hxxp://turyury | Triage™

Analysis

max time kernel
899s
max time network
612s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://turyury
Sample260517-nv2f6abx2n

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe
Token: SeDebugPrivilege	5164	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe
5164	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5164	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5216 wrote to memory of 5164	5216	firefox.exe	81
PID 5216 wrote to memory of 5164	5216	firefox.exe	81
PID 5164 wrote to memory of 5560	5164	firefox.exe	82
PID 5164 wrote to memory of 5560	5164	firefox.exe	82
PID 5164 wrote to memory of 5560	5164	firefox.exe	82
PID 5164 wrote to memory of 5268	5164	firefox.exe	83
PID 5164 wrote to memory of 5268	5164	firefox.exe	83
PID 5164 wrote to memory of 5268	5164	firefox.exe	83
PID 5164 wrote to memory of 5268	5164	firefox.exe	83
PID 5164 wrote to memory of 5512	5164	firefox.exe	84
PID 5164 wrote to memory of 5512	5164	firefox.exe	84
PID 5164 wrote to memory of 5512	5164	firefox.exe	84
PID 5164 wrote to memory of 5512	5164	firefox.exe	84
PID 5164 wrote to memory of 5376	5164	firefox.exe	85
PID 5164 wrote to memory of 5376	5164	firefox.exe	85
PID 5164 wrote to memory of 5376	5164	firefox.exe	85
PID 5164 wrote to memory of 3440	5164	firefox.exe	86
PID 5164 wrote to memory of 3440	5164	firefox.exe	86
PID 5164 wrote to memory of 3440	5164	firefox.exe	86
PID 5164 wrote to memory of 3440	5164	firefox.exe	86
PID 5164 wrote to memory of 220	5164	firefox.exe	87
PID 5164 wrote to memory of 220	5164	firefox.exe	87
PID 5164 wrote to memory of 220	5164	firefox.exe	87
PID 5164 wrote to memory of 220	5164	firefox.exe	87
PID 5164 wrote to memory of 2920	5164	firefox.exe	91
PID 5164 wrote to memory of 2920	5164	firefox.exe	91
PID 5164 wrote to memory of 2920	5164	firefox.exe	91
PID 5164 wrote to memory of 2920	5164	firefox.exe	91
PID 5164 wrote to memory of 6024	5164	firefox.exe	92
PID 5164 wrote to memory of 6024	5164	firefox.exe	92
PID 5164 wrote to memory of 6024	5164	firefox.exe	92
PID 5164 wrote to memory of 6024	5164	firefox.exe	92
PID 5164 wrote to memory of 2284	5164	firefox.exe	93
PID 5164 wrote to memory of 2284	5164	firefox.exe	93
PID 5164 wrote to memory of 2284	5164	firefox.exe	93
PID 5164 wrote to memory of 2284	5164	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://turyury"
1⤵
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://turyury
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {8f310f4f-0ca6-4c4f-901b-3dca3f28f628} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {b3206842-0931-4742-ad7e-0f4e0d461ace} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 25164 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {69cf1424-1cbf-4174-9552-345687d430fb} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 3976 -initialChannelId {ecfb9477-e8bd-444c-90bf-97d60c34046a} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 34773 -prefMapHandle 2948 -prefMapSize 270279 -jsInitHandle 2680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4324 -initialChannelId {77337d01-3295-48b8-8889-d8c788a46826} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4948 -prefsLen 35010 -prefMapHandle 4952 -prefMapSize 270279 -ipcHandle 4904 -initialChannelId {d3e23eb5-3054-4ca1-8fed-c1ffb19eaf61} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2796 -prefsLen 32952 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {665501d8-2989-4e55-a3e5-826c70ce4818} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {d85bc1e3-453e-4e40-82f3-cc90178e34b4} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5900 -prefsLen 32952 -prefMapHandle 5904 -prefMapSize 270279 -jsInitHandle 5908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5916 -initialChannelId {668dca1d-6541-4a43-beb2-84b75d959435} -parentPid 5164 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5164" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v1pny25i.default-release\activity-stream.contile.json
Size 4KB
SHA256 055894a1bd0a6be41f144543c0580e23cff0795d791003e4648c248f0157f07e
MD5 d22ba51939ba507e60ed4a698ebb456d
SHA1 ee50344f484ed269a1d767522bdff4fd6e708e9a
SHA512 512e375e5f1e4335643a49c43421cdba47a967ee5deac01b14293fd7ec1ec7b43285e8b2acb80e8d8af7f36c692c22ae3a4f6ad9de5e18bf591974c86dec571b
SSDEEP 96:ZuEECV8Dllv0XoPwSkxnTnVXQxXVvvtlYGST+mRxlol:b6lV0YYLBNQpV3tlzmRxal
TLSH
T1EEA1F9AFC8A588530725B7B47C5E37DCB00BB087EAE0C689FA588D01A7C531B90DD285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v1pny25i.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 23008a7999347bfeac84cae31c6ab10029fdd46b0dd0477264b550ed062f0659
MD5 8b3d0baa79a916d34e74c8af10108220
SHA1 822d8a87befe494caef3ef30e4b808ca81918d57
SHA512 2d5fc6e306aab033871f6a104a99a9b8a749b5cb0d9d5647cf311e4e01f1dad59bf621ae977d59aef16c74b8349b91d27bc2303e473db775dcb444b220ed5973
SSDEEP 384:HUr7iO024YVo6J+Sl1xDnZBPsac4j0lpDII+Ar3SLr3S0:0SZYVo0+Sl7zZlsac4ID8LAeN
TLSH
T179528DB99F0138B92A23C095E9FD9244CD05E6BFDEE3D06619143C04CA847B9F4F689E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v1pny25i.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 175cf0276e4460e90135b0cae4bb7bdd7705f632dc7e0ff9f99f068dd9d1d662
MD5 900b35931bd64e8aa7de28b699f59eac
SHA1 42652cbdfe8d5e806f0972d8d0e3630fe74347a5
SHA512 c9261b40afb18c15e0bd0fa898f70af4cdb96c8fd02deff886ae03b8f24e71bd6d5db0affd1a2410c26e5492d0d416f2d7b4c4f8f4567052f1d3b060e178ae91
SSDEEP 384:HHMO0iO024YZo6J+Sl1xDnZBPsac4j0lpDII+SqRhd5:nrZYZo0+Sl7zZlsac4ID8Lv5
TLSH
T1DB528DBD9F0138A91A23D594E9BD9248CD04F6BBDFE290661A143C00CA447B9F4F68DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 5KB
SHA256 4bae497bcd8e3f3aedd8f094aa22c278afeb336a2756df0feeb91af1c3fdd152
MD5 719326e289fdd3caa83030fab04a07a5
SHA1 6ef060c417e1431e20a8bd9a7150fd54d1da177f
SHA512 8f8ffc081562563857ad2be2cf33be6dd7f2215a9038af7a04c2abc93ccfc69be8ca8bd1646aefd75bf3380aedbaff4f5531babbb233c3410e93d7a1f6246cad
SSDEEP 48:aNdKzJ5Ugdw22UeUxzuqdKzJ/6Bdw22UeUnugdKzJ/adw22UeUFw:rTLE/6Ls/qLG
TLSH
T146B1CB018BFB09A6F9F783313B316753A2B3FD01671B065EC14166984A72760426DFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 13b90047f16f4e07fa243b1c4cf8f82c9583a84daa4cbf1826c18dc5a31f1101
MD5 dcecbcb2b5670b625542a8fbfc855d24
SHA1 7e4f40e578d4e5ba6a7fdf7232f11ddc3bcde0c6
SHA512 590e254b756af765352eb40164d15a75fad48959a3ed2a1d64779c1f45478fe5196e80784ec62afdecf3c1cee0cbf86a6a94f68b0e7c265dc64136531b842d0c
SSDEEP 96:cZSdF95/7bkW6QXjrcE0ryUR6zWZNLFg2FmFVFcF2/dd66Joz0dzgClKtmc0d/U6:+Ov5zboob0ryj621d66Joz0dzgCl6mcs
TLSH
T11AC1CB28E639863FC814023BDCA51B400F76396B984E7F2932DC651D2D972DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 676a9301a428ff8034fcf8ca7b1bbca4fb69d8ee34fb467c9deab88da5d36f46
MD5 4ff3fb57e60a73ce42ec88c6f9d2098e
SHA1 b3a5883fa080416a43f3e50a3ea3a5fd70dbc449
SHA512 b3340727fc856e83ab8b6279ad9896a53a65c8ea4a16187db02712c40544647dfe2a619b8ad506fb50fb1892e3a1ac0d5af04a50123b127d6741aec65f80bae0
SSDEEP 192:8Ov5zboHF0ryjYli1d66Joz0dzgCl6mc0dz:/bol0ryjPd66JozQzgC1jd
TLSH
T1B3E11068E638867FC814027BDCA51B440F3A385A9C4E7F1936DC651C2C472DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ff806c0605f51c3efd05db3ed2a6d15d0b799852664e08d53a6dab62cb639ccb
MD5 f17b5db61bb0898f022358f7596057f6
SHA1 6d98cbc1cb6b0282e191c05312796276644bb245
SHA512 04d7ddb4624399c66df58a9aace0fa94cbc0a3ebd266b01565c3926ce2f9a6dd2627c438db77d766818be6eab79145f3d52ad33d013656756ed80e1a487346e8
SSDEEP 192:XOv5zboHeZ0ryjYli1d66Joz0dzgCl6mc0dz:obo+Z0ryjPd66JozQzgC1jd
TLSH
T108E12068E638867FC414027BDCA51B440F3A385A9C4E7F1936DC651C2C472DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\events\events
Size 1KB
SHA256 978fd95863f9c363880604cae4799e24683b1aa3a8050fcc5c3deba1d7f37e16
MD5 855f4d9aa65808fc061bd9fad2ad32d1
SHA1 0e0f551cec08d5f6337f4dd5beeca62f51761104
SHA512 6ce330c72dc19531ea753e4d3803a2e0b8a43ed397c9298e6651ab1a034df9e332b273616e5c05d7dd4b81380962b706ea830f7b2a50cce2b5c5747dcbdfd478
TLSH
T1E421979C3EFC4D6A58DBF6AC7451068E57928E0B258B1C430E42DE8CCDC5AD932AA43C
MD5 SHA1 SHA512 TLSH

Submit Download

2f975e94-0884-414c-9045-d6f99a09be76

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\2f975e94-0884-414c-9045-d6f99a09be76
Size 883B
SHA256 0b5427bb83cd248692ada1a1d823eaf8e4936d059f66085776518235ea661097
MD5 e03a1ab1b1dc9208a9aa3ef788f52ad2
SHA1 228a82374f97fc50a7209d91ec48931b11d5cd52
SHA512 a2e22000bd031173f1cf8a684799daa98b672e5a239b8e0c7832c114641780736d6e76616fdd6ebdbda4e75f54eb77e3d60bcbb1e456a07f6a913b2eb7d27ed0
TLSH
T10D112F45D634F5F2CC38924BC6927B014BE4B53380C6C8143EB00E080CAA62EA7FF60B
MD5 SHA1 SHA512 TLSH

Submit Download

30ac73ba-c778-48e4-9973-d5405b9d1496

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\30ac73ba-c778-48e4-9973-d5405b9d1496
Size 16KB
SHA256 48478ed10e9d437a77931d6afb5b335e76355a4ed7771dd5442a52fd572e9514
MD5 0fc00a7f039878d767f7e8fd3543c07a
SHA1 8b50a6f9d8459fcc44b11cecc2437799ff09dcb4
SHA512 2905ce5ee31d11416b0607051cbd9d2b09a6655ee880c89c4aa8e8796bda9d932efaa842fd1dd67b8e0bdf504b4d54bd766485754c8314ba66976976830f532c
SSDEEP 192:Zvy8mV8AuI/Mb1ykz4b09E2jGU5ZRriVylQXXspx/3rhiKxPumG8Wt9W/R7B26ox:1mV8AZMb1ykkb09fmyHAtMp7xLM3F
TLSH
T12072C9561420897A8651E36994FDBFC7E6F528CF4C018FCA9BE4BE0869DE06E113784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

314b3a0f-93a0-4b85-8181-92e2ce217b5c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\314b3a0f-93a0-4b85-8181-92e2ce217b5c
Size 235B
SHA256 ce1a6299724b4fa2c2c7980bee9280e4f74cbd6d17af05089096bedffb9b5ada
MD5 6887d68d90c821776a5dafe39b5f8fbb
SHA1 6ea5c6c7fab2a21eb6f39f0115850023c3e193d8
SHA512 b072167496abf67c789e183ed2f082c1f86cacc6154eb767dfe690319dc5631e53a44db401120c1cf831baa525d268f944e6174d44b4a7de527f749ed229eb64
TLSH
T1ACD09786248823AD08602F02B0E129C630C48C3318B458108A618A78F9B8EC80192847
MD5 SHA1 SHA512 TLSH

Submit Download

96a7cd5d-0960-40dc-afb4-d012d7bea55b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\96a7cd5d-0960-40dc-afb4-d012d7bea55b
Size 886B
SHA256 9d20728d7fc9b54e5cca8829b0f6233d62c1b4eb8a4b1712edd24907c74d9dd1
MD5 12489962fee286b3b6ffa4ce03e33781
SHA1 c78a84ce67dd5493242719f9955ffd11cb2e30f9
SHA512 fa5fde58188116c5788690bec29cc66319ec6e2b6fbc69be4ccd0610ee993f2b3670715fe4dc5319dd5dc1ac6f079ab96e20e568fe0d282fb42de8092fe66a7e
TLSH
T1191123449530F4F3CC3892C7D5E1BB5147E8753380C649147FA05B080CAA22E77AB21B
MD5 SHA1 SHA512 TLSH

Submit Download

9fbf5362-5c1b-4f5f-82ca-4708d3dbd9d6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\9fbf5362-5c1b-4f5f-82ca-4708d3dbd9d6
Size 2KB
SHA256 70ae37ce5ff05c3ebe22137b55cf09ec847ad817e0079b4954561e123e1021a0
MD5 72aba03ea7e78fe79770b374ab34a1e9
SHA1 4945cceac55d7b28504f95560d0f7c634b121cfe
SHA512 c21abdd118aea0842f11de9ddcb0f13cc8e175cde98a891db625e716af5aa7cabcf9d4217c2e21920deb4d9063d418fe52574a58abc3c14928484c43541b5329
TLSH
T11F41216CB4384CF74CA7E59DD483238D67648A2310C21C832E62DF0C8D9A79D236A53B
MD5 SHA1 SHA512 TLSH

Submit Download

e6c1fb36-139e-4df1-9b06-d23dd3be6a17

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\e6c1fb36-139e-4df1-9b06-d23dd3be6a17
Size 235B
SHA256 5d27a4b619dbb1a5f15e2d32d3ee4a9fe4c6d66b913e7d6721232b9999ef3931
MD5 f16378fd742d7bf50bfbaa0881864f38
SHA1 891ddcc6ea6d6a294c0d6d9577a2786b04fb2566
SHA512 5a5c955fd6f9f8e2c97a00d4b3746ed69dcb822e0446b30e72cf47b2cac8484cc0c7c51783642054fe8d20fad008e7d61af32bc889f9606ca47d32d95e101abc
TLSH
T184D09790789C632C4C104F26B1B229D230944C3360609820EA62467899FDDDC026392B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\extensions.json
Size 16KB
SHA256 90168a4c508cd97b63e37511149b00d1fef683e910428e2d099f2b6d984ccfb1
MD5 27a62e216ffc24df7fc98a72dea09e61
SHA1 15515adf755a1e6198d563c67752f08c63352588
SHA512 27457a0759007471f919b66777ae3afd5dc34bcdd1166aeaa19f11e5d3c3f12ad5f37b1a1657d9d5c44aab9345a9bb7f692224c5710520c1e14187612cbe28e6
SSDEEP 384:jkI4vvUmldv7s8dhWg94zz96obL4HTL4PQL4HLL4HaL4H084hv:gI4nRfztX94F6w4/4a434I4R4B
TLSH
T13072411545049EB8298EA79AAA367E01C37D473B70845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs-1.js
Size 6KB
SHA256 eed16cfa491ec8e314245a867ffef8661848b2aade1e7aa705b15d3864b562e9
MD5 44290fe794ff912390c035864442b69b
SHA1 997e45e66b6aac67f9d3f7218efed487b0ed6a6f
SHA512 c9a4e47effd01dc30075fa415fd0cbcc8171c5d8fc0fe080a1ceda552884823429267ff2211c05a1cdee479bb5bae645b78361b2f714e743a41acf12d1a62bac
SSDEEP 96:xHTUTUfqGqgfV7Z1zSfSSl5dv9jYMnLHlBoe6Bw88H8L4cnjzu/:ZiRgfV7ZGSSbl96Bw88UM
TLSH
T1D3E11E789418CB7F74B6776CAC6888316AB2013BB7BF68C350B65884054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs.js
Size 6KB
SHA256 9476c309ecdf32dfa98516d448e7f6e64735e125a6a145e55ad691a14ce97cc9
MD5 a11426ea349a63ed9c8da1fc927c1d47
SHA1 6a5c544c9dcd35403fea6315b7a289d07cbb47c8
SHA512 121e46d473988d45560c0e6edc40bca32a3d536fadb7049235f5c9c8c665e5b6413ccfb54d6700bae96395963013a32a72e7fd123cf1523ad12ff2c1974aced9
SSDEEP 96:xHTUTUfqGqgfVtk1zSKxSSl5dv9j9efnLHlBoe6Bw88H8L4cnjzu/:ZiRgfVtkbxSSGl96Bw88UM
TLSH
T115E100789418CB7F74B677ACAC688C716AB2013BB7BF68C650B65485050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs.js
Size 7KB
SHA256 714291c9e3b7eb600230b48f0d6731a4ee37cfd6c1fa47bc57f8e5094dc5b309
MD5 fb7a1d862d6edbd9cef0f0098fec8d35
SHA1 7b0ffe1d978275fa3c46662b5eeab3ec0935db91
SHA512 f76650df459ba53901e469e2f42ae90129c4e6debcac88a27da37f244fe736803d6297911952b19c3d026d8dcaccd5fe8e69b505291b690bed7072f27b7f2e5a
SSDEEP 96:xHTRTUfqGqgfV7ZObzSfSSl5dv9jYMnLHlBoe6Bw88OD8L4cnjzu/:ZfRgfV7ZtSSbl96Bw88nM
TLSH
T1A2F10E789454CB7F74B2776CAC6889716AB2013BB7BF68C710BA4884054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs.js
Size 8KB
SHA256 8449bb4f8f99dba4186717dffb2a144e95b86ec90f744df3f9505fc1f4c76319
MD5 a0c77b03e7307e28bc29cbe0692d0d6a
SHA1 f19273a6e33c1fd6191e2f2138dd02ff5fe1f568
SHA512 73c4c4268f7049192c60e618f6e2206b192f93bc064c5cba36853e4afb8eeda23818f8d91a122ce9069ae16726439e31cd640f5770ccddfb6904eeeb6c75a17f
SSDEEP 96:xHTRTUfqGqgfF7ZObzSfSSl5dv9jYMnLWRXRBoeyBw88OpgxdT8L4cnjd/:ZfRgfF7ZtSSSRh9yBw88Tde
TLSH
T12C02DD385854CF7F64B2366CBC248D745AA2013BB7BFA8D310BA4885054CF3541FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 8608d35490385dd833b4c7d5ec80897204641d2153f5ed929458197b2054dd79
MD5 e3f7bf23be152ae76538bc6c8510469c
SHA1 92ab46cdbdc1883d1119bdc70a969d719c797761
SHA512 2eb2cc67e9b56666d56e9bb7607d9a9836d916eefbefc96adcf26bd72842112c250c10bccc176917ec2b256298cf06498f213c9ebed5ebb53c7e22f83b6972c3
TLSH
T11621C88B8B2E1FF6B392513990455FB28F9A343344B574A0C5AA4F0E1A5D958714450D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads