2ce3f41be927673dd1c3d74b956328608a42dc2580c3843e141528a643f0cd9f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-de
resource tags

arch:x64arch:x86image:win11-20260513-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download-link.html
Size 42KB
Sample260524-m59d3set2s
SHA256 2ce3f41be927673dd1c3d74b956328608a42dc2580c3843e141528a643f0cd9f
MD5 7063e5ce99196fc0399192d6488d4552
SHA1 3aef90116cfb76335ceeb07333062178fbad88ff
SHA512 25097a7de57a803ff6bab46bdf703bf9fe03d13afc96df645f6dadb1e7ba6092d84d5b431ba7ea7228d8eafd9b702021ddb63184f2682bbb776ef77cf91ee3bd
SSDEEP 768:8gOriWNcaS+/WiYhx3mg31AuM0jCYrF2CRn:j+/WiYx3plzOYrjn
TLSH
T1B513B5732D84143A1627D5CDB432BFDAF6498662E60764A5F9E88BA853C2DD3DC2C30C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	firefox.exe
Token: SeDebugPrivilege	3040	firefox.exe
Token: SeDebugPrivilege	3040	firefox.exe
Token: SeDebugPrivilege	3040	firefox.exe
Token: SeDebugPrivilege	3040	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe
3040	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3040	396	firefox.exe	80
PID 396 wrote to memory of 3040	396	firefox.exe	80
PID 3040 wrote to memory of 3928	3040	firefox.exe	81
PID 3040 wrote to memory of 3928	3040	firefox.exe	81
PID 3040 wrote to memory of 3928	3040	firefox.exe	81
PID 3040 wrote to memory of 3516	3040	firefox.exe	82
PID 3040 wrote to memory of 3516	3040	firefox.exe	82
PID 3040 wrote to memory of 3516	3040	firefox.exe	82
PID 3040 wrote to memory of 3516	3040	firefox.exe	82
PID 3040 wrote to memory of 3944	3040	firefox.exe	83
PID 3040 wrote to memory of 3944	3040	firefox.exe	83
PID 3040 wrote to memory of 3944	3040	firefox.exe	83
PID 3040 wrote to memory of 3944	3040	firefox.exe	83
PID 3040 wrote to memory of 4484	3040	firefox.exe	84
PID 3040 wrote to memory of 4484	3040	firefox.exe	84
PID 3040 wrote to memory of 4484	3040	firefox.exe	84
PID 3040 wrote to memory of 5012	3040	firefox.exe	85
PID 3040 wrote to memory of 5012	3040	firefox.exe	85
PID 3040 wrote to memory of 5012	3040	firefox.exe	85
PID 3040 wrote to memory of 5012	3040	firefox.exe	85
PID 3040 wrote to memory of 4768	3040	firefox.exe	86
PID 3040 wrote to memory of 4768	3040	firefox.exe	86
PID 3040 wrote to memory of 4768	3040	firefox.exe	86
PID 3040 wrote to memory of 4768	3040	firefox.exe	86
PID 3040 wrote to memory of 4084	3040	firefox.exe	87
PID 3040 wrote to memory of 4084	3040	firefox.exe	87
PID 3040 wrote to memory of 4084	3040	firefox.exe	87
PID 3040 wrote to memory of 4084	3040	firefox.exe	87
PID 3040 wrote to memory of 4016	3040	firefox.exe	88
PID 3040 wrote to memory of 4016	3040	firefox.exe	88
PID 3040 wrote to memory of 4016	3040	firefox.exe	88
PID 3040 wrote to memory of 4016	3040	firefox.exe	88
PID 3040 wrote to memory of 1416	3040	firefox.exe	89
PID 3040 wrote to memory of 1416	3040	firefox.exe	89
PID 3040 wrote to memory of 1416	3040	firefox.exe	89
PID 3040 wrote to memory of 1416	3040	firefox.exe	89
PID 3040 wrote to memory of 3460	3040	firefox.exe	90
PID 3040 wrote to memory of 3460	3040	firefox.exe	90
PID 3040 wrote to memory of 3460	3040	firefox.exe	90
PID 3040 wrote to memory of 3460	3040	firefox.exe	90
PID 3040 wrote to memory of 4504	3040	firefox.exe	91
PID 3040 wrote to memory of 4504	3040	firefox.exe	91
PID 3040 wrote to memory of 4504	3040	firefox.exe	91
PID 3040 wrote to memory of 4504	3040	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\download-link.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\download-link.html
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 1964 -initialChannelId {cac03706-85d0-46bf-8932-0294bd7938cc} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2308 -prefsLen 27133 -prefMapHandle 2300 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {9dc55b2c-4bbe-4225-8d82-51acb908b326} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 27274 -prefMapHandle 3724 -prefMapSize 270279 -jsInitHandle 3728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3736 -initialChannelId {b349ff7f-990a-4cc8-b0fa-f4f2478d8c2c} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27274 -prefMapHandle 3888 -prefMapSize 270279 -ipcHandle 3956 -initialChannelId {771e495a-d9ba-4eed-8cfe-c7d4617ca7c9} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1624 -prefsLen 34773 -prefMapHandle 1680 -prefMapSize 270279 -jsInitHandle 1684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2964 -initialChannelId {672b66dc-b2d1-489d-b49d-99aa639042cf} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5420 -prefsLen 35010 -prefMapHandle 5424 -prefMapSize 270279 -ipcHandle 5360 -initialChannelId {64e78f8b-3461-4858-8a2f-72f2eb68d8e8} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {fabd74f9-158b-459c-8599-7390a32a87b0} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32952 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5912 -initialChannelId {55f01ef1-cf20-4cdd-8ea3-5f1cca5d657c} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6032 -prefsLen 32952 -prefMapHandle 6036 -prefMapSize 270279 -jsInitHandle 6040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6052 -initialChannelId {8904b55c-d498-4f95-962a-2999ceaf4507} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6228 -prefsLen 32952 -prefMapHandle 6232 -prefMapSize 270279 -jsInitHandle 6236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6244 -initialChannelId {934262ef-64f1-47b1-a218-29bd72f6e089} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6516 -prefsLen 32952 -prefMapHandle 6508 -prefMapSize 270279 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6540 -initialChannelId {1800c3a4-936d-4b07-a2ae-dbcf7ba14900} -parentPid 3040 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3040" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 97e15dd33f5c0f15dfffc08ec2e1f9e66e002336af04fac363e776aafea2be69
MD5 0ea6855e9ca7005bcb86f3889d596567
SHA1 508749167553ff854a6346cbe8d0fce5e21c2938
SHA512 98027eb9a3722e2e09729a2e0e9d64377d230b8adce98f3651ba9839f9da6cb281b6bacac1bc9104c9af90ee06b9cc89dc7c4dda0836a1a6f607ab1402ddc078
SSDEEP 384:HUr7iO024Y0o6J+Sl1xDnZBPsac4j0lpDII+JBNMBNP:0SZY0o0+Sl7zZlsac4ID8Lw
TLSH
T143528DB99F0138AA1A27C090E9BE5204CD05E7BFEEE291A615143C04CA847F9F4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\AlternateServices.bin
Size 7KB
SHA256 a0139bba056e9d85decf9b374b797aa6e4a35bf5ae90d1e175312e16f429c1bd
MD5 010427c5446222c868923735ff6acfb5
SHA1 4e032f675e8e88c67246c93ca476d0c4638aa89c
SHA512 bbab380feaf6686775b70cf746c91442c2c9acedd897bc81c2f30d3449890e5ee0d9da3af98251285ea9b6f79af868daade48c62144964e637e8a6389b4e757d
SSDEEP 24:HuhMZG1E6Of2ZHWzB2p7zHWDI5qcgI5jI5SHWcGsOEGPG81E6jxZU:Q19HHHHHrfEV1b
TLSH
T12CF1EBE373779422E0765F789410B644DD324A45AAF498588360D46F07C1F83E04F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\AlternateServices.bin
Size 16KB
SHA256 f1c07beec702bf805079f1f76e216b0ec24d72714a78fa7e769f86cc3d48bdee
MD5 92f53c775a63ad53c06982410d0dd1b2
SHA1 fa686f9133ccd74cea1663f6e35f2c83d2f9ea72
SHA512 69219fdde01a2d118eb7721c64c6ef05d3a3f9304aeab3be3c557da337db65b50e6df909004c8f268f023b69b13f1b4ff33c4ca026d1bedb64a2dd5c3075586a
SSDEEP 24:VuhMZmO2+JB2p7YhEI5qcgI5jI5yKGsOEGPGQFxVOUhlOyk99O8sFdUexbhUqx1I:v4fEcjcZh3zM4T
TLSH
T1C37286E733729012F0B55FB4C415764CDE330A1E6AF8D4998260D8AB43C2BD6E14E76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 6b77b097a0ad4814336b6c0ae913c4d716b41761ad7a4870325c4f2049e94d27
MD5 ba4e57b7faca0990bd4133d8ee86d12d
SHA1 f15095be25b524cb7521f2ca8169588bd8ea5d66
SHA512 adf192133470afc82de82df1cb98cf61dbb03ff1d4c07c630c38cdffd814ae9934f26f1f77d9286f7a10c3346fd46fb0bb497727968581e3389d04f839c9892f
SSDEEP 96:zkRFC2F0FRFzFC/dd66Joz0dzgClKtmc0d/UjI07IaSdF95/7bkW6QXjrcEhIKSD:Q1d66Joz0dzgCl6mc0dsI07IaOv5zbol
TLSH
T1CCC1ED64E628863BC414023FCDA51F510F36385AAC8E7F1932DC645D3D962DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 09406e8c4ec3b586a63546ed55c6a891089fcbaa30ecf0fc220bf56a2ec4b92b
MD5 616e3838109bac6361ee0d382a9c301b
SHA1 eef75b7f6b6c7fc0edeea887d4389d79d04166a8
SHA512 ee7eb84e21aafb0a944c74e03ba98b3e53e24e84faafd469cd9f2bfc8445c34fddd4f80cb9802dc52adebeeb772cbf407f4e96a06a6d14208bec70b0a418b639
SSDEEP 192:J1d66Joz0dzgCl6mc0d0I07IaOv5zboHWZhIKSyjoI0MN:Hd66JozQzgC1j2zkbo2ZhVSyjoU
TLSH
T178E10CA4E628863FC404037BDDA11F410F3A389A9C4E7F19359C65582D9B2EE778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\events\events
Size 1KB
SHA256 79ad895c79d4858ab4c345b6b1ca9b5e37f23ee74e09db1b403100b55b1bc417
MD5 d28f66411cdedb807bf88d3c3ad4520a
SHA1 ef0e02ada097bd3b4d8fd83b99e5e7c5738ae304
SHA512 bf144f657ef3b7004848881c268665dd9fb79b124a4f0958f932f08b84454fb07496e70281d48657a84bc60c6e9d521c2c426e76991fb3bda6582443481ea701
TLSH
T1F721974C39F84D6A98E7F39C7850068E97414A0728871C970D02DF8DCED9ADD322E43A
MD5 SHA1 SHA512 TLSH

Submit Download

0418d887-9a97-4d9e-bc26-2f8e15b20ff2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\0418d887-9a97-4d9e-bc26-2f8e15b20ff2
Size 235B
SHA256 1e27cec4d9e69d937f222d82de7186020205c702065366ac45bc1be5417e419b
MD5 54bd6bdd7a2207fc411e7dfef5314c54
SHA1 a5afaa49040d5a27880a567c176d85f45fa1b489
SHA512 19f4431acf6b14ec428c5a264fa506f765ddaf82bed53b02929460ee2f0fc8e33fdf96ef9ed887e02e878b98d22d2b0d532c2cf2a093db039aa5ad4b81d0ca73
TLSH
T154D097842CC8AB1C08010F06F0E07AD230888C37106C9820DE91097499BA9C88222C1A
MD5 SHA1 SHA512 TLSH

Submit Download

13183ba2-bc45-4e9f-b129-555560e18c4b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\13183ba2-bc45-4e9f-b129-555560e18c4b
Size 2KB
SHA256 8a82b1b358caa1846ec9da7fe341c17e2743e08763aaf78cae8cd99076ebee0b
MD5 f39972489644eaa2508c7b266d8a89fd
SHA1 33ef6d473f87718e042c9e111fc06583215461eb
SHA512 2a9ac3c1488b9cce3fd0fa2d20dce63a8595971499f563bcb9e0716003e4485b0d4dfb745a9b4d2a1f4541ace698baaec55b63ebe60713120e2697aceec1da30
TLSH
T19141259C35789CB79C9AF59DD582338E97608A0340C628432D51EF4C8C966ED736E53B
MD5 SHA1 SHA512 TLSH

Submit Download

91de4df2-d8eb-4fb0-b3e1-071cddd0dc19

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\91de4df2-d8eb-4fb0-b3e1-071cddd0dc19
Size 235B
SHA256 100a81becbd9a413185e5f64c92f955aa719ac546a5e3b19b87408920f1cf6d2
MD5 45a1338d92586c96b989ef8e6a45d009
SHA1 1c1b5da1acf6efff10d22ccc0eb9b89932274229
SHA512 e3e9d7c2d1563e0dc98234763e28e027c5cbcbaf7519a23741f1e188470c970a86deb9b2291718d9bedf8ec909d7b64ac3779062027ce7ec60fad63d355a1106
TLSH
T1B8D097802888236D08201F13B0F169C231A44C3324B09820D6D15538EAFCAD402118B7
MD5 SHA1 SHA512 TLSH

Submit Download

b0fe07fc-ef45-4954-b1b9-7031a544bac0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\b0fe07fc-ef45-4954-b1b9-7031a544bac0
Size 886B
SHA256 7a844039b10d2eeeeb3545e48e661586749fe7cec8613210a38c353ff69f16af
MD5 92f637d87c470819ec2b7f2d4e0da82e
SHA1 230d46832ac6ac2583ef8208a3d8645acc301f4c
SHA512 803ecfec3c4b77b21cc0d62b367482ea55bee5372aa2c7bcbbe2da908f39820eaceecbd58b037fdf4acb1b236e55794057ac1b58836ccc3a0a1836eb4ad0b437
TLSH
T14A1104908678F972CD28D24F46E17B534BA4742380C649183D95AB180DAA57E636A61B
MD5 SHA1 SHA512 TLSH

Submit Download

df307053-7a11-4e72-a993-44af929bf950

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\df307053-7a11-4e72-a993-44af929bf950
Size 2KB
SHA256 4c27c0f56d79db57ab91841bccc415889280c6ba52f4c644882cb09334c704fe
MD5 c16be587c4cfe6844a459b43223d9b36
SHA1 a64f4452b5362ce9bd3869074bf6c3d0a20e3a2e
SHA512 ee1c56b1c638824bf1bf2e589f9fea2bd317b2b692c85b4209720f2dcf0574e8bcfab8e14bd328d31000378cee0e0e22a46b2572fda9f7d16f05d69c0815fe3e
TLSH
T1BF5186654164DC7EC97DB31AD9213B828BF2140B408B1C4EAEECAF0B157FC5E9359649
MD5 SHA1 SHA512 TLSH

Submit Download

f77d9ad3-284a-47ff-8331-905d92d21b1d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\datareporting\glean\pending_pings\f77d9ad3-284a-47ff-8331-905d92d21b1d
Size 883B
SHA256 873119fb63ff0ef2c898e8329d38f227940e37d4525e5bc217257683622e376a
MD5 153a2949d2f58a65a67aa00a57ce752e
SHA1 692030b929ef5f8c1e9e367127377e6f2644df71
SHA512 e617a1d0320bb822c2e08af31017158151e9c24eed8a72298e74df1dc8ed7ef7c08efe09f2cb81b256ef8072ca448c17f67239df9c751bb79cba265eaeb8dc37
TLSH
T19411E7D59639B9B2CD28D24F879137124FF4792380C5451C3EA15E180D6E57D936A70F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\extensions.json
Size 16KB
SHA256 b20e6e9e56a3ca63118f3fb3ea5675abc18912deba5d89a142263390a700012e
MD5 cd36341041acba245c7f2b914bf9ef3d
SHA1 d4c1081025dd3a227e06df4ad4b5ae1d3cc6f6e3
SHA512 0364a22c627793d6760b0b02e2c59d9bbf36a433da4e42201c3ef8259a8a74bd56e2b0fd94c01be43cd253fbb24df5068c0c25bb21dbbc86bacc16240e3fd298
SSDEEP 384:YkI4vIUmldv68dhWR94zX896oKL4HUL4Pw5L4H3L4HRL4HVt4hY:PI4ARf/Xo4M6f4u4ox4b4p4L4i
TLSH
T18872521545049EB8298FA79AAA367E01C37D433B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs-1.js
Size 6KB
SHA256 2931cee1b117e3a44288ff00ffb03d8c673015f3b126cd351c31bf0cde3fd85c
MD5 5e21601a602a067285bd7aa833dc045f
SHA1 bb003e70e9b660b506031c25ea68ad457aea06ac
SHA512 89b66216061c90f1749e389ad10603c67baa2ca05971442e4dee05d933b9f97ec4a64f6a3b07419e2aef02594a006b984048addace333b6b028f76501dffd0c4
SSDEEP 96:xH/UTULXqGqSfwZg1zSoSSl+dv9jJnRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwZgJSSl9PuBw888I5
TLSH
T181E12E7894088B7F74B677ACAC6888316AB2013B77BF68C710B94485055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs-1.js
Size 8KB
SHA256 6b45c9b98a1eef565076fb94fa776c2624b75bc92585b61688abc0d3caf727cb
MD5 11f0528acf513474ea0529279d98c661
SHA1 0171a455973244f73a589be0b5ba227885493c33
SHA512 6b792191cf8550fe2f1b310541ab889bb63261686829ae9a01a31840afa7aa824c96c275cf43d5297596364e3519f951560975de8a234b3b87b77dae59b6640a
SSDEEP 96:xH/FTULXqGqSfyZgObzSoSSl+dv9jJnRERWRCjKLyeYBw88+A8L4cnEvzIym:hm6RSfyZg6SSl8RynBw88+4zI5
TLSH
T19A02FB789004CF7FB4B6776CAC648D715AA2013BB6BF68D310B95885054CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\prefs.js
Size 6KB
SHA256 d48412c160347897d023b13be281e7a6b5151d5de7af7c6816fbb35b13dec8be
MD5 50b0019726f584a87547de67885a78b9
SHA1 65d253371501164bec9d28e1d91336839586cdb8
SHA512 34c13b26ebb0ea8365451a57d22be550a8fd828657c5657a29690af6f45bded95245b48ae3f0fee68d0641ced88df0c4ac004357bff2e95f7342582f0f88f293
SSDEEP 96:xH/UTULXqGqSfwpmk1zSFHSSl+dv9jgnRERHPKLy4Bw88H8L4cnEiIym:hb6RSfwpmkMSSW9PuBw888I5
TLSH
T120E11F789408CF7F74B6776CAC6888316AB2413B76BF68C710B95485055CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 919507f1d549ba084988cd4a43c75e9c730f2ced49f134b25442b9b9c3c484b5
MD5 e26dbf2da5e345d97568a8f30af15064
SHA1 3831befb5205e59f8ba01f6c5ce736ed550a61b1
SHA512 def4f8f9be69c2655dfca82ef588dd200a736ef06aa7116eb084747e0671ef9fcd87d0b7847f8ce3446fe512264c963dcc2a1e2236364eda75918a4d4f7be919
TLSH
T1A851084798222BC1E618C98DD0D44678A5C714A2C29184E1FC48BE9331C6FDBD34FE2C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 bde43c4fb1de4114f901cefcb5ee14f2e6f9277ac3d835500155e5e2caa5ba6e
MD5 31275f73dec4bdecf05370b9707cb205
SHA1 e4133678cdd5b3f9819642f314d77a01fa11735b
SHA512 1fb3d2d87a25799c416d3e13aa7fa90064ed5a20fc84df9c3aa8eb849fb264d273dcb90480f467376a25ba262721015dbde4c2f421b7e368a857f55ddb961032
TLSH
T18C5108439C221BC1E628888DD0D45674A6C714A7C39184E1FC08BE9360D6FDBE38FE2C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 76eeb4e8a893ccd06c44ce3bc623527fb01162809f6776ced41fda8077002530
MD5 2dcaab6c96f3ea6d2151336f0d29cdaf
SHA1 b081368843368fe9ebadb31e1d963e18d3c87f68
SHA512 084fdaa154a095a03c9da7e6278778244d1385047cab77a4d16fa60777a4419405ce64df063f06f59a1179438c53696c0bd689c35f903427f8fb5ade834de804
TLSH
T1EF51F9879C121BD1E66889CDD0C1563485C31162C29184E6FD887E6371D6FDAD64FF2D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 91d823ea1357fa59ac2ec504d8800ef0070969084fa073a5c653141494eb3262
MD5 ec0deedb6de00de15c2658c3b4c616e5
SHA1 a8bb58679fe7a5ddb0fd083366e3128ace7b003f
SHA512 9818a5a37be658b56f303317c05520534a71d718bd08690da79ee56e9d5950b6d583b37a83abdcc5b0cf5734aeb55be64bbafe54b03fe0df82b9aedae0d1b388
TLSH
T18F51EA535C221BC1E668888DD4D55A78A5C72163C281C8E1FD487E9370D6FDBD24FE2D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmpjn8cr.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 32bcec30167302a24509c942d8e607225ae5258e6f6a77f233b1209b34bee9d4
MD5 1b81c74c4de4edb845170eaed1abf3c1
SHA1 89a9489c91bd5b93d0b572fdeca97f2da5d3c073
SHA512 ed2e27c286fde8735949490d5f2d757d6ac15f711eaafe338529ad5d8e930ebf705d70dc789d59a3373411e9da1ee6f173863f85d0096da02c77727732154dcf
TLSH
T16451F74358221BD1EA2889CDD0D46674A5C72562C28184E1FD48BE5331D7FDBD28FE2C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads