a2d919bace9e69e8410f111ce98658b12e4eefecb578ac73c106fe617d59633e

Analysis

max time kernel
299s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/05/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8.gif
Size 240KB
Sample260518-xmmsgacs6x
SHA256 a2d919bace9e69e8410f111ce98658b12e4eefecb578ac73c106fe617d59633e
MD5 553f503a09bd7abb41be0db41bcf2ac5
SHA1 ef0dcd0719d10bd084b1c1fc0c9e6c5527c6c86a
SHA512 4c27520802e26d9c4cd7b2848c7f43931e1073f4d223ab8e0f4b294c72fef4cc8c750774beb121c714cdbec33db1e348c76e3cbd1516d6a8ce2112288d9585a1
SSDEEP 6144:7lCJ1GP9DUX0e0Wr+Jl2johwQAtGt6RjjJSD6Ws0gO/o:EYP+X0e0W8lK6DArHJms0D/o
TLSH
T15E3423368A122D195765488C6D32A5E8E5F2388151778BF6CC0ACC5B12E90F37EDA7F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3108	firefox.exe
Token: SeDebugPrivilege	3108	firefox.exe
Token: SeDebugPrivilege	3108	firefox.exe
Token: SeDebugPrivilege	3108	firefox.exe
Token: SeDebugPrivilege	3108	firefox.exe
Token: SeDebugPrivilege	3108	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3108	firefox.exe
3108	firefox.exe
3108	firefox.exe
3108	firefox.exe
3108	firefox.exe
3108	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3108	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3108	3788	firefox.exe	88
PID 3788 wrote to memory of 3108	3788	firefox.exe	88
PID 3108 wrote to memory of 1872	3108	firefox.exe	89
PID 3108 wrote to memory of 1872	3108	firefox.exe	89
PID 3108 wrote to memory of 1872	3108	firefox.exe	89
PID 3108 wrote to memory of 2132	3108	firefox.exe	90
PID 3108 wrote to memory of 2132	3108	firefox.exe	90
PID 3108 wrote to memory of 2132	3108	firefox.exe	90
PID 3108 wrote to memory of 2132	3108	firefox.exe	90
PID 3108 wrote to memory of 4544	3108	firefox.exe	91
PID 3108 wrote to memory of 4544	3108	firefox.exe	91
PID 3108 wrote to memory of 4544	3108	firefox.exe	91
PID 3108 wrote to memory of 4544	3108	firefox.exe	91
PID 3108 wrote to memory of 4724	3108	firefox.exe	92
PID 3108 wrote to memory of 4724	3108	firefox.exe	92
PID 3108 wrote to memory of 4724	3108	firefox.exe	92
PID 3108 wrote to memory of 3044	3108	firefox.exe	93
PID 3108 wrote to memory of 3044	3108	firefox.exe	93
PID 3108 wrote to memory of 3044	3108	firefox.exe	93
PID 3108 wrote to memory of 3044	3108	firefox.exe	93
PID 3108 wrote to memory of 1620	3108	firefox.exe	94
PID 3108 wrote to memory of 1620	3108	firefox.exe	94
PID 3108 wrote to memory of 1620	3108	firefox.exe	94
PID 3108 wrote to memory of 1620	3108	firefox.exe	94
PID 3108 wrote to memory of 5100	3108	firefox.exe	95
PID 3108 wrote to memory of 5100	3108	firefox.exe	95
PID 3108 wrote to memory of 5100	3108	firefox.exe	95
PID 3108 wrote to memory of 5100	3108	firefox.exe	95
PID 3108 wrote to memory of 3492	3108	firefox.exe	96
PID 3108 wrote to memory of 3492	3108	firefox.exe	96
PID 3108 wrote to memory of 3492	3108	firefox.exe	96
PID 3108 wrote to memory of 3492	3108	firefox.exe	96
PID 3108 wrote to memory of 536	3108	firefox.exe	97
PID 3108 wrote to memory of 536	3108	firefox.exe	97
PID 3108 wrote to memory of 536	3108	firefox.exe	97
PID 3108 wrote to memory of 536	3108	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\8.gif"
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\8.gif
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27099 -prefMapHandle 2036 -prefMapSize 270279 -ipcHandle 2112 -initialChannelId {3549b2a9-57aa-4614-9e9d-8ffcafdbe915} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2512 -prefsLen 27135 -prefMapHandle 2516 -prefMapSize 270279 -ipcHandle 2524 -initialChannelId {df9076eb-9e3f-4bbe-abaa-e57ce8c8e8d4} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27276 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {845df631-cba3-42d1-9748-db229bbc8b78} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27276 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 4004 -initialChannelId {b500bdcf-6d5e-44c5-b055-c48bf65a32e2} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4364 -prefsLen 34775 -prefMapHandle 4368 -prefMapSize 270279 -jsInitHandle 4372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4380 -initialChannelId {4c60a3c5-2d8e-4e08-8b3e-a89f35802506} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4908 -prefsLen 35012 -prefMapHandle 4904 -prefMapSize 270279 -ipcHandle 4248 -initialChannelId {74b69222-b265-4e28-ade4-a886c6afd618} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5032 -prefsLen 32900 -prefMapHandle 5036 -prefMapSize 270279 -jsInitHandle 5040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5048 -initialChannelId {9b550c0c-3d28-464f-b3d9-8a6e161ece22} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32900 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {939eaddb-e3f7-4193-9b1e-738cb21194d3} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412 -prefsLen 32900 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {0d030c47-fa98-4b0f-bf4c-18948d4646bc} -parentPid 3108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 34925a1b953f3d3e7c4262ffe565023de226f6f69fe5f5465dd6782348085932
MD5 cb4feef4f7b21eedeeab1cb3ae6f5ba4
SHA1 0d76fc288cf5a1d6c937585ac78631d40dd6aaaf
SHA512 a354ba71c489af6b04d4261dd404b7baf19f4316ffa254d0a8a5ca270c6af49226421160c3a875b9126c41b9917cdf921c138193dda1da1bd983da72a7655e0f
SSDEEP 384:HUr7iO024Yyo6J+Sl1xDnZBPsac4j0lpDII+s3IN3I/:0SZYyo0+Sl7zZlsac4ID8L2
TLSH
T17B528DB99F0138B92A23C594E9BD9344CD05A6BFDEE2D16209143C04CA847B9F4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 cb7921089e0635f1e8a1597fabd4b585d663b7503597439e93bdf0bd4082d3dd
MD5 fb2ee2505a1a44a0106988f84f3ff64c
SHA1 721bbcd0f9dac3ecf62179b678dd0d7a9eab6460
SHA512 a33c54f94c85222e7b87338d20170fd92676de26431740d6f1990022af59505371fa349cc1dc6dcfbbcb2bd771f8cf16eac83eb7aa5d0946338bddfefea69442
SSDEEP 384:HHMO0iO024YEo6J+Sl1xDnZBPsac4j0lpDII+JquPG:nrZYEo0+Sl7zZlsac4ID8L+
TLSH
T17F528DBD9F0138A91A27D1D4E9BE9205CE08B6BBDFD280561A543C01CA487B9F4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EGIHGLLL2HW1UIBIE00K.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EGIHGLLL2HW1UIBIE00K.temp
Size 7KB
SHA256 bf347214be5603ea3aeef25ad70af2c12ed619b2e3564ea542d9bb0b91115cef
MD5 1f1c50466c4ea4cbb4e3f92941bf10cd
SHA1 f6c1d4576d16fbfc30025507aa01936526dd09cb
SHA512 af0c755dcdbefc08582d35a39fa7ce3e9f58436583ce4b3e6b552ad368b96650cf6c0173ff16fabe943e70f8f84e53619ede3dd86245207f8cf42db74937e6ec
SSDEEP 48:zJtydZJ5UgdwbAzIJ4ydZJ/6Bdwb4IJmydZJ/adwb6BaJfydZJVaMCi+SidwbNXE:z3OEJ6O/jvUO/TdlOVau9rhE
TLSH
T1C4F1EF024BFB1E55F5F382357A312B12A7B3FD001A1B527EC181F28849B27A0856DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 55aadb4fcca09a807215a4aed63659ca003ee871ad0e060e5f00bdecf22e16d3
MD5 cef16c764377b00ae2da177b6fc6b2d9
SHA1 bfabc6b2cabc5068d4332feb1a9376b361e1f36a
SHA512 805edd2b1e311f61088f8a0ea6a64eb2d3dc09b13dd45cf1b4e5b730343153c06206bf6724cd0ea67fe8af0ec07ff2f342ef8121c2767afcaf402b81dc3d23bc
SSDEEP 384:e9d66JozGzgC1j9boasbOcyjbFCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3b:pEv3KsFpoGcmhuTsRptLiuFbybTbEbr
TLSH
T121D2F144FB2E953FD42912BBDCA50B002F79B88959192F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 9503d2bdd6c19d467c7d92804b8303d1db880e2af3f96d72b9a5a32d3c088b11
MD5 8d7f7375f576d6e97955dce1e88bd736
SHA1 5dfe0d7336ab8db1b0770160c043cfcb435c0617
SHA512 95f2283a5ae4367e4f61894d35421c920a4657727e4f7569b7fd0d4c40af445de7714ca41c808fd46dc5e8385a6adce8ece24dc2f21756c881ab27a91ecf709c
SSDEEP 384:ibodFCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3bOe/66JozGzgC1jd:GaFpoGcmhuTsRptLiuFbybTbEbryE/
TLSH
T1E9B2FF84EB1E953FD42912BADCA547002F78F88959192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 6656be429bb9ebcc37e85fc9846c5cf62b55cd8cc0a5af4d11bd41a11c15365e
MD5 9a5c5facfecc48719f922484def30c3f
SHA1 99d8870f798c9499061d483363e2a079f5a5ca98
SHA512 fe4e749d2a63d4fb1cd6fa2c662e25818648e0b7641211e81040c84724f071dfe4cb5fdd89775126b36f076796008c9a74a9e869bac4703bc9a6722b8ebd1d34
SSDEEP 384:e9d66JozGzgC1j1boVsZOcyjSFCksE1rHSBGcmhuV5X5+RptLiuFbybTbEb3b:pE3soNFpoGcmhuTsRptLiuFbybTbEbr
TLSH
T11ED2F184EB1E953FD42812BBDCA51B001F79BC8959092F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9c7422f5ef1e5815602d4771dbcb52495706cc0ac456ad32d3567e976ba44b4b
MD5 0aade3409588c3b1f33733454cbaabeb
SHA1 7d07bf39572f0a21141e9343440c1c2bca7b16ad
SHA512 9fcbdc4679b4f79802fdd33465d28141fd9867ec3008990802f93a2b733bd0bc002488532b15d799d58fc95070e09f0a8f19a8388638bcd1755ad73382ad66dc
TLSH
T1B321A96C3BF84D2AACC7F25DB440028E9B958E0224C71D430D52DE8DCCC5AE9716B439
MD5 SHA1 SHA512 TLSH

Submit Download

18f50bcb-6a81-48d7-863b-1decafdffc7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\18f50bcb-6a81-48d7-863b-1decafdffc7a
Size 886B
SHA256 5a74dcc32b7e5943d15850e7dd3c3955f0e40b68dc4d9373661d11830ed9b2d8
MD5 7ce73be0453f99d781d415e773102e7c
SHA1 2d956eebc4f22c6b85130aa66e964dbb69d055b4
SHA512 65b74e822f009c7985388df287d95c6504e6dcee5b8e303e919cd4aa4af58fdc71abefbcd235de051e9dfbd212ac362596f1057858c24c068d423b79206b816f
TLSH
T1C51100409679B9738C78E2C796D07B464FE43423C0C659043E918E180EEA129E39660B
MD5 SHA1 SHA512 TLSH

Submit Download

1e6a19df-b568-4493-b490-5ab680c1f2ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\1e6a19df-b568-4493-b490-5ab680c1f2ad
Size 235B
SHA256 55ede7549080fdb3b3e15d5284d80c99a8074650637c2a55ce03fa03cba121de
MD5 189d92eb1728c9cc77a683d30c918904
SHA1 34cfab2f2e553d3c028c8b22ef9d7a18672d6628
SHA512 44edde25bd73500f777889ca61bb4f159c359c5bdc8e30de4f16163f8c419b916dbd3beb82e18abcee60937d6ebdac01312144b25c7b001da7b29266c9350c12
TLSH
T1F8D0978014D8A79F08241F02F6A02EC3B0854C3315749860C9A0027589FDEC8922282A
MD5 SHA1 SHA512 TLSH

Submit Download

85472ddd-ebcf-4d87-8edd-78b34148b97c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\85472ddd-ebcf-4d87-8edd-78b34148b97c
Size 2KB
SHA256 92a60b704e721ccf4951cd503d0e5bae4efefaa641a52b75a60bc9ce4540be9e
MD5 7c7c21e746293e16f191f095e3f801a8
SHA1 646390fa24d8ded65d3144673bb0a0d570077471
SHA512 47205a852eb3088f0cd0ee92a0855f0acab2ca9ff59865f05a8b9c43b58f0cb6a77288a404d9150c0a29b7b64766ca8b7261c37d3b942f530a27d8d9750c03f4
TLSH
T10741335C3A784CB78CABF59DD482338E47644A0340C258572D51DE0D8C9A69A736F43B
MD5 SHA1 SHA512 TLSH

Submit Download

85745f07-8b4a-4761-96d3-8e2da9a76ce7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\85745f07-8b4a-4761-96d3-8e2da9a76ce7
Size 235B
SHA256 43d2cdccae4abd943f5cebba2f449158b65035623562a5c0b9cf7b9c4dc7918c
MD5 dc1197b30588cce9446507e38739c478
SHA1 6675dd611c2abe21989b2ec5b5b69d6a68d2567e
SHA512 b9a065fcfb4b6b35b387bb5a97a5a339008188e42d79695bed22078b73c7a0dd235ad34d057581c71413c1d7ad3cc626343a0be21f36f32b7383f14446999100
TLSH
T1C5D097C4389CA36D0C200F06B0E068CA70894C3311A0A850C6A0417899BDAC4819189B
MD5 SHA1 SHA512 TLSH

Submit Download

df220355-1d75-4430-8a8b-106b810626c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\df220355-1d75-4430-8a8b-106b810626c3
Size 871B
SHA256 bec50c56ef004cebe01de23052fc85d481999c89afac8abe7eb17ab9193cae5b
MD5 f8b2dc101f2158b694493f60813bca30
SHA1 8a95ec268689b854c2ebfb43eed7d252c65f1c05
SHA512 c886d2dd19640b16e0c858863a51beb872c4263eccc6ffbc2bb0df6c5d63fc74b63664d2dd6e5bb8e2a5c497d95cacc381dd0f0962a2eda9dfed41313ca2349d
TLSH
T18811E381E639B9A38C78D34B89557B028FE4356380C994143D909D140EBE52AE3A960B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
Size 16KB
SHA256 f4abd93b30cb9a642d9ae06be92e9befff2785cf48431bba53d9c6e28b0fec2d
MD5 0447357d0268bc76d741bafcdfb24ab5
SHA1 a76ca152de53b74945735f74bf4f2da419f799d7
SHA512 815604cc6c9cd8fc67bd0e5ade6df7ce22a21bc6a2821e9639309451240444e6d8a0849783df28b69cd80e8229de3f3c6759123998acef9bf3b238fcdc1a9715
SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4HEG4h1:PI4LRfJXF4F6Z4y4U4f424r4L
TLSH
T1BE72421545049EB8294EA79BAA36BE01C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 8KB
SHA256 539713f95729c9b84f134af9c1cac02e588add0846ac4b58c85a09c595e99472
MD5 3ebb408c1f0e6454390226984561d516
SHA1 1e359f4b05891cec735078bceefb7ea862f062a3
SHA512 3e5a0b86efcf41f1810e7df5790b6b85b667cca477a4ac78fe19a6f6221b88170a2c87ea05c94f3c2236b28bf5675a872dde76aca60dcb80601859af874c42c8
SSDEEP 96:xHi1TUMqGq/fp5cObzSnSSlmdv9j4nytWRvi5AsO7HjvuBw88lQQ1x8L4cn2PU1K:UCR/fp5cdSSm4Rv9sIHzuBw88v17
TLSH
T11602FD3C9054CB7F64B2367DAC24897169A2013BB6BF68D710F98485055CF3885EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 273a9e6791b9dff78dfc77b46080b2eb231c235d5951b508bd77333d869d67e8
MD5 a620bbf5995bf8307188be83769da7c1
SHA1 c5b47d440512ee61b8c8f42733dc97cde86ff6c2
SHA512 68057770987ce42086fef5298787b8e8230594265c4e381742ba54911103e0667fe51006000cf95e4d5c117c448022dd9ee32b0f46a177bc10c36acee7e12bc3
SSDEEP 96:xHiUTUMqGq/fSrO1zS/SSlmdv9janytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrOWSSYxisIHzsBw88J
TLSH
T195E140389004CF6F64B676ACAC688C716AB2013B77BF28D710B554C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
Size 6KB
SHA256 eca24cbe065efb4249c88bca0ce7342929e012a3d880588cd2af951113912050
MD5 7d0869fcd346227fc5a075ad8aca36f1
SHA1 a711a1c4d8dff3f22124fbf4d6cc53b70d8562f8
SHA512 1047784a97a125f8530deaecb2314721618bceb2645b5634f9098dfc1d756a84cbddc0f65f7f84d668f15ac8cabbafe897fdce09acf4255dd27037694a1516f8
SSDEEP 96:xHiUTUMqGq/fS5c1zSnSSlmdv9j4nytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fS5c+SSmxisIHzsBw88J
TLSH
T178E12F789048CF7F64B676ACAC6888716AB2013BB7BF28D750B554C4055CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads