hxxp://cdn[.]polyfill[.]io

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cdn.polyfill.io
Sample260511-rlcm8ab161

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5300	firefox.exe
Token: SeDebugPrivilege	5300	firefox.exe
Token: 33	5188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5188	AUDIODG.EXE
Token: SeDebugPrivilege	5300	firefox.exe
Token: SeDebugPrivilege	5300	firefox.exe
Token: SeDebugPrivilege	5300	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe
5300	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5300	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 5300	3052	firefox.exe	78
PID 3052 wrote to memory of 5300	3052	firefox.exe	78
PID 5300 wrote to memory of 1444	5300	firefox.exe	79
PID 5300 wrote to memory of 1444	5300	firefox.exe	79
PID 5300 wrote to memory of 1444	5300	firefox.exe	79
PID 5300 wrote to memory of 4232	5300	firefox.exe	80
PID 5300 wrote to memory of 4232	5300	firefox.exe	80
PID 5300 wrote to memory of 4232	5300	firefox.exe	80
PID 5300 wrote to memory of 4232	5300	firefox.exe	80
PID 5300 wrote to memory of 3316	5300	firefox.exe	81
PID 5300 wrote to memory of 3316	5300	firefox.exe	81
PID 5300 wrote to memory of 3316	5300	firefox.exe	81
PID 5300 wrote to memory of 3316	5300	firefox.exe	81
PID 5300 wrote to memory of 4196	5300	firefox.exe	82
PID 5300 wrote to memory of 4196	5300	firefox.exe	82
PID 5300 wrote to memory of 4196	5300	firefox.exe	82
PID 5300 wrote to memory of 2460	5300	firefox.exe	83
PID 5300 wrote to memory of 2460	5300	firefox.exe	83
PID 5300 wrote to memory of 2460	5300	firefox.exe	83
PID 5300 wrote to memory of 2460	5300	firefox.exe	83
PID 5300 wrote to memory of 1056	5300	firefox.exe	84
PID 5300 wrote to memory of 1056	5300	firefox.exe	84
PID 5300 wrote to memory of 1056	5300	firefox.exe	84
PID 5300 wrote to memory of 1056	5300	firefox.exe	84
PID 5300 wrote to memory of 980	5300	firefox.exe	85
PID 5300 wrote to memory of 980	5300	firefox.exe	85
PID 5300 wrote to memory of 980	5300	firefox.exe	85
PID 5300 wrote to memory of 980	5300	firefox.exe	85
PID 5300 wrote to memory of 5360	5300	firefox.exe	86
PID 5300 wrote to memory of 5360	5300	firefox.exe	86
PID 5300 wrote to memory of 5360	5300	firefox.exe	86
PID 5300 wrote to memory of 5360	5300	firefox.exe	86
PID 5300 wrote to memory of 5412	5300	firefox.exe	87
PID 5300 wrote to memory of 5412	5300	firefox.exe	87
PID 5300 wrote to memory of 5412	5300	firefox.exe	87
PID 5300 wrote to memory of 5412	5300	firefox.exe	87
PID 5300 wrote to memory of 5556	5300	firefox.exe	88
PID 5300 wrote to memory of 5556	5300	firefox.exe	88
PID 5300 wrote to memory of 5556	5300	firefox.exe	88
PID 5300 wrote to memory of 5556	5300	firefox.exe	88
PID 5300 wrote to memory of 5104	5300	firefox.exe	90
PID 5300 wrote to memory of 5104	5300	firefox.exe	90
PID 5300 wrote to memory of 5104	5300	firefox.exe	90
PID 5300 wrote to memory of 5104	5300	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://cdn.polyfill.io"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://cdn.polyfill.io
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {409179cf-6798-4481-b7ee-0894081261e7} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {2f984720-e5b6-4412-a2aa-52610a9120d5} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 25213 -prefMapHandle 3792 -prefMapSize 270279 -jsInitHandle 3796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {a0cb7871-e80a-439c-b997-0139d4e6ea7e} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27323 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {1fa35d38-cc7b-49e1-b94a-e5e37ef53d58} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4412 -prefsLen 34822 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 4420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4428 -initialChannelId {bf839503-acf5-4428-bacd-b9b2730c7061} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35010 -prefMapHandle 5060 -prefMapSize 270279 -ipcHandle 5068 -initialChannelId {bc80acbe-27c2-40de-95a9-8d9eee958e5d} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {400c3bfe-528b-4dcf-8027-1f96b2835a5f} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 32952 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {ba9395bc-3d5a-4df5-a60e-5512725b78d1} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5872 -prefsLen 32952 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 5880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5888 -initialChannelId {fb873abc-34ef-4c88-8411-34664f24f041} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3392 -prefsLen 32952 -prefMapHandle 3404 -prefMapSize 270279 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {a8c69366-472a-48d3-a6df-ee3810a0c78c} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 3008 -prefsLen 35062 -prefMapHandle 6232 -prefMapSize 270279 -ipcHandle 6308 -initialChannelId {51b1c914-c3a7-4e51-93d4-ccfa0cce4244} -parentPid 5300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:5104

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tjvljcf.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 b3ad27bb850d1026124278d6327297108c51f60817cad0c2b2d490189115f52d
MD5 a8c0c9a17ffac7c4a7abd856385ddfe0
SHA1 173d4c4c6d5ee1ed52d3d6205c75cff31a2e5d1a
SHA512 a5eb4bae87aa69ca2feea24f9bf87b7a21fd0ad0e8527a78d7200d0e20464cd3a357ce0494c07f4a19731fa622cdd6dba4a8f20e5183ad44d2e749205466fdcc
SSDEEP 384:HHMO0iO024YGo6J+Sl1xDnZBPsac4j0lpDII+idtdES:nrZYGo0+Sl7zZlsac4ID8Ly
TLSH
T17A528DBD9F1138E91A13D4D4E5BE92158D04A6BBEFE290661A143C04CA44BB9F4E64CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.bin
Size 6KB
SHA256 66946b6bb76603f2633d57439af11ba7ac6b23cc7771caa065ed958bd73d18aa
MD5 81a9dbe42b664618bf7260570e65efa8
SHA1 ad381f67f902295482c7cbbf6b704608ca00fcf0
SHA512 438e15cacba2a65f1fe62ebcc06b51b17bad70b835e52d4c5247707a1d368c7bb515d789684b6b66fa4a79db1e24bc8f58c021cb988116ffc73734c817800ab5
SSDEEP 192:POv5zboNZDAyjExd1d66Joz0dzgCl6mSSdz:gboNZDAyjkd66JozQzgC1bd
TLSH
T17AD1ED69F629563FC408023BDCA61F400F35399A988E3F1932AC645D2D572DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8dc92a24517299b51cbc3cd2bde56f21f34c331e2b66131fc6d46ae9c0c68bba
MD5 9d07c28a5c065fbd2a613cfdabdf7828
SHA1 41b9e5166a2b9180cebdea1a2c8bf7c9e6001660
SHA512 0173026f5d0ed2d87f22dfe00e9c3ebf5a9c9bf053ef122d6f615094687df98d096428861fa36c30eb8cbc1640c1523dc07b74710c20900dfa02cf00cadec564
SSDEEP 192:QOv5zboYZDAyjExd1d66Joz0dzgCl6mSSdz:bboYZDAyjkd66JozQzgC1bd
TLSH
T189D1DC69F628563FC408023BDCA61F400F35399A988E3F1932AC645D2D572DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e63e458eaf8973a99c8437ce5b659d5e656a1ed685a33e6b2a49c311d11caf6e
MD5 4930993fccd05db56bdc159766f0c813
SHA1 2698f9824d6ce6b872091bc50421865a34e39866
SHA512 78280b1dce58633ac4697eaad70ee74aef4c867e4ecbd003accf7520307deb4bb90d8f12f1c9126ca9b2984c63ba05ffd746087d3bfe09d4bff7b0820f69c2e9
SSDEEP 192:DOv5zboHNZDAyjw8b1d66Joz0dzgCl6mSSd:MbotZDAyjnd66JozQzgC1b
TLSH
T1A9E11169EA28863FC408027BDCA51F440F39399A9C4E3F1935AD605C2D572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 94625e7ed74b772f89c75fa8d904c89fdd899aee64fda0b2f0109771e3d9e682
MD5 4195637c5319f3204b8607d44d0c6dc6
SHA1 aa800da027a42bc48f4c7f7fea1745783895a178
SHA512 a5ecf53a6206b384cea83f04f8a91dc20db0b78600084eb7fa7a459e412d1fa13e0b462054a9d3878a7df78763bdea54fb6ad87f3e5024d218c21a85cf8dc966
TLSH
T1F321674C39B84DAA9AC7E6ACB46101CE53958E0744C71C830D63DF8CCDF5AE9326A87C
MD5 SHA1 SHA512 TLSH

Submit Download

065cae2a-add3-4812-9eb0-7f1db7104997

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\065cae2a-add3-4812-9eb0-7f1db7104997
Size 235B
SHA256 a297b344e56cd2e94df30950333649f49b87b91908fa462203c5438726b298ff
MD5 307ab718ed9a08d1e10393d9e0e66189
SHA1 1e681354989ada8aca6db5fded5c6879ac3f9b69
SHA512 acb0e8aa19f7da68b88cb69c1f11936eb60676e93f30a935fa3fd5b956c2137ccdd2088fdf0a7da8c1d445f62489a14976a07077f2c7fba5691201dbb566ae08
TLSH
T127D097C026D8A79E4C240F16F0E068CA30848C3320A99818F9A20674DAFFDE84251C16
MD5 SHA1 SHA512 TLSH

Submit Download

1a594dfd-fda2-4604-82a9-2dfec3750355

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\1a594dfd-fda2-4604-82a9-2dfec3750355
Size 2KB
SHA256 df77bb1d09348164841c7e2a5a84e2dfdd2c40ef3406718099118e1b2551f127
MD5 129c6649e3626823d41dc4de4b81c4f1
SHA1 e53d250ba0c65188478a8fe476ab530a8f7e5e2f
SHA512 c6cea220f6e6fc49614fcea666706430b4d83db5f506da6743fcf2b35f6dfba821bd20f696b958d48578f36dfaa05067b08f16390ade1b325b8f231d433449ac
TLSH
T17441116C39B85CB79CDBF15D9482334D97604A5750863C832E61DE0CCC866AE336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

1fdd73f2-a694-44bf-ba9d-473230960014

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\1fdd73f2-a694-44bf-ba9d-473230960014
Size 17KB
SHA256 82943491ae3977eef4b682e2cb3b777cf69cf8380bb278e6e163258c0d01660c
MD5 70d44e7cd92e23ae0ae86fe4f3e38787
SHA1 e10f866017c2f4961dbb4376bf04d05ede17ec0c
SHA512 a0470f1f4115c8b75b80c41cb4ee4ee708bd3a593223950462515850e6069f997253a006f14a4159f3f3bca690bf02a483da820e5732f4fbbb0ee3e912660dde
SSDEEP 384:4PcJWcoOPREm/mS7c1NmmvT3biatUQhO3488:YVOuxCOUQc3x8
TLSH
T1AF82B956246045BA8351E36994EEBFC3E5F528CF4C418FC9DBF4BD0869DA06E122788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22fdbfa6-574d-4816-a6c4-03ba0e3dcdc1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\22fdbfa6-574d-4816-a6c4-03ba0e3dcdc1
Size 235B
SHA256 20bf2d2fd4b73ad9009648b89546a9ccc94d382743e14fa893bcbce3526f7a0b
MD5 dcf0e79c3ef973bc683c20bbd189411b
SHA1 3e49ef82eb058285f3664bb6fc8cd1835710f0a5
SHA512 89ce7ed059ea79170553a52fc03704dfd692f168a95de36336172cc83105bcd724de99aa291fc866062f3e249d5926c53ac5ad7456ae42a60bbe7d37d218a8ab
TLSH
T1CCD095501C64B36D04040F07B0901AD531484C331175D810D56105745EFA9C8B211407
MD5 SHA1 SHA512 TLSH

Submit Download

47a67000-7ba0-4a0c-8458-bdd94ba9433e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\47a67000-7ba0-4a0c-8458-bdd94ba9433e
Size 883B
SHA256 8144b86535cb3f81265aaf05e82130c1ba4557c23bdc2fa9709f5d9f1c2c1fe2
MD5 396a8b8d70164521ff1d0ce679e56977
SHA1 013ddd773d38c043af12817bb53e60d33c2abaa0
SHA512 ef5b7aea91de9f50d2a9d45825a3a45ba25ed2ba902b5106c36665bc0083d0cfd720b3cf9b7004ec2fa8f7c34f52af0c2d577b642099ebef4e2a4810784b64d7
TLSH
T1ED116381E77078B3CC2CD21B889537068BF4722380CA54143DB299088C7F92EA3AB10B
MD5 SHA1 SHA512 TLSH

Submit Download

e413fea3-265d-402f-b9be-e9736713e6bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\e413fea3-265d-402f-b9be-e9736713e6bf
Size 886B
SHA256 825fa17fa1f578663515004a67ef1af2108274d3fabc7ad68dc7f0d7eedbfaea
MD5 ded61f9b059e641079afb6a2f45559d7
SHA1 b71445f84b3632c80ee8d36bdf9cd79bb6448a81
SHA512 0fd5dc5932028cfdbf90ca6e1a209595a3b2e959d288988501c1272ee25d9cb73351e270f6af10e05a7b5673b74e375123d83d7a7b680f2957efbc0925e3b9b2
TLSH
T19A1127929A74B8B3CC28829B82E17B018B94703380C519043D619E088CDB52F63AB20B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\extensions.json
Size 16KB
SHA256 30ccef852d0cfbe379f4f53455e769880d97fdd824092a6c994819b6565ec025
MD5 e392b8e7b4c95b617feb2f627f40fa9c
SHA1 d9b4fad2cbde4b7d0a796f470686ab7f5e8825cc
SHA512 03e14aaa0073c5cca9e8d26a28f68448b16203cb0f56ff21b4d1e9dc70e5ede02aa1b84e2961f29752d2bdf80efe5152f352da8b0acb697f1b633536916fee86
SSDEEP 384:zkI4vPUmldvZ8dhWo94zR96oKL4HYL4PqL4HJxL4H4L4H9r4hO:QI4XRfaXh4z6v4a4Q4pp464R4A
TLSH
T12C72411545049EB8298FA78AAA367E01C37D433B70845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs-1.js
Size 7KB
SHA256 9905dfab41f1c287e53cada81f3cc637c18c50a862541c1bd18356a0f61f9f3d
MD5 dc99ee5dd9a8e742ec22e376503e809b
SHA1 ed1c07d236b0d887d3e3ff170c10d6becf04c084
SHA512 0c38c426006b8e77e765eef68eb0d5ff3a675389fda1cdca34fe05b1891c2680d020aafba2c4f74138230692ce118a6119d8ebf687392871975487e72a60167f
SSDEEP 96:xHmNTUhqGqm1f4q7ObzS5PSSl5dv9jBnSRWR3KjC5Bw88h08L4cnUVwI:slRm1f4q7rPSS08R3bBw88hoz
TLSH
T192F10D78A504CB7F75B6777CAC248C705AB2013BB6BF68C610BA8485091CF3445FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs.js
Size 6KB
SHA256 fb95d4316f001926a986478882a1de84ce830ccd71de3f8a4db3ff63af75b7f7
MD5 917f65e83316343dcdbc8a7ebfd83435
SHA1 03e9f322c663d3e1e506957a50f79ff9b239df02
SHA512 023f8db32fb367a2c3ec68a70d8f94a071687aff80575a54e59aa819c9f6ab1012bfd6efc0193c70f766b492a74c8a02967efa1861e47a2cde340bd2c07b9873
SSDEEP 96:xHmUTUhqGqm1ftoY1zSSvSSl5dv9jMnSRH/CgBw88H8L4cnUVaI:ssRm1ftoYrvSSX91Bw88lx
TLSH
T1A6E12F7895488B7F74B6776CAC688C306AB2013BB7BF28C750B55485010CF3456F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs.js
Size 6KB
SHA256 77eebddf702b8061132750ad4d0e3d2926e367b2d1768c6147ab718e06478083
MD5 12e7ff184cf0b4c1d9a7e7c2ffcc4c54
SHA1 8e52aa5e575dee6e40db0d6916b34beb34d01fd4
SHA512 349339c02caff8d8a5f54eaef51dacfcf223917649e418c7bb65d3b38bc9daadb477dc9293361c603ddce7212a9b04058474628218540647ff115ea854c1f82f
SSDEEP 96:xHmUTUhqGqm1ftq71zS5PSSl5dv9jBnSRH/CgBw88H8L4cnUVaI:ssRm1ftq7IPSS091Bw88lx
TLSH
T164E13F7895088B7F78B6776CAC688C305AB2013BB7BF28C750B64485055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 90a26a27a30a98da8222e39febe9188a96734ef2b1b84da33621c5ff86f369d4
MD5 3721e96d4f19a95134039f39df3e1ef8
SHA1 bb1e60694dc23b0ca7d82e4c816fca8dcca5a286
SHA512 e9acbf67e34fa5a11da62f26a5ce42e46734f9747977346c3214b5fd43c42c5d24b2ab7370431c204f69c9d6196ec95b6df09271b5c37485b759b85aaaed5183
TLSH
T136219616A63B2DF32731D50CD0465AE6DB5870328DB654F0A2CF8F02676D545738674E
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.5MB
SHA256 62b9e1ce9d85ae8bc734df8ffa45b86d7e68fb25deca37000a5493b757af46e3
MD5 fd100e55a47fc47f9277d472d1704155
SHA1 c713907718afdb1f64fad68377fa21b5ace741cd
SHA512 f1d442bdd6def26467f90a7160d9760a0cb5a9be271722e61418b44873613d62e0f41ad9227a3130a8d4baffa1c1ac0bc05a946f3bda7a49d6c2fd1f450d80b7
SSDEEP 12288:ZmE9sxRXQfNADH79p7u15faUODnxIeQA8eKl:ZmVxRXQ+T7bC1taUGxIUK
TLSH
T187C527C5B4E3F256D39A40B3F24DA3E310BFC01C40765E0447AA6295B56989F9CD3BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads