279f25bf752f88a069ab7c21abdaa59dfadd2c4144d74a0d78a42ed53f79d97f

Resubmissions

18/05/2026, 15:30

260518-sxtasaaw5n3

18/05/2026, 15:30

260518-sxfppaaw4q3

18/05/2026, 15:25

260518-st1wfsey3w6

18/05/2026, 15:24

260518-ss3nnaav6p3

Analysis

user interaction
yes
max time kernel
173s
max time network
161s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/05/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lands-7.25.18.jar
Size 2.9MB
Sample260518-st1wfsey3w
SHA256 279f25bf752f88a069ab7c21abdaa59dfadd2c4144d74a0d78a42ed53f79d97f
MD5 6572de0eb08f16afe3fd6ecfc0827760
SHA1 68711d0273456a89e3ae06ca3d75efc4c4c95df8
SHA512 744b5861290392030a59836477e8a1e1f08f2a5565e234f96fefb2e49645455d3984dd5547c6467324667604748278975c88d6f6cee483fa4063922bac48ac37
SSDEEP 49152:qJMucMTW7Q0TYIWHmNRcVsESSpBzqpAr+65V/qTL0v8OnqFGxHK85b2oJ1O54:qJMucMTWLJWGNRypSw13rLV/qkF9Kc7
TLSH
T13AD5CF49548F42B6D053D7F010628F6FFE1E9BC2F0021A67A359C7636EB3AAE4705726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\server.jar:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe
Token: SeDebugPrivilege	1228	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe
1228	firefox.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1228	5016	firefox.exe	87
PID 5016 wrote to memory of 1228	5016	firefox.exe	87
PID 1228 wrote to memory of 6000	1228	firefox.exe	88
PID 1228 wrote to memory of 6000	1228	firefox.exe	88
PID 1228 wrote to memory of 6000	1228	firefox.exe	88
PID 1228 wrote to memory of 5992	1228	firefox.exe	89
PID 1228 wrote to memory of 5992	1228	firefox.exe	89
PID 1228 wrote to memory of 5992	1228	firefox.exe	89
PID 1228 wrote to memory of 5992	1228	firefox.exe	89
PID 1228 wrote to memory of 1740	1228	firefox.exe	90
PID 1228 wrote to memory of 1740	1228	firefox.exe	90
PID 1228 wrote to memory of 1740	1228	firefox.exe	90
PID 1228 wrote to memory of 1740	1228	firefox.exe	90
PID 1228 wrote to memory of 5304	1228	firefox.exe	91
PID 1228 wrote to memory of 5304	1228	firefox.exe	91
PID 1228 wrote to memory of 5304	1228	firefox.exe	91
PID 1228 wrote to memory of 5548	1228	firefox.exe	92
PID 1228 wrote to memory of 5548	1228	firefox.exe	92
PID 1228 wrote to memory of 5548	1228	firefox.exe	92
PID 1228 wrote to memory of 5548	1228	firefox.exe	92
PID 1228 wrote to memory of 5100	1228	firefox.exe	93
PID 1228 wrote to memory of 5100	1228	firefox.exe	93
PID 1228 wrote to memory of 5100	1228	firefox.exe	93
PID 1228 wrote to memory of 5100	1228	firefox.exe	93
PID 1228 wrote to memory of 2692	1228	firefox.exe	94
PID 1228 wrote to memory of 2692	1228	firefox.exe	94
PID 1228 wrote to memory of 2692	1228	firefox.exe	94
PID 1228 wrote to memory of 2692	1228	firefox.exe	94
PID 1228 wrote to memory of 1064	1228	firefox.exe	95
PID 1228 wrote to memory of 1064	1228	firefox.exe	95
PID 1228 wrote to memory of 1064	1228	firefox.exe	95
PID 1228 wrote to memory of 1064	1228	firefox.exe	95
PID 1228 wrote to memory of 4984	1228	firefox.exe	96
PID 1228 wrote to memory of 4984	1228	firefox.exe	96
PID 1228 wrote to memory of 4984	1228	firefox.exe	96
PID 1228 wrote to memory of 4984	1228	firefox.exe	96
PID 1228 wrote to memory of 5356	1228	firefox.exe	101
PID 1228 wrote to memory of 5356	1228	firefox.exe	101
PID 1228 wrote to memory of 5356	1228	firefox.exe	101
PID 1228 wrote to memory of 5356	1228	firefox.exe	101
PID 1228 wrote to memory of 4332	1228	firefox.exe	102
PID 1228 wrote to memory of 4332	1228	firefox.exe	102
PID 1228 wrote to memory of 4332	1228	firefox.exe	102
PID 1228 wrote to memory of 4332	1228	firefox.exe	102
PID 1228 wrote to memory of 2172	1228	firefox.exe	103
PID 1228 wrote to memory of 2172	1228	firefox.exe	103
PID 1228 wrote to memory of 2172	1228	firefox.exe	103
PID 1228 wrote to memory of 2172	1228	firefox.exe	103
PID 1228 wrote to memory of 4776	1228	firefox.exe	104
PID 1228 wrote to memory of 4776	1228	firefox.exe	104
PID 1228 wrote to memory of 4776	1228	firefox.exe	104
PID 1228 wrote to memory of 4776	1228	firefox.exe	104
PID 1228 wrote to memory of 5536	1228	firefox.exe	105
PID 1228 wrote to memory of 5536	1228	firefox.exe	105
PID 1228 wrote to memory of 5536	1228	firefox.exe	105
PID 1228 wrote to memory of 5536	1228	firefox.exe	105
PID 1228 wrote to memory of 5520	1228	firefox.exe	106
PID 1228 wrote to memory of 5520	1228	firefox.exe	106
PID 1228 wrote to memory of 5520	1228	firefox.exe	106
PID 1228 wrote to memory of 5520	1228	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Lands-7.25.18.jar
1⤵
PID:4236

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {c9ed2818-de2f-47f0-a885-683f4795e43f} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27136 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2468 -initialChannelId {3a2c0e4a-9ca5-42d2-93d1-41fff340158f} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27277 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {74ddfcc7-fd9b-4614-82d3-edc86c416518} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27277 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 3952 -initialChannelId {6afe1477-8d59-4aef-808e-16cb937d2f94} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3020 -prefsLen 34776 -prefMapHandle 3672 -prefMapSize 270279 -jsInitHandle 2948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2720 -initialChannelId {e4cc0472-341b-4207-a3a8-00b70e7c65e2} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4872 -prefsLen 35013 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4928 -initialChannelId {8505e560-47d4-42b2-9256-a2f34eb0a50b} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3148 -prefsLen 32900 -prefMapHandle 5028 -prefMapSize 270279 -jsInitHandle 5032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5040 -initialChannelId {20789a03-bb84-4e84-99d3-3c675043726f} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5028 -prefsLen 32900 -prefMapHandle 3148 -prefMapSize 270279 -jsInitHandle 5128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {992ea2ef-9e9f-4f66-9714-dfcca8379b17} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32952 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {cfe8f216-27e4-4ab4-8b85-1e2b9bf6a3a5} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4896 -prefsLen 37413 -prefMapHandle 4900 -prefMapSize 270279 -jsInitHandle 20752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22796 -initialChannelId {4e2bec2d-7d3d-41a9-bde3-b43f9b979d62} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 9224 -prefsLen 40667 -prefMapHandle 9144 -prefMapSize 270279 -ipcHandle 19572 -initialChannelId {fbeddc00-9a75-4d91-bf13-6dd3c3ff557d} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24696 -prefsLen 37413 -prefMapHandle 24840 -prefMapSize 270279 -jsInitHandle 24816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17424 -initialChannelId {6848702f-9b0a-4d92-9310-382c1051ae0d} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10068 -prefsLen 37413 -prefMapHandle 10076 -prefMapSize 270279 -jsInitHandle 10104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10060 -initialChannelId {b47b3ab0-af7e-432e-ae72-bba4889f79e6} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10308 -prefsLen 37413 -prefMapHandle 10316 -prefMapSize 270279 -jsInitHandle 10796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10852 -initialChannelId {c9ecd80c-961a-4d3d-985f-ac7ebe192277} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11244 -prefsLen 37413 -prefMapHandle 19888 -prefMapSize 270279 -jsInitHandle 8316 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10804 -initialChannelId {dec412e0-51fc-423b-951a-b07810c51020} -parentPid 1228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

386D22EAB36C3C5C3713F931E60D7F8CA78D773F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\386D22EAB36C3C5C3713F931E60D7F8CA78D773F
Size 48KB
SHA256 1d01d1c29084c8199ae2485ddfa4703e9c8ddbf332041c7835442b0f23743649
MD5 eceaa5eb83a3fcedf49cf871252d3391
SHA1 7f7ecf0050b0f6a81740d198b9c3e1d79f86b9e9
SHA512 12c0301867a35d209336f9cc16e444bbfb9191e8f42143b1fa692a62ca52c43919594d939f53f19a3a7848d8b325811be06a15d30ea281b2ba559cecbe76a951
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56mSlc6NlFXKAvKiwI:VcI/iEEEtXdFJj+0GPwHbP+w5r79w2v
TLSH
T1CB23F23B5F18A7194912BBB03550F7C87E083B238FEE54AE831C87991D98BF1649B1D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6DED9FE7A50E8290358DC1D8C755B05692CB9E36

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\6DED9FE7A50E8290358DC1D8C755B05692CB9E36
Size 512KB
SHA256 c9b1d3b5f9b0ea483c3d71a60b07edac8b6b42e6e03e47d6524d3c1b7ede96d5
MD5 3984883dd0eb3bff9e45acf832dfa880
SHA1 e80cd217cc72235f9df127fca9ea68d63375ef87
SHA512 dd4d8a41004d6c707e9fd10f40dee986c805249fb891622a447af3b8c9af0708a658637c877442c21a07c879529f3f76ebdf73f2c3212bdb70f6f6da5e8119ad
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErHRq:OltBL+PLQFZBgBo2xAzpsrw
TLSH
T1ABB423A8B73B766CD37A5C76C257D8F853E8DA2B56422CE80C4E018E6140AB137D73D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 9b1a71d6ec0dbfd421931659ef85c70515eb1b01e3858ef182f7e70469bfcda6
MD5 6014df420f9cd15a16c4d7559a33969d
SHA1 744e0fbbc16b98d3f3e57996eb863a56fde0dd7d
SHA512 63ab6052f9b219b9253ad02642e47def7e2b852709d54239da54105f4b7fda1bfdd4f542bd622bdbd800f62cd352cbcbd45d0e7ddb5e1aa0ad0e9acfb48fcd15
SSDEEP 384:HHMO0iO024YKo6J+Sl1xDnZBPsac4j0lpDII+mhzhZ:nrZYKo0+Sl7zZlsac4ID8Ly
TLSH
T17C528DBD9F123CA91A27D5D4E9BDA205CD04A6BBDFE280661A143C40CA447F8F4E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IHSwq7rhwet_PL3Lbva+oVGB4sb7qQw6AX6PUENc3eU=.ico

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\jumpListCache\IHSwq7rhwet_PL3Lbva+oVGB4sb7qQw6AX6PUENc3eU=.ico
Size 691B
SHA256 6574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8
MD5 42ed60b3ba4df36716ca7633794b1735
SHA1 c33aa40eed3608369e964e22c935d640e38aa768
SHA512 4247460a97a43ce20d536fdd11d534b450b075c3c28cd69fc00c48bdf7de1507edb99bef811d4c61bed10f64e4c788ee4bdc58c7c72d3bd160b9b4bd696e3013
TLSH
T15D0194C2B2203025F81A82B05613C895D04E81EE0998A42A8CA7D1F6A848A23958EFE4
MD5 SHA1 SHA512 TLSH

Submit Download

85774ccf-5af5-45ca-83f3-0725c3b7d4c9.zip

Path C:\Users\Admin\AppData\Local\Temp\85774ccf-5af5-45ca-83f3-0725c3b7d4c9.zip
Size 3.7MB
SHA256 efeb32692c1718c3d5480934f6936441745f86509bb5e85c590849ac99e4ed09
MD5 b27f3813fdebb3467b63e23a6ace5d1f
SHA1 513d41627704f90b5af521a4fc1dc2e8dc61e8d6
SHA512 a61c12a06885d68bcf32d24adc368b8c4bed8f9bb9d4c69dc9ca04290638cf7bd3f443af0192d4f62166f383ca2400436f9963e5fd5dda4e4249c9913fc687ec
SSDEEP 49152:37zo2NkrkhzzXKz6relAiB0x3TOuTU/AYLsKUtUcXX0D/75gIVfRiVVAWe3W5BFM:37zbKAd60xBUF/UtU8X0pgHQm5BF0l
TLSH
T12D06F135D69C1A09CDCF83BE850C2FF2984F4FA6B054A96B7B6AB9715CE31E61F44840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 18.9MB
SHA256 92ac4503d850d61341c2b89b0ca25ae45a875f85e7ab7018354cef9a0b37bba7
MD5 ca2e152cdecfec8997a5467b9c3ce569
SHA1 abfefa098053f20577c867069ee2fa02c768c907
SHA512 7b07d200b5a5dfa88e22cc293be9f9fe0f26e3b927ca0222958c08db650590907bba852083562577b49f58edae676594ba4a1d8163bf07f102311a77694c0c8e
SSDEEP 393216:YD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5o:rGD+l8VmuZ/S24/junfSFwUqYg4z
TLSH
T18B17E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\AlternateServices.bin
Size 12KB
SHA256 9deb39fd620a20475e8ba46d5679659f342c39fc53c1cb0db60619522db2f1a3
MD5 3f686003426fae6aa9b2c98ac0380303
SHA1 97ac3f6572e91b153e980e7773f628f9c23e2bde
SHA512 917cec1ef699387036ff8cdf299091d6a3e4a2c70da4362b8465ba7df22aa7e0cfc66420bef18060633f419134ca9f7c16e71b8f538c3edaf0e491f18f379ff3
SSDEEP 24:dTuhMZ4+lzlmA91el9B5Y9xKvMlvsSx9VvYfN9FdI5q9F55A5Od9lh:dK4wKUP7Sms9DBYPDyI56OXX
TLSH
T1704287F76B7564B2F0928FB09059728C9C33072925BC95C4CB54C0F702E6AD9D17EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\AlternateServices.bin
Size 30KB
SHA256 63c6b2f4115bfde093410a38053657ebba11cc0bc1bd107b65b4c8b05087fd84
MD5 fc0797b716fa9351b08b6b7b9789f431
SHA1 2a0a8d07a4e50b438e913588189285f33649dbce
SHA512 1e30d40540974b0a638f957cd7fb28774172807b1669e0fb0f2f4b805362d21aa632a75329d9568269c56c7f5f448ad4f003defb9eed7757f1d5a11c29f17702
SSDEEP 96:dK4/I7XSmATBOWItI569KU2CCgM/pWw+FtPD1JNe6JtlPQsnmEPbEbEntEGI6yMU:3gQmoszIgg
TLSH
T10CD298E76F71A873F0528FB044A9759CDC33062928A891D4DB58D0E703E1BA5E17EB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 efb5a5ee5001905e0b8ad92a131589a495baf64634641482035c55564e656d8f
MD5 bea0a1f90c779f6b57b334e42caa9c00
SHA1 961ce26ca4f9b63c55d1d708c9296397567f05d1
SHA512 8bb60f4fde81992c41a44dacaca832a4fde19d6e2f40f39434e04de493cc958a8c559c1e53b89c15e7089ce3ffeeca96b78af961475ad34e0203f23296d44655
SSDEEP 768:kryP9Xin2ofEN+HGcmhuGVwKPZRKDb2bkFP/:4n2ofEsqVwHd
TLSH
T129D20044FB2A963FD41512BBDCA547002F79B88A98192F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 112127b9cbb16edd1dd57b6fe7144a2007965add1ef196fe7fea6f4d9dea6134
MD5 1dfc9ccde462251584ce1e261bfae149
SHA1 0c6d04008f751669f41e40098986eae6c8414c30
SHA512 c0e29fd28ae2c29e9b040c3c2b39275e59704d84c7395932ef4098f29e153912a7780700b06a7e22cbe209d469f62e750dc65b314379b82937873b53b54d2b2e
SSDEEP 768:hPnryP9Xin2ofEN+HGcmhuGVwKPZRKDb2bk:7n2ofEsqVwH
TLSH
T15ED20044FB2A963FD41512BBDCA547002F79B88A98192F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 e02746688bab72e924194d0c844c959a93b5b73b578d257941fb1c471b9f740c
MD5 71a9d5c6347fa0ac02cd80c276beece9
SHA1 cd7d4df4cbf128e823ebfa0018f4e28962425bdc
SHA512 cb5f58b2e1932224120dc5044cbdf4262dd152c922564b27ceda1ae394790a7eb491093ddd3a64da9b893bffd2f50cfdee98fd6d20a99780e5a1c54e25c24430
SSDEEP 768:en2ofEN+HGcmhuGVwKPZRKDb2bkgryP9XNP/:en2ofEsqVwHf
TLSH
T193D20044FB2A963FD41512BBDCA547002F79B88A98192F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 45KB
SHA256 2d58e59346efb94861dde4b9dd6ce3a20d041eb6dc0a6575a921e4e3883761bd
MD5 b82e1d91bef918ebf0030fba3e6a5886
SHA1 c78bf6dbf2810aab2f2ad702e0ca382b31bd8c48
SHA512 5e5804ee6ce594b3caa7ab915ebcaddd0e6ed9db8e9a782311a77cf7af7930e9051baff9543d189fe74ca72cac4a8e9853b3bd44c90a55cc7089ca0454d5cbdc
SSDEEP 768:drV3PL9IDZg5zF6GcmhuBg66Ki3Qi7ECZ8izcbrbPbpbfbtblbIb8bceBNIyplbI:drV3PL9IDZg1Wg66jeBNIyplbLOsq
TLSH
T10523F044EB1A953FD86812BADCA607003F38F889591A2F57365C64786C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 65217d69c9285f5fbb75388f9542ac144c4523d38395ef77637f2264d6688bab
MD5 2d343b3ede0053a5aceac0a09914166a
SHA1 53bda6ced6fbc6bcfa3865bf6deb9b1691a49715
SHA512 235485cd4389a8b0f816c3745cb7cf19742c958c21ed55f2ed4ec89979bf2959222a907c6737218f53756fa496d8688e1778de4884d599666111f2c304fd44ea
SSDEEP 192:NrhOv5zboA7ZpI9yjaDym11d66Joz1zgCl6mc0dz:Nr+bomZpI9yja5d66Joz1zgC1jd
TLSH
T139E10E65EA28863BC418437BCDA61F404F36399BD84E7F19359C641C2C5A2DE3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ba18ae5c179933a247165c90cb6ee8154c4b6c9e09deff99fda5fe53282bb00e
MD5 9f65d2471659da018d5bea795a495284
SHA1 33e8d7d34ddeb4795e2f15086bb50b1fc2a9b0c0
SHA512 9006d91811f28f3766d0a5347caf9ac9c28d02d9464ef2df3a2cf17f032acadb9295d833c87387351dc4a4d9d8a526b13954cb383c68377f273149c093cc2ec8
SSDEEP 192:F11d66Joz1zgCl6mc0dDrhOv5zboBbpI9yjaDyL:dd66Joz1zgC1jxr+boBbpI9yjaG
TLSH
T1AED10D65EA38463BC408433BCCA51F404F36399BE84E7F19359D65482C5A2EE3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 239b59619c098f5b137c10c3b8db7b00686a63a53f3f333a0afe806ba63c6842
MD5 ccd7023c0c8d4b4bf4239bda03bfc6ee
SHA1 39df80e73bc061ba65b92e029aef95c17a7bfdd4
SHA512 26305baf950f8e38ea20dbc9864f6eaba8f7a0db4cb8e56e8d97ebf58e7d36420f5094fd1659694d9b44fe31a4ecdb82a4a37e826a21c9a6e810cceef7abaf3e
TLSH
T1AF21979C3DB84DBAA9C7E2AC7441028E53504A0338C71C938E02DF8ECDC5AD972AE538
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\events\events
Size 5KB
SHA256 977a8b8e0e30213578fb82a6131f2d0f9e37feeac0f6031c1eb8756d4d11da84
MD5 c5af6c3aa38d6e6163d526665265e40e
SHA1 933defe81353ae14d098bab3b1a7ad6a172b778f
SHA512 eabb3427265bdd17d3fb3afe1cc818b97221d383867e9c8eb6617a95cd197df67040e6927d6fdf3a80054e678c50bb52244c8e870042f4fb3b3ba005adabfc45
SSDEEP 96:62g+V3EqxH6hEHW2UcAxMDaXmk4GUJFF40:6QBEAahE22Gz8NJ
TLSH
T14CB1021D29B90CFF6DD7D2A8B441028E43894702E4C71D878CE6DE4ECC9A699335F579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

042a2118-ebf2-40e6-8f01-e745266b3ddb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\042a2118-ebf2-40e6-8f01-e745266b3ddb
Size 235B
SHA256 ff18fe35325259bb135b095f0ee0c3f4721f9096ef3971ad40fe98f3c3af3fcc
MD5 75aeb30150326b70ce8937874f442df7
SHA1 b7a923e0ecafd93c5df030bd420c595dffbf6b06
SHA512 f93104bbebdc6df9e6dd657cf22b32aa810fabfc0ab203cd046b66375ccb4fd7898cbb0c9defd51959742457bad1ff3f991070c46fa41897449f4376c5a2e923
TLSH
T14ED097C178CC37AC08140F12B0E168C770468C33A4B6B820DAA14638AAFDACA0252817
MD5 SHA1 SHA512 TLSH

Submit Download

2c71be52-3829-4456-81fd-df6352d1094f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\2c71be52-3829-4456-81fd-df6352d1094f
Size 886B
SHA256 ac317dea130c6bb3a0b7c1f6bbc36b3350ccc760249397c0c30d237b216f3bc9
MD5 0fe8ece1bdd0eca5747f3b654281caca
SHA1 fa3bd3e9f3db5c8366ff8d9e6b9dfbbf4214a0ec
SHA512 bfb8d234293d6ad5658fa21447b8663072bd819fd6f63cb9983bff9da5478a80ce085e90e6c67f4261fc6d8815c57ca055581ba04c680a2a567d10502c146902
TLSH
T1EC1123419934BAB3CC78D28785E1B7428FD07923C0C65A187E689E184CAF12FA3A6707
MD5 SHA1 SHA512 TLSH

Submit Download

39847b8f-bcc6-4057-a8d6-1e832fb99dbd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\39847b8f-bcc6-4057-a8d6-1e832fb99dbd
Size 2KB
SHA256 8a7d36a5b272b4e5ea725cad48c01e07beb7a3dfb8eb0563b78ce681b5f2c4bb
MD5 e8d0bc5bb6b6ac90ceb59247f4f06ef8
SHA1 8d24059ff48a1289f89e3385a1f74a8beb8849f6
SHA512 f3036fe211459703f4b6d582b0ebd57162967f2a82fda3e868d885237839f508792c01365699be0df01ea7f5b21686c21beafb645339f235b14a171d9a6b7beb
TLSH
T1EC41231C79785CB78CE6E18D9496234E57908F5740C668832D61DF0C8CDA6AA336F53A
MD5 SHA1 SHA512 TLSH

Submit Download

c2c67e20-b281-40ab-9ee5-2dfd4acc59de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\c2c67e20-b281-40ab-9ee5-2dfd4acc59de
Size 235B
SHA256 eb6c824fdda1ce97fa67a6ed302c43ecd076a28d44498173710421c162b1c756
MD5 a7f9f40fe8648f841ad257f1cf2f54e0
SHA1 8df68efda4d1e55a7b844b8db8aa25624d3a9004
SHA512 15b5d3cd6e36d243c9bc147585bd91efa23c7aebe7445d544e54d12b50b09434cbf03876149672b4b82598d4d00bfe355a300c1f28e922824f98094cff6eae30
TLSH
T140D097C01498A32D08000F23F0B13DCB30984C3324B0B810AA924638CAF8DC40111D3B
MD5 SHA1 SHA512 TLSH

Submit Download

ec5610c9-86e9-49a2-a27c-10290a4313c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\ec5610c9-86e9-49a2-a27c-10290a4313c3
Size 16KB
SHA256 bdbdbd5ec6dde4c17f40d912177aa8bae60c269538192b332c57a4df1015e72d
MD5 4662dcf18d8c92f1e54ceea0688a0e58
SHA1 d60f39a406adba04a503e25f3f69786d0aa02f78
SHA512 51901ddf1aed08f8c07da53f110010f8b62817aa7efcd31069cb3f4a987fb33bf1b3723553afb318ab02042389ab0be0dc77b164c8cffdb39629b8e7a76b6653
SSDEEP 192:jeNjzxRhSNeKXPj83BMjUrKeE13oYMia7u1o4hmvEK61CQLymAeoXD26fV5dG2h/:jKjlRhS8KXIijArY8y1/hmMKP8Dh4
TLSH
T10172EA56682045BA8291E3A8D4F8BFC3E5F528CF4C419FCAD7E47D0869DE0AE1127947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3b2b476-6114-45a4-8734-bc3a53ab434b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\f3b2b476-6114-45a4-8734-bc3a53ab434b
Size 9KB
SHA256 a9b54bd5ce118d162a1de4f02c6b1c5d0cc99092be40b060b28aac94907c828e
MD5 935cee3cfec8e1fad998188be5ecc4d3
SHA1 c60aca7a3ff49a9707a865962a3a1afb542a9f0c
SHA512 13315fe7d02a1c23bac4800395f21b58555abdcc7438d378f1070accb12bbeb4dce21d235f09c6dcd5d453e65bb1c604f8d02416c8890651cfe1404894a1528d
SSDEEP 192:evJupSYfpzZOpfak2SKZMdwrN0dTCd/9C:QQpSWpz0pfak2nZMdwJWTCdlC
TLSH
T15012C7FECD2240533A66E52DF1A8ADAB005A293149CCC79C6AFC4C3A36D2EB70657314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd383c82-d8c4-46a1-85af-e2d159f25114

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\fd383c82-d8c4-46a1-85af-e2d159f25114
Size 883B
SHA256 24084302643c01162a4c72023fe9a863990f839f5002abc0b59c30ece61bde74
MD5 122e93740d9c3ba49d588edf45f04ac8
SHA1 89df06aac6f8905d39a9cb3d7f2ec9bb06762812
SHA512 37fdca19873d7b460b1afbbdc80896741ee10c9e4cc33269cf36eaa3172fccf34b281201160f5cab9454f965a2f1f85bad8e41d2f405f924f8b595aec1b42fef
TLSH
T1FA11E341A53079B3CC7CC24B85A1BB424FE47527C0C695183DF45E180C7E52EA7A6757
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\extensions.json
Size 16KB
SHA256 af713a02342192b7639bf7be480beae896bc8f5ec8e72323677bcb603970119c
MD5 189eb80cb31aaf08628a9a739228f9ca
SHA1 84e7edb965586dca92b10cca8ea97184e12a841b
SHA512 ab06f7aba7985e8a8ed8002e5c575aebc1805d4b6a71566db861f3264a588867290246c7c4e9522590726bd582da2bb32515ef598e9a723727a5f8407d6b1ae9
SSDEEP 384:ZIkI4vOUmldvf8dhWA94zc96oSKL4H9L4PRUL4H2TL4HPFL4HZhq4h5:tI42RfsXt4k6i4945O4Wf4vl45k4L
TLSH
T1E772421545049EB8298FA79AAA367E01C37D473B70845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.2934.0\LICENSE.tmp
Size 499B
SHA256 55064d7d8fecdd90ba36cebaff34f05583c183b34686b17b40b974442fc07523
MD5 d8a9bfce875f2081d41dbb18dc618b14
SHA1 5bc4e44bd455d8838fc382b5a5525aff1a117e4b
SHA512 643b0befb7244283f08188fafb2e7f96cdf82353d06ca5c0b25ad0157eabe786809677c876faf3b12888a8c3ce38e97c8090505b06c514370a16c955db3fd8ee
TLSH
T14DF09E7EBA224772459603C7011540D47B1707FAF25422D1B358C1E4276E27982FF184
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs-1.js
Size 8KB
SHA256 06f4602ea899282785f40076e8a6fc2124ce806d1143c5c10016a54e09dda118
MD5 7142aa25fe9412659ad6d9f3095b1f57
SHA1 335e7d65b5ec27c1a55f7dec4f753c5339f1400c
SHA512 ace5348661fbbdb17e7d04e15f1b573c07e29d0ae9de473852b7cb3e555052ebf234ae94f960038d9132c1294207b7a59211490b72593ec74dd146a9d4360743
SSDEEP 96:xHthTUsqGq5fz3mObzSnMSSloldv9jtnRWRwFDdcSapNBw88gv8L4cnNyyFGS:HOR5fz3mlMSSrRsRcSazBw88gQf
TLSH
T1DE021E789404CFBF74B276ACBC6448715AA2013BB6BF68D750B984C5015CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs-1.js
Size 6KB
SHA256 6837615e8a7b7bcd738f7024312c0fbdc835036d0f85aae69145c7b937967c77
MD5 4f28a2b358adbba8abcfbd608b3fcab7
SHA1 33ff4f0c43d4856a9b7a2cef663ac7f3d98b0b65
SHA512 27c74b9acdae2550a9346839570801e9b9346c3f7d1115cfe9ab2ae97e880ed23142de265533406526a032c4ddecc01bb60cbdc54de6b416a5b8ee3e8ad40252
SSDEEP 96:xHgUTUsqGq5f63m1zSnMSSloldv9jtnRHRDdcSxBw88P8L4cnNyy4:yfR5f63mOMSSeRRcSxBw88wI
TLSH
T1F3E12F7894088FBF74B676ACAC6888715AB2013BBBBF68D750B554C5014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs-1.js
Size 12KB
SHA256 f333f0fdcd59a873538da2df4e1cc6a62878f628958c30b01a589048854c3166
MD5 a04bd7b0d73cb1a1d1f4e8fea1f112d1
SHA1 6a9e397d42b1c8f7ecfee8366e5af68a392838c6
SHA512 9b681f11b62415d04c4d6d1b0bbfe06912c5c7fe8bef8a5eb1dd6fceb72fcc487bb61bcc094bde28b278c8c814c109f4471dab6a495034dc331dd6a32c70da14
SSDEEP 192:HWCR5fz3miMSSaLRsRcSacgmBw8Oe8FgfL9L:DjR0jwB+V
TLSH
T17742AB3898108FBF64B3327D7C6149E02AA14127B6BFBCD745FD8496045CF2542E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 7KB
SHA256 e5c97b05f5a9c1d20231f83eebc7901a9b6071a320d0581e66c26d94b45cc71d
MD5 246616a1b69a929b56cce1e5e49371db
SHA1 40be717f240846848904c8d442290500280d04a1
SHA512 21d45c5fec3d367a6f148f9818317c555c206524bda92caabcbe6acd623536dbdc59acc5ebabec39242f89ffc4e90624ddd30bc8c39e5c95d36e451550c7e0f8
SSDEEP 96:xHgUTUsqGq5f63mObzSnMSSloldv9jtnRHRDdcSxBw88P8L4cnNyyFGS:yfR5f63mlMSSeRRcSxBw88wf
TLSH
T16BE1207894188FBF74B676ACAC6888715AB2013BBBBF68D350B554C5014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 6KB
SHA256 4913b88b094ca956c480c94132830c132e6360bc438e5744e1ca24692bb7b2c4
MD5 c185de08684caa884495f828a2015c90
SHA1 73c8bc13eed19482d4816c02813958643a3fc25d
SHA512 001711a7f8ae95d380fdcd60db4518f7810c417ff2974f4e7002e145a69773bf91a7ab750b48d59dbfedc7a6d4806bbe12d3f24b3f5b0815075945a1c63fee88
SSDEEP 96:xHgUTUsqGq5f6v71zSnMSSloldv9j3nRHRDdcSxBw88P8L4cnNyy4:yfR5f6v7OMSS0RRcSxBw88wI
TLSH
T128E1207894088FBF74B676ACAC6888715AB2013B7BBF68D750B554C5010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 99f7ec149dab932779925f835b548c1bb8b6528f1618fea5f208796b8b53d0cb
MD5 e2ceae12c26ae200a69f1161bed987e9
SHA1 896abbe9eb93bdbc3fb65d395a595c32f5443463
SHA512 0142abe9bb9a15dc2ee968bd2f5fae4dc8a7e18089a7c78283cb2c77b23a751b139c228479a5977b0d4c031813e20094d5ac6720cd5116a7213895b84d79a007
TLSH
T1F12119837E7A48F84331811BC1CFE6E8DA8539328F9920C1D97815438198967338C18A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 8cffe99d03ee2379c2564ff3855a0ca9d2202f014649139d7bfe1337a2f0b297
MD5 925358dddc051912cc72145deda9b91e
SHA1 692750d44091c55faf17228c101c4b2aefb00bfe
SHA512 f0defcd23405a97145f8b4ef54cedb0921a5bfdda2aee284be40456a53d74ff39c8fed69b05b9f87750a7265229880d48f8f1bb70b2341107623f40216671a63
SSDEEP 192:XeQtQ9orcA4T1KJf7F/VfX6L2Nn+EFWCQBCWkJNi0v/43snHXxAP16y2FrHV:XeQtQCrf4oF9I2B+EWCQBCWeNpgOHFHV
TLSH
T11D32D01FE67379FAD67CD6A488968FDC488264034BF642074D2D6F3A72D6B0CE108079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 e113304ba33b312f6059f8a88d79444d498b47dfc7c478219060c9324e3a2212
MD5 42954b5a56a498e12222f0b816c4ed4d
SHA1 cdfed1582c5ebf3da619c90f568b19c805180732
SHA512 c7eca45b87c7410f2542c4471638b80732c4fe1aab97075abdaeb0ca6cfdfb459e36456de0775c3dd72a1f767747d813cf9e5193049e686a7bf0e7cd84f17319
TLSH
T178716DB70D2B29FA7135C066DCAF4FC58A82241049EA9066F928DA6391EC655610CD9F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 750f94c24beccd2055ea3a8abf70ec3b4ceae346c039386e9a09e64669fdb9e6
MD5 1653553772477c1de05d0f5f7d84b306
SHA1 2e78e44aedd0e28d31808bf91e4447ef6e65dce4
SHA512 7d2bb59b8baf220a1cf3187ce2e4d68c6f021d7342dae6713fe95fcadb3cc2d2aae0d6ef8d07c6c5ca9c7738f37398f39632a81b998496031687e30c86645173
TLSH
T1CC21C8623CB3EEFEBA72900790DAA7FEA5C87C1255E854D0E05D5D11D1482AA731D289
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 12.8MB
SHA256 fa542823d2199712ff2817bb8855ef5d4841fa3175b8c6d2e47929220d00b391
MD5 3e5942475a753b32b8f044b46fdccda4
SHA1 ff11e152c3e7e79f2fd7263afdaa365c3cf10260
SHA512 6d12166b6301a7de1f1c0216eaac3a9079360b577b5734b2d134f32f3222dd7627b65e574ec1edd0fa0dba88d37441eea5bf022469b0591709ebf3340ade92ad
SSDEEP 49152:YTZFVcyjRBK6sSqcspYgQRzteBgBR9b63YbU+8BLQxzC60YmoHq6KmpXUHR8aQcx:SnV/jRBK6sSfdRzteBgBihC0Y
TLSH
T15FD6399270E1D6A1EE0086F2B31F53EB313FC1DC20E589941678B56C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4236-2-0x0000026D45D00000-0x0000026D45F70000-memory.dmp

Download

memory/4236-11-0x0000026D45CE0000-0x0000026D45CE1000-memory.dmp

Download

memory/4236-12-0x0000026D45D00000-0x0000026D45F70000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads