87e7f15ba96979cda54a6b9b228a1f4ed84e4f393fbb9ba687809a7f6d9c56fc

Resubmissions

11/05/2026, 17:53

260511-wgnbdaf15t

11/05/2026, 17:44

260511-wbd6hsbt3l7

Analysis

max time kernel
599s
max time network
475s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 5.2MB
Sample260511-wbd6hsbt3l
SHA256 87e7f15ba96979cda54a6b9b228a1f4ed84e4f393fbb9ba687809a7f6d9c56fc
MD5 6d60639741369b5d0dccf060bb918ad2
SHA1 fdfc5741e16617140678890d127bda52cfb1c552
SHA512 f873e4a0f607d022c480222cb1d91040c90c58235b33329198f65fa6778f64460ee26b5102d37501e0d00f12e01cc7c30309b436478706cddcbfdfd97f3e3524
SSDEEP 24576:Ki4qVui5DSPovok2iv6vqKXhv/+uwJ+WGhsA3Ar:X/uipQ+uwIDxv2Ai
TLSH
T11A46C66BBB49037316F242626B4AA5CAF31F903F375A1654309CD1181B7BE2483FB69D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
22	raw.githubusercontent.com
25	bitbucket.org
58	bitbucket.org
110	bitbucket.org
16	raw.githubusercontent.com

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe
Token: SeDebugPrivilege	3052	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe
3052	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3052	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3052	2380	firefox.exe	79
PID 2380 wrote to memory of 3052	2380	firefox.exe	79
PID 3052 wrote to memory of 1192	3052	firefox.exe	80
PID 3052 wrote to memory of 1192	3052	firefox.exe	80
PID 3052 wrote to memory of 1192	3052	firefox.exe	80
PID 3052 wrote to memory of 1732	3052	firefox.exe	81
PID 3052 wrote to memory of 1732	3052	firefox.exe	81
PID 3052 wrote to memory of 1732	3052	firefox.exe	81
PID 3052 wrote to memory of 1732	3052	firefox.exe	81
PID 3052 wrote to memory of 1832	3052	firefox.exe	82
PID 3052 wrote to memory of 1832	3052	firefox.exe	82
PID 3052 wrote to memory of 1832	3052	firefox.exe	82
PID 3052 wrote to memory of 1832	3052	firefox.exe	82
PID 3052 wrote to memory of 4284	3052	firefox.exe	83
PID 3052 wrote to memory of 4284	3052	firefox.exe	83
PID 3052 wrote to memory of 4284	3052	firefox.exe	83
PID 3052 wrote to memory of 4572	3052	firefox.exe	84
PID 3052 wrote to memory of 4572	3052	firefox.exe	84
PID 3052 wrote to memory of 4572	3052	firefox.exe	84
PID 3052 wrote to memory of 4572	3052	firefox.exe	84
PID 3052 wrote to memory of 3376	3052	firefox.exe	85
PID 3052 wrote to memory of 3376	3052	firefox.exe	85
PID 3052 wrote to memory of 3376	3052	firefox.exe	85
PID 3052 wrote to memory of 3376	3052	firefox.exe	85
PID 3052 wrote to memory of 1528	3052	firefox.exe	86
PID 3052 wrote to memory of 1528	3052	firefox.exe	86
PID 3052 wrote to memory of 1528	3052	firefox.exe	86
PID 3052 wrote to memory of 1528	3052	firefox.exe	86
PID 3052 wrote to memory of 328	3052	firefox.exe	87
PID 3052 wrote to memory of 328	3052	firefox.exe	87
PID 3052 wrote to memory of 328	3052	firefox.exe	87
PID 3052 wrote to memory of 328	3052	firefox.exe	87
PID 3052 wrote to memory of 236	3052	firefox.exe	88
PID 3052 wrote to memory of 236	3052	firefox.exe	88
PID 3052 wrote to memory of 236	3052	firefox.exe	88
PID 3052 wrote to memory of 236	3052	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27097 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {0d766fe1-ea2c-4214-8dee-9c4b1d0506ac} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27133 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {8cbe004c-92ef-46d7-ac12-83325119b611} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27323 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {700affe0-6980-423c-8a7c-c35b7d23180f} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27323 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {9b58c967-f4c6-484d-9cff-41b4ca12f23d} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 34822 -prefMapHandle 2948 -prefMapSize 270279 -jsInitHandle 3056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4460 -initialChannelId {c6b80561-4d3d-4630-998c-41aa1b9f7324} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1648 -prefsLen 35010 -prefMapHandle 1652 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {57e072e0-d339-46ad-8afb-8db18c2148bc} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32952 -prefMapHandle 2824 -prefMapSize 270279 -jsInitHandle 2828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4948 -initialChannelId {93b4d58e-1127-4678-af29-0b4fe91e515b} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {b626776c-a1d7-456c-b0ad-600d9832b7d0} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5720 -prefsLen 32952 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 5728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5736 -initialChannelId {42343036-060d-4fca-a59c-7e47aff32c33} -parentPid 3052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\activity-stream.contile.json
Size 4KB
SHA256 e29e6bc0d651089a74ffb7288281cf47528ce65e1ece76aadc7518cfae8667d4
MD5 6d905d701104d4eb03c854789b8c2979
SHA1 90434047b65f5d654c4352bc2ee87b4ee29890b4
SHA512 81b4b6182808b58a50c5ebe12e42799c18a5e6c1aa73fbb1543f1e0f63cf4dc93737dafa742ccbe42f9b503420c0bb2de52736c6a882b6bdf10685dd38514171
SSDEEP 96:Kmt7+mDJVwoKdxCUI8DlVZo4otIfWaBf9XOwdkl:Kmt7jJ+d4Urlg4otIfWa3XOwdkl
TLSH
T103B12BEF8875C417473263E06E1B375DF14FA10BDFDA8DC9AB875C1092E410E51B9684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 14KB
SHA256 22144c9d75ae2089d61fbc8a0987d5b530553e0d17d0fe64d1f2653f2a3d39ac
MD5 bfe2f77b47ce3530731e2778a9ea8b4b
SHA1 82b152b992f94be34002cc73b83cdd2a073f139d
SHA512 71f176a91c8f14a33516244c20cc05ffbc075b06e7ca080692c14cb95b5b580be76944102a179f342776bf256a863044d384467110ccea73c3ad79b883631001
SSDEEP 384:p37jcDiMIlz3ew76E+AxAbJ2ePsac4j0lpDIILUIj:OI+exAtsac4ID8KV
TLSH
T18A629EFF8E71505F4B2296F1AD7E27C59D0A920BAFDAC6DD4E853800C18429DE5F91C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 2ab84c14fcb04b336aa01ea18bb46f05a7f552201bc084e37cf0f5c93eacb4a2
MD5 6ceea5099fba3c327a78490465020f3d
SHA1 b97189317285cca3a8774a76ea141c4a825f197c
SHA512 bf812280b95c3f1d88749ab8b65dd3782241d6444e612e8c95db2e0dd5a5452628036fcd9c9325814b45c07b25aaf944f0647b361b9f5c1011ad1010919bc901
SSDEEP 384:HHMO0iO024YKo6J+Sl1xDnZBPsac4j0lpDII+LdgdM:nrZYKo0+Sl7zZlsac4ID8LV
TLSH
T1A7528C7D9F1138EA1927D1D0D9BDA2558E04B6BBDFE280661A243C04CA44BB8F4E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UHM6LK3DWINLYR02SUOB.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UHM6LK3DWINLYR02SUOB.temp
Size 7KB
SHA256 d59de484392beb0d769f6c89435cba2410fae53428dda7f73a6cad90aaa8b95a
MD5 62abae7616abc4f7d7ca428c8374eff3
SHA1 53f37ba3fed88dba2bab237eba5a4bf17d56f706
SHA512 d9a023023574cdca4c2d6d6acc690eec6277cc854633fbc3cf53be4ce765cf666cfb6e1801a7b9134edde21726b37f0c62e43ebe2eaf88559c7c8b69320ee7d1
SSDEEP 48:63ud8J5UgdwXzDWud8J/6BdwRDEud8J/adwzddhud8J8i+AVdwbS:m/P//a//F/xr
TLSH
T186E1AC021BFA1893F4F38632BA32B7476673FE00565F462EC18166494A323A4916DFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 af831603186f6b58a13a76c9b2e021c52c1bc5dce122bcb447a6378dbe89caf1
MD5 9e982563be38c2cc1c9b432b4e27ad2c
SHA1 922caba2cf0b7c7d7d10dab628c3428e7696fc6f
SHA512 041c8af25c5b15f6242a96997e2a1d0a72ed256c0fa24ff385569756de460c9eff3caf636a5982d1232fb7050450a8f23e32fe7b34f6eccb1d4b317fa10c03d8
SSDEEP 192:jOv5zboH0RJyj9vTp31d66Joz0dzgCl6mc0dz:sboURJyjLFd66JozQzgC1jd
TLSH
T195E10D64E628863FC41803BBDCA61F414F35389BD84E3F19359C64082D576DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 87fd3ff8b091aa9641a1c03990a0876b227d0dab37f49c3d62d906f465cb8ec6
MD5 de83814267ab3b43b297f1362a375a63
SHA1 c842742ccd0691df26b34dd4b122433d23af4b9b
SHA512 88d16aa263377219efa264d25638696d89a57696735340e248ea4f5c1bd76080eeca1dc95e3827e4562367a57a0d04b641bcaea1a8f9ac0a8b00a2c44d07ac54
SSDEEP 96:wV52FIFhFFFL3/dd66Joz0dzgClKtmc0d/URGShSdF95/7bkW6QXjrcEq0JyUR6M:wp31d66Joz0dzgCl6mc0deOv5zboobR/
TLSH
T11AC1DB25F628863FC418023BCCB61F401E72385BD84E3F1931EC64092D6A2DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 acb6f88b0c577cf2742d6b2b100d1e22fd625dd62256a8334f09bb0c120c64d8
MD5 8a6d9742091cbc4ebb6fbc38f57bedd2
SHA1 d23d4013afa660ed24d9ffb75d1f1946601cf11d
SHA512 c3fd9f494abc5e1269c96af5f676d0072f7c662b4f210453d430b8897fcb01dc016e88149f7ccff0b4ed7b96e9e1a3118df694e9c8afc7552986a469857c6950
SSDEEP 96:0ShSdF95/7bkW6QXjrvEq0JyUR6FmWZHV52FIFhFFFL3/dd66Joz0dzgClKtmc0d:VOv5zbooMRJyjzhp31d66Joz0dzgCl6s
TLSH
T14CC1CB25F628863FC418023BCCB61F401E76385B984E3F1932EC640D2D666DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 751106e0ae060ac52c6a22eb8084bbe823a50f29e61464446d7690d48bfae113
MD5 4d85207731ccbaa9a288047603fc8fb0
SHA1 2d2a97297cd097b452ed17fbc38740f6a22db132
SHA512 7b330b323d0938e43cbccc4bf599490cd633223940932219a82562532f16f791921e9831b512cbc164a7e999b39b2bcdff925fcd1ca524d4277c91d547fd8925
SSDEEP 192:wp31d66Joz0dzgCl6mc0dwOv5zboHwZRJyj9v:4Fd66JozQzgC1j5boQZRJyj
TLSH
T15CE1FBA4E628863FC41803BBDCA61F410F35389BD84E3F19759D64082D566DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 08403e2f134e4c245b866b60ef6f54d471b5babcd1080c6c71c4aff743224cec
MD5 94209457b0344ce9a3599c12e832d804
SHA1 de8f2631c6fa0eab5adbda899eeb6036eec31700
SHA512 70a9e70d1e64882a200aaa236095297a1e4191e65feafe7387b203849d54b967130b7f8c99f770bd24e26fe2c945b977bebe649df495823c05c203f8ca335317
TLSH
T180213D9C3DB84D6AAAD7E39CB84102CE53594E0704CB1C430D22DF8DCD99ADB327A479
MD5 SHA1 SHA512 TLSH

Submit Download

3b5a4954-f207-427d-9bab-81659c0909cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\3b5a4954-f207-427d-9bab-81659c0909cb
Size 235B
SHA256 4e2f51ffe4d56a2cc24ee54c7288495f6347b21faec90feccaabaa36caee8335
MD5 35807cb17bab03628362aaaf4a9c7ea1
SHA1 3f2ab3d5705b3b75551efcb5319f81112916a736
SHA512 ce0d40d133885acfc66e85a074e8eecc74ff68c27cf640df01ee1e531285b0e3ced9aa383706e2d3e682496ef31241e333f757776afa2d4e568e64998434f8e7
TLSH
T172D097D014A8E3AD08080F12B0E03DCB30C94C3320656820CA648078EAFEDC802A1807
MD5 SHA1 SHA512 TLSH

Submit Download

829e4fc6-1e77-4685-b94a-8a439deece3c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\829e4fc6-1e77-4685-b94a-8a439deece3c
Size 235B
SHA256 bec515119f24fb99ed8c2bb553668cbe41a1a6c6cbadcabf339e00506357a92a
MD5 651fe1680e564b7010452d715598f4e8
SHA1 2f8d9b553ea35c564cf55f0d5b6f3e0533ef2f80
SHA512 845795a62b5f496c83a9113404f9a5938ea54ed6a2f1d2b25b6d226d2be9c1dfcc5935e9d3aae3578bd6e261e8f59c8329cef16027a46ec2d8264f04aa960001
TLSH
T12ED09780149CB75E4C140F03B0E06AD6B0948C3328B49820E6E00D7499BEEC451118A7
MD5 SHA1 SHA512 TLSH

Submit Download

b92d83df-780e-4b7e-8c17-db9e82ba49aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\b92d83df-780e-4b7e-8c17-db9e82ba49aa
Size 16KB
SHA256 5fbcbf0fff16df9fe68125da0feedb0b79de426fa75b03405cc6eb9802b4a926
MD5 ed71ed9b46422f945d0c1c82feab3eea
SHA1 09533141f50497a023eb1751ede5b0da83da6f1d
SHA512 ecce0ea24f4111a236e92b68b4500ccc67a85a5801d4f28de3516436ab823769cc3e2bcc3056c473a8a9691abc40018abb1a45c3c0373b0695a17aedf11b93d9
SSDEEP 192:ctaGC41QJJeJFKYbuQBS+m3E1PdujzuT5fz6CkWv+U5LaBl5U85pPKuGvSnxJFxZ:cwGC41lMuJc/OuuTpzQ5loe0YSXbY
TLSH
T18772C956186045BA8691E79994F8BFC3E6F538CF4C418FCD9BE4BE082DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beb22230-1e80-467a-b9e9-47ff770e04ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\beb22230-1e80-467a-b9e9-47ff770e04ba
Size 886B
SHA256 b3816d4e0bd2fc25255ec26a9442e4bb901bbd690bc9c8bd4f94e1ff943d2db8
MD5 16ab3f5f013d97d61550949a7d9dcb23
SHA1 12b488d4fe8b44f3f7568a3b29243598882fde4f
SHA512 9dc784ce18b0131709312fb37f22726abda498f48ec050202d8c953c9a06068ac156d0cedb8656ff1f569d844582e62c39c063fce3d088ceb8a6f23ea074a488
TLSH
T1E211DC818674B9B3CD6C928FC5E17B425AE43023C0CA19187EA54A180DBE91EA36B60B
MD5 SHA1 SHA512 TLSH

Submit Download

d9c253c4-f91d-445c-b297-e721adc88cf4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\d9c253c4-f91d-445c-b297-e721adc88cf4
Size 883B
SHA256 fb8805f0e08af04b76e3f68edfc6233ade407d8e0627dd8df488bca87896da5b
MD5 2d19995d136b20abcaea085fbd6ea466
SHA1 7f2a60f0cec983f856f2daa26c9ebec0fe583d04
SHA512 23ff688b72d9dd4cda66bd3c636d4b1399e549adc37acb4f5c6defc54cb3c11d9b40ae26eaee4eede5f661017b754f41e8c79a90415d11bf92bf2b38d0070828
TLSH
T18211005293347972CD3892CFC9927B4197F83523C0CA54147EE58E040DBD91EE3A760B
MD5 SHA1 SHA512 TLSH

Submit Download

f84c3710-df9e-47d2-a554-505f75bc9679

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\f84c3710-df9e-47d2-a554-505f75bc9679
Size 2KB
SHA256 51fb7305b080c124c37ed3508789303128c3f396d2e46962b0ff787e9841925a
MD5 583df89b93bd74253b06d6d281a5b0c1
SHA1 6ea71bc3c302eda8f4c4d8180fcad7365a9185b1
SHA512 5ba6251e0951fcfe36a9df47bbf3a3947dc16cfca8fdb8dedcbf9fa6fcffbb9321caa1381bbdd93a196e67e4aa7c3fc64eb57cc1d170c43e53e883ff2aadbc56
TLSH
T1A041235836784D7B8CDBE1DDD492368E93A08A1340C61C836E91DF0C9CD969E736B82B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\extensions.json
Size 16KB
SHA256 a02a7b1653c808b461a7ac888e505f07a00f28dd7ef616990908eadbff992f26
MD5 0194f2fee330cfb688127e45a0bd6f2a
SHA1 283816cb8e5ff6897b0986bfa4eeec55cad34a79
SHA512 f00df9afae6c792df890544a1cd3aa2146e012dea01031e78962dbed92d67643142fa0c3660924c3af705d3206d766b444a85e8a2d823af6aa92fa1bb30ccd81
SSDEEP 384:MkI4voUmldvM8dhW894z896osRL4HmL4PKL4HGL4HJL4Htz4ha:DI4QRfVX94U67J4s4A4M4B4F4o
TLSH
T1DF72321545049EB8294EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs-1.js
Size 8KB
SHA256 c6e8f68132e5a5dc94eb948a227cecc970c71dbef8af223f4fc7b64e217ae737
MD5 e926b53848fad0ecb5c5b95380566a6d
SHA1 486d40967d068ccd2c4af2067b973eda42d4bdd6
SHA512 a583f253063b81e67b4893886b00eb9ca3d6fc3caba3e92de733dff9bc882281e521c6db348a8baa1994450cffe8402bbff44bb9d613f7906f83f2aa533780af
SSDEEP 96:xHHJ3GT6G+jTUtBoqGqV0fJiBObzSv4SSlldv9jm8nYtWRS2xLeBw88usC48L4cn:nuRmfJiBZ4SSxRl6Bw888n
TLSH
T132021F7894048F3F65B237BCAC6449716AA2013BB7BFA8C310F95485054CF3941FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 90bfb8c77275e9b3c0dd9e31ff6072bd95c12840412d1284206c2146953f5ff5
MD5 896edc973b3f0a3cd20871ba44de0960
SHA1 058eb2a1be10b7adb1f3abe5419a5fef9fa322f7
SHA512 65a517e3bb71aaad3f63a29368ceb13c2a988b272cfddd02e54086bba65fe0c5caca3f79a1b2a583e6877c149da78cc6aef60f1ea2943fe7da97edc7c6f1925f
SSDEEP 96:xHHJUTUtBoqGqV0fYKjzDnjb1zSVMSSlldv9jRinYtHFLkBw88H8L4cnZhLMR:njRmfYcDfrSShvFoBw886s
TLSH
T18BE1107895188F7F64B677ACAC6488316AB2013BBBBF68C750B544C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 e3352360259db6a40a4527ceb17931b29ec290a2a26b9f3588d538af084bb266
MD5 5a28bcdbc1227eabc6fc8bada7066cf0
SHA1 d1d39e1169a68002d2608bdebc5aece567247225
SHA512 ddcbb8ec870f96e922b4c7be6ad59786731d9aa01aa504607da802e47e715d9ee81eac4c17bd03f70474a51c2b82154c672626500c8ef59e394b3197ba51150c
SSDEEP 96:xHHJUTUtBoqGqV0fYiB1zSv4SSlldv9jm8nYtHFLkBw88H8L4cnZhLMR:njRmfYiBu4SSUFoBw886s
TLSH
T180E1207894088F7FA4B677ACAC6489316AB2013B77BF68C750B544C5054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 96178ecf4f9c28972f18d06a8852e277f8854ad3886949d51f06a9ce633bfc81
MD5 e3fc213022d8cab7a3c2c7ac4cc550b0
SHA1 a11aeec6342eb37552a9159a147004aba6630df3
SHA512 c79c368f3c9c00516aa128e34dda83e38f38f2b8a838ece901adcf97649766c89da1207e06b99f181cfa37b46e30d041bb48cfe3a1e86d0d61f366d977e7c589
TLSH
T14B21088BE8EB3F757693044E99848FD5C6B4383241B928F09009CF0274AD44A3A47B5C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 0e365034c6dd9d2ee951a9b2afee8f3c54f6d4835fabbdf0e7000ca930741ed2
MD5 d41c170babdc3595d6c5b1d183499c0b
SHA1 ac2c0f6d7423275107044ddb8b4a7675fa3995af
SHA512 557af5ddfa3464d89e2ccad680c53f2462231890ba2cc18c79e3f15864e10386d8d0a9f0e7bd1137409095337c741728f8042ee964ea76a49b5b8b4ea89b252a
SSDEEP 24576:LNXGl209jHK209DuyO6FDqX+RIq2XRw+fZnGV:LZsjK209D7O6JquR6u+hnG
TLSH
T13DF52AF82092B357F3418033A64553EB21AFD00CA467DE044BA956F995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.1MB
SHA256 5cd5db045ef8671266982b2bfc5053b89ecfa4c6872facd9532dd2233fafcefc
MD5 8c1590c4ab094cc01ab9f8a180f3aaba
SHA1 a00b8850a9e00d050735b8d2e4ba82966cf395f8
SHA512 aca4e8786d3672d8894a2278a4de37afcfc62d0d35d7e08c67ec1cc1fb7fed3c2609e2200e212e63240ff8327e0c86752c929d7b11de350d341be273dd1e97a5
SSDEEP 49152:OvkvRVaAIoW8zN6wlk3SYlx5kua7G/eRfz5CylSBB45Pmi73z6xqRoAgclMB2xPW:aURoAB6BcPKUts3WF85
TLSH
T166566DE420E29252F38544B3719A53FB10EFC01C6076CE44579896FAA5B8CEB4E877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads