	firefox.exe	82
PID 3416 wrote to memory of 4812	3416	firefox.exe	83
PID 3416 wrote to memory of 4812	3416	firefox.exe	83
PID 3416 wrote to memory of 4812	3416	firefox.exe	83
PID 3416 wrote to memory of 4884	3416	firefox.exe	84
PID 3416 wrote to memory of 4884	3416	firefox.exe	84
PID 3416 wrote to memory of 4884	3416	firefox.exe	84
PID 3416 wrote to memory of 4884	3416	firefox.exe	84
PID 3416 wrote to memory of 5904	3416	firefox.exe	85
PID 3416 wrote to memory of 5904	3416	firefox.exe	85
PID 3416 wrote to memory of 5904	3416	firefox.exe	85
PID 3416 wrote to memory of 5904	3416	firefox.exe	85
PID 3416 wrote to memory of 5144	3416	firefox.exe	86
PID 3416 wrote to memory of 5144	3416	firefox.exe	86
PID 3416 wrote to memory of 5144	3416	firefox.exe	86
PID 3416 wrote to memory of 3120	3416	firefox.exe	88
PID 3416 wrote to memory of 3120	3416	firefox.exe	88
PID 3416 wrote to memory of 3120	3416	firefox.exe	88
PID 3416 wrote to memory of 3120	3416	firefox.exe	88
PID 3416 wrote to memory of 5348	3416	firefox.exe	89
PID 3416 wrote to memory of 5348	3416	firefox.exe	89
PID 3416 wrote to memory of 5348	3416	firefox.exe	89
PID 3416 wrote to memory of 5348	3416	firefox.exe	89
PID 3416 wrote to memory of 2756	3416	firefox.exe	90
PID 3416 wrote to memory of 2756	3416	firefox.exe	90
PID 3416 wrote to memory of 2756	3416	firefox.exe	90
PID 3416 wrote to memory of 2756	3416	firefox.exe	90
PID 3416 wrote to memory of 4268	3416	firefox.exe	91
PID 3416 wrote to memory of 4268	3416	firefox.exe	91
PID 3416 wrote to memory of 4268	3416	firefox.exe	91
PID 3416 wrote to memory of 4268	3416	firefox.exe	91
PID 3416 wrote to memory of 3392	3416	firefox.exe	92
PID 3416 wrote to memory of 3392	3416	firefox.exe	92
PID 3416 wrote to memory of 3392	3416	firefox.exe	92
PID 3416 wrote to memory of 3392	3416	firefox.exe	92
PID 3416 wrote to memory of 1616	3416	firefox.exe	93
PID 3416 wrote to memory of 1616	3416	firefox.exe	93
PID 3416 wrote to memory of 1616	3416	firefox.exe	93
PID 3416 wrote to memory of 1616	3416	firefox.exe	93
PID 3416 wrote to memory of 3584	3416	firefox.exe	94
PID 3416 wrote to memory of 3584	3416	firefox.exe	94
PID 3416 wrote to memory of 3584	3416	firefox.exe	94
PID 3416 wrote to memory of 3584	3416	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://cdn.polyfill.io"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://cdn.polyfill.io
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {a41fdd5d-1c29-43a8-b67b-20e71d20eb10} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27136 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {6809587b-ca06-4f85-8029-34b88837f734} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3920 -prefsLen 25164 -prefMapHandle 3924 -prefMapSize 270279 -jsInitHandle 3928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3936 -initialChannelId {50c3ebab-cf8e-4538-8aef-66b98ed580c8} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27277 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {a17a69fc-2c19-4f68-8204-32dedc2c160f} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3164 -prefsLen 34776 -prefMapHandle 3224 -prefMapSize 270279 -jsInitHandle 3228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3412 -initialChannelId {7c76d906-3c55-4067-8477-9f8b40083f20} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5092 -prefsLen 35013 -prefMapHandle 5096 -prefMapSize 270279 -ipcHandle 5104 -initialChannelId {e5dddfc2-8f9c-4a03-a0c0-249842874211} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32900 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {3d1677bc-6e1a-4514-bffa-3b8ddd2a2e6c} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32900 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {6314fc6e-57c8-4361-8ef2-de62ed94ced9} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856 -prefsLen 32952 -prefMapHandle 5860 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5872 -initialChannelId {4e5a7aad-7722-4f4b-85f5-e7f5b2a5884d} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6212 -prefsLen 32952 -prefMapHandle 6248 -prefMapSize 270279 -jsInitHandle 6344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6364 -initialChannelId {57ddd0f9-a8b2-48ac-b6e5-8f549533aed9} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6700 -prefsLen 35065 -prefMapHandle 6704 -prefMapSize 270279 -ipcHandle 6676 -initialChannelId {bfdfdf4f-28fd-4302-8df8-3f2d2a4821bb} -parentPid 3416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gr767auk.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 daed448044e43a75312d0442d684cdfac4156c0f6f27612d047e2de0fd60d361
MD5 90a0b5007c5a697ac9c442e339b3b95a
SHA1 343c2189a83f5c4136a23e5d2ba8532a37f95305
SHA512 7ffc0ae52867db8665dbe09bded1989643f81f8ca06ebe10dc3b3e41b49e3d6b05e7e0f19e83c97b4dcea0cf165e4d22d1ee5e973683df3a9b6856b0b9fa9960
SSDEEP 384:HHMO0iO024Yvo6J+Sl1xDnZBPsac4j0lpDII+idtdM:nrZYvo0+Sl7zZlsac4ID8LF
TLSH
T19E528DBD5F1138E91A53D4D4E5BE9214CD04A6BBEFE290661A143C04CE44BB9F4E64CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 bb17527e9669cbf0eb9349985bc8e7d1b8cfc352d30c3455adbf7a09680c5f66
MD5 d754dafa38c9d6b2d1debfba3b5ce301
SHA1 f5e28ba8138f15d4d58367f7806292257b2cd6f9
SHA512 4f28bb0f39e2c8e26ace37fa2775638c4084ce92d8aa31e03d88bb53ebfb08ae122b5bc103e9e342b459fcef42955f68883d2c44ae7031d650d97e0fc5dbd8ff
SSDEEP 96:cJJg4SdF95/7bkW6BrcEUl+yUR6spWZoFs2FvFeFnFL/dd66Joz1zgClKtmc0d/Z:AJg4Ov5zboBbUl+yjs4D1d66Joz1zgC1
TLSH
T10FC1CA64E738563BC445023BCCA20F400E76759AD89E7F2931EC645D2C5A2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3d1a2ab01d71e9e6cd071d8dc8c0d57494e58fe2ca1bec21c24bd825a6e2ba72
MD5 4e463c327fe7a04a5a8458eb83d90631
SHA1 1237e6e16430485ebb99f7aa8592b1ad1b541eb8
SHA512 016ba792ff0531b54ca976b16cd3685765ba1185d5d511c6784dca2e9ece4c936164d5504766749d15cc2f9f222434ef80bc8400fd00609e5c41ec783bfa414b
SSDEEP 192:F1d66Joz1zgCl6mc0dZJg4Ov5zboA4ZUl+yjs1yL:Dd66Joz1zgC1jfCDbo5ZUl+yjsw
TLSH
T11DE1F0A4EB28563BC405127BDCA21F440F39359AD84E3F2935AD645C2C5B2DD3B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9fbbc7a27672d620fa271ac4c758192b51ec19c99a11b47c51865cdf41b907b6
MD5 6822b8d760fc6508953430a417e55339
SHA1 a587f36ffefe3a4db30ae5a34c1352e4bdaa7514
SHA512 35c72e14de87a8c2d93e512e21812f106a7df1f83554d5866f0c90d1c608c8abd2974aaadc7874b25583e5abe162512960b1c2740dfbdd677aab3f902ea66f1a
TLSH
T10121AF4C3AF84D6AAEDBE26CB45001CE57254E0704C71D530D13DE8DCDB59D9326A83D
MD5 SHA1 SHA512 TLSH

Submit Download

1caca58f-f738-4b24-a1ea-caffa8415219

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\1caca58f-f738-4b24-a1ea-caffa8415219
Size 235B
SHA256 1d365575814ce3b62d8f5462e4c81b265cfde28d8bf0af14c094ad5a8b4362d0
MD5 f83d5a187919664f84a6c9ce204e9285
SHA1 dd0cf2aaef08322f50212b9c6b62ac264ea22562
SHA512 a49ee765edd8b393caf85f6dd12ba8d0841ad60a57edd3cecee6e4a01ad78416f0f9439277eb46ec24c207251f59a20c79287c7e4d045de22b8702220e3eb2b4
TLSH
T102D097822488B36C08000F06F0E02CD730894C3320A0A820B562027889BBEC90351E0B
MD5 SHA1 SHA512 TLSH

Submit Download

35944ff3-a62f-47c1-9d94-728b98bf2fff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\35944ff3-a62f-47c1-9d94-728b98bf2fff
Size 235B
SHA256 abae4a63d0bc1bbdccb9ea77cb6b50ca4a0ec3709de77e8e12080be48775969b
MD5 dc29ceeb657001f3ce9e16ffef2284d9
SHA1 fda06d581ff37796170c60852f718d27b5cb21fa
SHA512 1520f84e9d77522d3b348a3ab3d2af3c1864c64f2f98152a627e29fd45776e9733a43ec7a3287550e24ede2327d8ea8f19cb06e58d34812ed848216736928547
TLSH
T1A3D097C92898776D0C044F13F0A02AC671588C3314B86820E6908E3499FD9C4A261816
MD5 SHA1 SHA512 TLSH

Submit Download

7f046cd8-beec-4006-94cc-d9911c75f730

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\7f046cd8-beec-4006-94cc-d9911c75f730
Size 2KB
SHA256 262d9f9d7d3b0f72d088d790ca5da4f6d1fffb3f65240a0148817f22dd28eda4
MD5 9cd69dc25eaea1568625c4146d5a507d
SHA1 f8045162c6f784ea6abde6f689b7c2008481aa30
SHA512 0987593186d36b019b58586c138cdfef6937f0eda39b2e3e6a180d53b7edb10c993fe3ad986ec3f23649970f51d9cb8b5fa99c1fe095fbe4fc3a47b6f10fdc18
TLSH
T13C41549835745CBB8CDAF18DD482334E57F08B0B00CA2C536E51CE4C8D966ED73AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

9ac8d9bf-f66f-45cd-adea-c72e97856e0b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\9ac8d9bf-f66f-45cd-adea-c72e97856e0b
Size 886B
SHA256 6b1fb52cc005c339e1fdb5d073e80636983131e65ca04534260536159560316a
MD5 9269770c943ff52405191dad410a1350
SHA1 ec4af7e90224b1a2f90d23f95e5fd7753212809e
SHA512 cb86ca59e2424256d8a399d8f17cadb0e58dbe4894b707095c26457d002ed6f6ae4daa84e37271be32eea2c0481f1140d3afe80594f02e30ea7f6822bba9ff0c
TLSH
T1641100C0CA7479F28CB8A1C784A13B424FE47123C0CA2818BEB45A184CFF42E5396307
MD5 SHA1 SHA512 TLSH

Submit Download

aed65585-9745-497d-9216-09b17b667f0e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\aed65585-9745-497d-9216-09b17b667f0e
Size 2KB
SHA256 4a934b5822fa133c08f6cce8ce687495f0e7bac36fcbd5e33c70bebc7ec05587
MD5 cf9096f0abfeda3547a243ee94c48373
SHA1 575b448cc9bb4d7c9750b31410b0a36c789241be
SHA512 fbfab07b172c1dc9d1090cb688024292a5a6e1eda53ef2d8edd7b3e3e5ce5a87f5725cd957955c7d3c7f17f94ca4931c4baac57237837631dc42058dea15a896
TLSH
T1D55185658160D87EC979A30ADC213B828BF2140A409F291DAFE8AE0E157FC5E9359645
MD5 SHA1 SHA512 TLSH

Submit Download

f0bc6fad-4a32-45ae-97e8-47e71c9a10c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\datareporting\glean\pending_pings\f0bc6fad-4a32-45ae-97e8-47e71c9a10c5
Size 883B
SHA256 fd824b7dde348baadf3c67a0608bb1aca933130aa6fde3d778116602229c9de4
MD5 1b29771e8dec4f08c91e9afd62198149
SHA1 7e3865d2da51d42aa169650488f796d4936ca1a1
SHA512 17d865b696e442bd7f29d6660842ed4e685bce4188bdf9b7658b28afe40c1c2c21bf5eb0a9fba9d5ed8aa945201ed386c9fcb3187b745717e25389c79ea8fbfd
TLSH
T1A3110490D73075A3CC68918BC8513B465FE8B423C0CA64243EB15D180CBE62E93A674B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\extensions.json
Size 16KB
SHA256 3cb99f5a7c4d751720d334cfa5b720d7e44b8343ce4305ef03c7be6e5d3b727e
MD5 bea41fba01410ae3210b09ad6e9d3072
SHA1 1d23fe575b3212754bd08cec84f5aeb5ce9621ad
SHA512 4e9903a7f7f557cf9c33c0dd130775bc34f1af64c4137079d04ba07766190357721676c1c124643d4ecf6e2493fd695f81397eac9991f79b7b1eaddd2edf81c3
SSDEEP 384:PkI4v+Umldvk8dhWD94zK96odL4HDL4PQL4HYL4HuL4HoAf4h6:8I4GRftXu4C624P464a404p4I
TLSH
T1B372421545048EB8298EA79BAA367E01C37D433B60855C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\prefs-1.js
Size 7KB
SHA256 218fd92e7f95696ce870f406b5b5d8c4fde579ba361acdaf14fb3715a47a7e94
MD5 9f523a609a81f3e3835c4e31df9c00d5
SHA1 88f004612a0f940caa20ef478af002f5d47c2379
SHA512 25f83da77aee5db972ede7c08f3b763a0a1361e90659f9b4a46a41608bbf19242c173973443f06f9d8f7c39911c1290af24a7bf3a0d91c6d91007c95fbb24057
SSDEEP 96:xHWNTUcqGqQf4tizObzS5PSSladv9jMnNARWRUozU6fs9eBw88Z08L4cnfFRq9:M6RQf4tizrPSSRA8RxxfVBw88ZTq9
TLSH
T1A3F100389004CB7F75B2767CAC644D705AB2013BB6BF68D710BA9485495CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\prefs.js
Size 6KB
SHA256 64bc1aa892d87cd34615dd45beb0e3a0772f323472d4a9f1f1679976b981951e
MD5 ced1cf5bdf471e0b8033fe16aa0159b5
SHA1 9a78623dff3ccc8d87681282c853d4bb6b08a181
SHA512 bf6424ad7f92b824094d3f17a21d12e114ec69648e4efbfd33f8d3a187a23e9c9efa69eae4201443186a0a4e75c29b05e16b27be1093c24a375c405184175bb1
SSDEEP 96:xHWUTUcqGqQfvKjnnju1zS+SSladv9jA+nNARHszU6fyBw88P8L4cnfFRq9:MvRQfvU6nSS0A9cxfyBw88Qq9
TLSH
T142E1207895188B7F64B6766CAC688C315AB2413BB7BF68D710B544C4054CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\prefs.js
Size 6KB
SHA256 2f6755a9ff257edc482b03c7b8b10797900071dd223c58ab18a89ffb66fe1af2
MD5 95a86183ed5d968f388b9461f84f2dea
SHA1 095e22cb31b97e6c823fc07012ea954b54ffbf28
SHA512 00f6d9dd54464407a1220f3be6cca2cda512702744dce4a778976f0fdce50fe66f84000607a7b7934e88d7cd183cb43b0db647f2dbd119f0f3857b2a1dd5f809
SSDEEP 96:xHWUTUcqGqQfvtiz1zS5PSSladv9jA+nNARHszU6fyBw88P8L4cnfFRq9:MvRQfvtizIPSS0A9cxfyBw88Qq9
TLSH
T194E1307891188F7F65B6766CAC688C316AB2013BB7BF68D710B644C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 a2cf649aebc34404a389aadb9b2bdfb71c4c5a1ec97b514b85d7712e72cf3916
MD5 2b8a0dd6b746f89d445bf6d5ded9c484
SHA1 b2e9c7f34df8e3d05a33013e9cdb8a4d699874cb
SHA512 f8c5e0d6e8e2f6f33fcd32f5d8c3d76fb902269abc74e8f8d2b97264eace59987f0b05a86e389d935095f6dbdb23d79d664dd35f092a70ab7ba27fd630ceef28
TLSH
T15A21F913A83A3DF5BB519197D0852FEAC75C352344B90CE0914E9E5122DE049334730D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gr767auk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.6MB
SHA256 742007c23787efbfa66ec930b3004f9fa7998ea7813d6da948e09739198d4428
MD5 fb6d36dcc10e1ce05ee6e64fb913befb
SHA1 60c9440cc1bbf4b61998181f36a809c3742b7074
SHA512 81d438cc8813b60aaa2e5ccb39cc0710c6fcc2e4b2df592ba73ae7b4cb9671b690d1607673ac7e7b214ac9124be3426583332a16fa020f0db23d3320d1e5eb2a
SSDEEP 24576:tE+OO/IgzrJ4r86lZYDyrRLvcMItQTdOrl/6wrbItDB4:tVbfJZ6kDyrRjcMItsdOJSww34
TLSH
T11B062BF860D2A247F3424073B64593EB21EFD00C5027DE0847A956E9A478CEF9E56B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads