hxxps://warnungen[.]zamg[.]at/wsapp/de/alle/gesamterzeitraum/57581,238912,745081,553121

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://warnungen.zamg.at/wsapp/de/alle/gesamterzeitraum/57581,238912,745081,553121
Sample260519-vbtershw4y

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3976	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3976	560	firefox.exe	85
PID 560 wrote to memory of 3976	560	firefox.exe	85
PID 3976 wrote to memory of 3772	3976	firefox.exe	87
PID 3976 wrote to memory of 3772	3976	firefox.exe	87
PID 3976 wrote to memory of 3772	3976	firefox.exe	87
PID 3976 wrote to memory of 4660	3976	firefox.exe	89
PID 3976 wrote to memory of 4660	3976	firefox.exe	89
PID 3976 wrote to memory of 4660	3976	firefox.exe	89
PID 3976 wrote to memory of 4660	3976	firefox.exe	89
PID 3976 wrote to memory of 4656	3976	firefox.exe	91
PID 3976 wrote to memory of 4656	3976	firefox.exe	91
PID 3976 wrote to memory of 4656	3976	firefox.exe	91
PID 3976 wrote to memory of 4656	3976	firefox.exe	91
PID 3976 wrote to memory of 3092	3976	firefox.exe	92
PID 3976 wrote to memory of 3092	3976	firefox.exe	92
PID 3976 wrote to memory of 3092	3976	firefox.exe	92
PID 3976 wrote to memory of 4936	3976	firefox.exe	93
PID 3976 wrote to memory of 4936	3976	firefox.exe	93
PID 3976 wrote to memory of 4936	3976	firefox.exe	93
PID 3976 wrote to memory of 4936	3976	firefox.exe	93
PID 3976 wrote to memory of 4492	3976	firefox.exe	94
PID 3976 wrote to memory of 4492	3976	firefox.exe	94
PID 3976 wrote to memory of 4492	3976	firefox.exe	94
PID 3976 wrote to memory of 4492	3976	firefox.exe	94
PID 3976 wrote to memory of 3048	3976	firefox.exe	95
PID 3976 wrote to memory of 3048	3976	firefox.exe	95
PID 3976 wrote to memory of 3048	3976	firefox.exe	95
PID 3976 wrote to memory of 3048	3976	firefox.exe	95
PID 3976 wrote to memory of 2452	3976	firefox.exe	96
PID 3976 wrote to memory of 2452	3976	firefox.exe	96
PID 3976 wrote to memory of 2452	3976	firefox.exe	96
PID 3976 wrote to memory of 2452	3976	firefox.exe	96
PID 3976 wrote to memory of 2076	3976	firefox.exe	97
PID 3976 wrote to memory of 2076	3976	firefox.exe	97
PID 3976 wrote to memory of 2076	3976	firefox.exe	97
PID 3976 wrote to memory of 2076	3976	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://warnungen.zamg.at/wsapp/de/alle/gesamterzeitraum/57581,238912,745081,553121"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://warnungen.zamg.at/wsapp/de/alle/gesamterzeitraum/57581,238912,745081,553121
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {27313705-f419-4b03-80d4-288ca37cb407} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2492 -prefsLen 27135 -prefMapHandle 2496 -prefMapSize 270279 -ipcHandle 2504 -initialChannelId {84230f3e-3b0a-4f84-a471-bcc942b94f9d} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 25164 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {dd3d6632-d102-4e4c-968e-25b967248332} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3900 -prefsLen 27276 -prefMapHandle 3904 -prefMapSize 270279 -ipcHandle 3972 -initialChannelId {f61bb897-f247-48f9-a49f-bbe285d7eda3} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4312 -prefsLen 34775 -prefMapHandle 4316 -prefMapSize 270279 -jsInitHandle 4320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3144 -initialChannelId {a4fa3591-23f3-46cf-ac36-3e3320b5e848} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4928 -initialChannelId {b6a8e7ef-ff09-4416-bdb7-1c917a654360} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 32952 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {67e5861d-155c-4800-9cd2-1f36a842cecd} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32952 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {6b24fb25-ab59-44a8-9f38-83e6861b0ae3} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {f509b934-7912-463e-9232-639894f1402e} -parentPid 3976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 c4b60b75fa13ec0556c3f287751bb89ff2997baff200ef79308674180732d6e0
MD5 85cb8b870705c77d539ea234949f538c
SHA1 efe96490ec11c7c643d17a268dc7af99320010cd
SHA512 398a05300c7f10ec46f632227278896e7723b548a400f6c3428b645c068b43fca442b20a9f412348b0c3d8a7733d75cf12fdfcad952572c9172453ad585eba64
SSDEEP 384:HUr7iO024Yj1o6J+Sl1xDnZBPsac4j0lpDII+y3Y33YL:0SZYho0+Sl7zZlsac4ID8LE
TLSH
T1CD528DBD9F0138B92A27C494E9BE92448D04A6BFDEE2D16709143C04CA447B9F0E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 43e0dc172459213136bf3936f633247d9ff2d7a6035b540ad8d9d4dc6eed8979
MD5 061cd4ea4c1c9bb3fb5f37cbb173f252
SHA1 6cfb242e04fde63b7f888757648a1022dceb7687
SHA512 581c0e41e22bb13a603ade0bdae568ab3cb04bb4eb791d069090fa3630a06f0dff8fa64d73f9ef9eb0028f2f0537bbe026916244cec809e15697ad9b5aaebd87
SSDEEP 384:HHMO0iO024YNo6J+Sl1xDnZBPsac4j0lpDII+mq5h2:nrZYNo0+Sl7zZlsac4ID8L8
TLSH
T157529DBD9F123CA91A27D5D4E9BD9205CD04B6BBDFE280661A143800CA447F8F4E64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 0c8a71600c5adcc53f4226c794b6e3114f7a6d9eff2859e7e2d2446c21bf8d96
MD5 17c4c376b3528c688f40dc225c07c99e
SHA1 a36e3e889b8700d73aa53b2068b917dc4c170eaa
SHA512 97db05f569f76def064970efbd6b513b4a59b4ba1faaffaa028db14e4b2398ce84f5303f3b272047fe4ca77688118e38bbc209be6e0433d1fadd71d3cf996cdc
SSDEEP 768:/EQUOtmkUGcmhu0RM3bEvgbgb+bYbnppu:XUOtmQnG
TLSH
T1D5D2F044EB2A953FD41812BBDCA507002F79B88999192FA73B4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 1fdf454bd1413e3466f7886890077a1706306eb96c16ebe5f1896e4786c7219e
MD5 e682382986051a834a062fdea4d1881b
SHA1 0aa710f8639688458b17399edd29c0d1bb9bc76b
SHA512 fd6c6a358d9757414cc44864d5b9bb224dc820328f54fe2ce1adbbc8de6f7bcd2adfb6501451561ceb32c85a552166c292995a3c5b9d2634dc19821873e33f07
SSDEEP 768:XUOtmkUGcmhu0RM3bEvgbgb+bYbnhgyE/:XUOtmQnU
TLSH
T192D20184EB1A953FD41813BBDCA50B002F79B88999192F673A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6326749fdf85f347e27278f543dee7ed035da8a912d66a7bfd18bb2146781f9e
MD5 90cf87cfebfb8be2cbc9a876b4d36a50
SHA1 184dc83296de9ad99327ce09f0bb49e4e362d5ea
SHA512 d821cd875b63d059bf9f7c829818ad92016b51db3dccf9a1b3b9a52a6bc91bdc1a53af1cebf00647ccbd7d0461f1aadb3b2818f144fab955260d66464aae7b74
TLSH
T1C821675C39F84D6AAA97F2AD7880018E5B948B07148B1E434D02DF8CDDD9AD9726A43D
MD5 SHA1 SHA512 TLSH

Submit Download

1c72bc2a-4643-4763-839a-e501dc44124d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\1c72bc2a-4643-4763-839a-e501dc44124d
Size 235B
SHA256 3bf18908820237385042958a4a917207ec650add92646298c8951a89c825aaa7
MD5 bcb437e736d7ebbdb984f7763e738de2
SHA1 e934a219a327b12acd0f324a7ca8417de6bcfa20
SHA512 8dbcc0490e7add20d1fb3d603e586a5e44c6f36a7ca3905a4ed5275542f29dfce7cd9d647cf10be0e95e816f2756afc68c0a4135a98b664badf47a53991d98ca
TLSH
T1D7D097C42498675D0C100F07B4A129CAB1848C3314706810C9A10A7489BCAC452A1817
MD5 SHA1 SHA512 TLSH

Submit Download

3c3a4d93-9d70-471f-8ba2-91a0085120e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\3c3a4d93-9d70-471f-8ba2-91a0085120e0
Size 2KB
SHA256 ced04f0d2451898884802691d1643c9584c485a190e93b0439be45c8160c5c50
MD5 09e76bf1e1c6c2c1dd5fdc04b78ada83
SHA1 e9b633f73f496fdd64a19c751925562ed24a7f37
SHA512 6afa984b3c414b64f3ffdb940c909c74e2b2769160d7ac52ce72f1f5c12635a20a7e468357dfbfb317c467b3b6ec2c33bfe039efb1455db6ff5140d634c74c42
TLSH
T19441235C35784CB79D9AF5CDD982278E57648B1340C61C833E52EE0CCC9679D236A437
MD5 SHA1 SHA512 TLSH

Submit Download

55066373-d103-4423-a71c-671f9c35ee07

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\55066373-d103-4423-a71c-671f9c35ee07
Size 871B
SHA256 b52fae6bab18c4d857d7af7a5ad89e6b3bdb7a470fdfaf4af8f123bd1c5bbc4e
MD5 89b00aa8395b1a8b903d07fd675f1885
SHA1 13bd13d5da902a89e1c6f45c8c0e095e8e551edb
SHA512 602969b47db84e9749c61a60c0003a05f13817eede70b052f7ef88acf206cb3380862221dbb3c007793bfb3ecdc48a814c37d483c311d886888d472e622afdf6
TLSH
T1FD11E3D5D630F5B3CC6CD25BC6A53B428FA43523C0CA54143EA16E280DBE51E976E20B
MD5 SHA1 SHA512 TLSH

Submit Download

ca8210c6-41dc-47c0-b5e7-4965a6dc9f79

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ca8210c6-41dc-47c0-b5e7-4965a6dc9f79
Size 886B
SHA256 cdb7b17bf17d15cce785dbc75bd700533bb91e889d4da1c40f53d022cdfe349b
MD5 33df41dd6e7ad2699e71c1cc95dfd3cb
SHA1 c81bcacc7051e51e5202fea4ee5493e35ed74366
SHA512 5bd83d161d7d7f9f8a50ebc2fd0fde8219cf9bd3ae7189dcc97c29f3bd5aa491261a33cf02ccd2f8492bfc82cea2ed022cf16077be2425637a6163a47bc5cb1d
TLSH
T15E1123919A30B8738C7C824796D57B838FE16433D0CA08243F517F380DAA52E975A607
MD5 SHA1 SHA512 TLSH

Submit Download

d88c1110-c7d7-4f86-a8b2-ac92dd9d0f95

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\d88c1110-c7d7-4f86-a8b2-ac92dd9d0f95
Size 235B
SHA256 4c5118479e76f453fc31181ed82c1bc6c7507c2074fe7e34b27b2e5f42151132
MD5 dfb36f735c8eb3805b82062b76487af8
SHA1 55929024ec8ec7b850210de7926d23c5ee163f8e
SHA512 d04233276548ee326c603b31cdb14dfc8b4bdb75a80c78a8416d7d017279f9271c0da9e1303f200ab51c4de64ff803596cb400230e7ca6b41a76589fc2fe542a
TLSH
T1DAD097C474E8AB2C08104F03F0F0A9CA30AA8C3318706820D99148B899BAAC8032282B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 a66c41446105851d0ec2fe292e069ada42e9fa35980bc1d9d00d4418d919f722
MD5 e6dd6748e18a75c86e8802a6099b30a0
SHA1 30a0967c752e428a42bc0f45b11692b65cc69b51
SHA512 6c956ee8418fca16ac6a6c38a84fa674615c4e2529d59aaf9b03ffb190819b86605ead2eae082b6a91e8f4e6dc98264062ddb9c6497c25cfc54c75b0e5da7d69
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4H4B4h4:ujI4VRfOXN4e60434L474f444S
TLSH
T13E72531545148EB8294EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902BB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 0a0cba00fc67ac11b356fed88f85e0d0f4c4df6d5d120422c172ed97cfef5786
MD5 5fcbdff4386ed04045110f83fdc7ed66
SHA1 ac1a6527732d476f8439abb06dd34419a4ef5c42
SHA512 6b03c59075dbe265e5e4aa3e4c43442fd8a0d75ab870e7a4fff847792fca8368ed04b9c575d94b9404ab0da7ad19909eb7284620d9585011626aee0b51df4f6a
SSDEEP 96:xHcUTUuqGqdf2oOF1zS+gsSSlDdv9jqnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oOFdgsSSd9A1Bw88+w
TLSH
T186E14F7894188B6F74B6776CAC6888716AB2013BB7BF68C750B954C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 8KB
SHA256 805ab2182e4316e4d752806834ab30874c55f8e68b0acaa20fafd8fdab3f0efd
MD5 ab2eae58315a8ea94169d8bd4107e904
SHA1 26c7b766462d5e2ceb5d12e18d18042e752ebb2c
SHA512 f3da815bd976e7ac1e838fb59c9a8b2a819b918ff07d35fed6a3c64a996f4f4dc20420686c5618d3839e5b689894b8e0bdff05870931d5d6279dc3f7d4db4533
SSDEEP 96:xHcFTUuqGqdfCoOFObzS+gsSSlDdv9jqnERWRCBO+ylBw88s78L4cnrzBHK:6ARdfCoOFkgsSSd8RZlBw88bw
TLSH
T12C020E785454CB7F64B2767CAC2849705EA2023BB7BF68C750B954C5050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 45f5dab958f610d5ac903d11ddcf7c37b25a3c5a5b73baca06b47c63ea3f2caf
MD5 9fd382bb2b94c6244a24ace32efca099
SHA1 d599fef010075d88164e39fbd4cc0c922a55daeb
SHA512 985576ff6b833e0d2ff4e466b2981bdb89ffa2d3b1d8b4e933bb351d767ac61b1173786a4490e8a13461ed204cdab396e899fb41dae15a74fbc3edd541811f74
SSDEEP 96:xHcUTUuqGqdf2oE1zS+lgSSlDdv9janERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEdlgSSN9A1Bw88+w
TLSH
T118E13F7894088B7F74B677ACAC6888716AB2413BB7BF68C750B554C4050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 5182d118d887e53582e9c658b6dd69d4a1f849aed1159fce886496b09657cc39
MD5 2bd58bf850a90674e37cb83e35e2791d
SHA1 5712fa0537432dd5ef0412306891594c00915404
SHA512 6b934d0e397db73192944355f71cdb390aa38d666cf4895779061190a9a50744cea1c5b27f4975bff2d285496a605fafd44639891dfcd4a291880b751b1c0208
TLSH
T1CA413D9769662BF9BB01D85F80C48BBBCE562039D16848A15007AF91175D55C96DD090
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads