16d7a4689dbaeb103f7a4b8181474c772119731e6b9cb55f8d9bdec47bc9aa95

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
activity-stream.discovery_stream.json
Size 76KB
Sample260623-hcddqabs4t
SHA256 16d7a4689dbaeb103f7a4b8181474c772119731e6b9cb55f8d9bdec47bc9aa95
MD5 6a1e215ddf1595bd863ae94fe23e3dfc
SHA1 edf179961214a6b7f4607c56042bb84628d5d477
SHA512 665f55dfed95fa6619855fec432ec551f4d8f84a17f7a845ecdc127ce0f7cab6f6861fb760f5e89d8975b202961abd90a44b70a4f43beba7eb27d1e78fedc08c
SSDEEP 768:9yzrAic2zy41ejrmMZTxt87LlFlp/UGKpQW+JDbbbmGzAIaxzuxVdS1RDQvDVYQ5:szrV1lfB8nwDbFAbxzYVdScYQW0l
TLSH
T19D7319A3E2A9B1FB0B9637CB2C4B795B96E24155E34602CCFCEDC91D818C655023E5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\json_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\.json	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\json_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\json_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\json_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\json_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5816	firefox.exe
Token: SeDebugPrivilege	5816	firefox.exe
Token: SeDebugPrivilege	5816	firefox.exe
Token: SeDebugPrivilege	5816	firefox.exe
Token: SeDebugPrivilege	5816	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe
5816	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3660	OpenWith.exe
5816	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 3324	3660	OpenWith.exe	90
PID 3324 wrote to memory of 5816	3324	firefox.exe	91
PID 3324 wrote to memory of 5816	3324	firefox.exe	91
PID 5816 wrote to memory of 5512	5816	firefox.exe	92
PID 5816 wrote to memory of 5512	5816	firefox.exe	92
PID 5816 wrote to memory of 5512	5816	firefox.exe	92
PID 5816 wrote to memory of 1572	5816	firefox.exe	94
PID 5816 wrote to memory of 1572	5816	firefox.exe	94
PID 5816 wrote to memory of 1572	5816	firefox.exe	94
PID 5816 wrote to memory of 1572	5816	firefox.exe	94
PID 5816 wrote to memory of 1680	5816	firefox.exe	95
PID 5816 wrote to memory of 1680	5816	firefox.exe	95
PID 5816 wrote to memory of 1680	5816	firefox.exe	95
PID 5816 wrote to memory of 1680	5816	firefox.exe	95
PID 5816 wrote to memory of 2288	5816	firefox.exe	96
PID 5816 wrote to memory of 2288	5816	firefox.exe	96
PID 5816 wrote to memory of 2288	5816	firefox.exe	96
PID 5816 wrote to memory of 4840	5816	firefox.exe	97
PID 5816 wrote to memory of 4840	5816	firefox.exe	97
PID 5816 wrote to memory of 4840	5816	firefox.exe	97
PID 5816 wrote to memory of 4840	5816	firefox.exe	97
PID 5816 wrote to memory of 1600	5816	firefox.exe	98
PID 5816 wrote to memory of 1600	5816	firefox.exe	98
PID 5816 wrote to memory of 1600	5816	firefox.exe	98
PID 5816 wrote to memory of 1600	5816	firefox.exe	98
PID 5816 wrote to memory of 1832	5816	firefox.exe	99
PID 5816 wrote to memory of 1832	5816	firefox.exe	99
PID 5816 wrote to memory of 1832	5816	firefox.exe	99
PID 5816 wrote to memory of 1832	5816	firefox.exe	99
PID 5816 wrote to memory of 1432	5816	firefox.exe	100
PID 5816 wrote to memory of 1432	5816	firefox.exe	100
PID 5816 wrote to memory of 1432	5816	firefox.exe	100
PID 5816 wrote to memory of 1432	5816	firefox.exe	100
PID 5816 wrote to memory of 4280	5816	firefox.exe	101
PID 5816 wrote to memory of 4280	5816	firefox.exe	101
PID 5816 wrote to memory of 4280	5816	firefox.exe	101
PID 5816 wrote to memory of 4280	5816	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\activity-stream.discovery_stream.json
1⤵
- Modifies registry class
PID:1756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\activity-stream.discovery_stream.json"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\activity-stream.discovery_stream.json
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {49394e83-d403-4279-9238-3d0c7ac5a1d8} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5512
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {f3001da7-2497-4a06-9e03-3180806bcf2c} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27323 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {b398705a-8b56-4ec9-aaea-fefd9de89b2a} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 27323 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {38a2d964-5f5f-49c8-9463-86a8a4acb405} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4408 -prefsLen 34822 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4404 -initialChannelId {bf76758e-67d1-4000-a7a2-1998d38cb0ff} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 34876 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 4856 -initialChannelId {cfb86524-3330-49bd-8e3c-0180372d8aaa} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32952 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 2852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {a62b78e5-198b-4011-9257-f7b19c0025ed} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5424 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 2636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {478a5df3-3af9-449d-b823-72550bd3d69c} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {e56ac1b2-5d0a-48f1-8607-0d78d99f1818} -parentPid 5816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 165d4d7aec31f927434cb53657a05ecc68a8455be1d0d8140d41246d296241ee
MD5 e763f88d7f663302e7c9a98ece212032
SHA1 9bab2b11085e4d5752076c3b3b5713f44a7d2673
SHA512 87c2caaf72f7f277463082e44fcd86fb448fcd404bbff251e916af27e58be8765783904abd3b244a8c26b5b60043efe5099ce101f8933846ba418c0fd8d67906
SSDEEP 384:HPC9iO024Yko6J+Sl1xDnZBPsac4j0lpDII+Ml8:v9ZYko0+Sl7zZlsac4ID8Ln
TLSH
T137528EBD9F123CAA1927D4A4D5BD9254CD04E6BBDEE2D05609143C04CA847B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 686ef35c91c9a1c71f86420c6dd7716296466c74113ad899590a767ca888b781
MD5 e8e844039a620235bbf9d2779a7b6b5a
SHA1 10919bc36eb74235783c28e8eb5659c35645fbd4
SHA512 f4d2976dd2b04f60fc3996540a95ae34cec2848e7f9c0fada8c3987d48ffc3ae40f40c517ee97ef52d5d74b77570f853daf666e8ee3974fe22398244e78c3dad
SSDEEP 768:ZBn1LfPV6T1jC2Gcm+urldPC/vKKslBx5XwmbQCbXb1bMbRbKbBbhbVs6UxdhM4a:dfPV6T1jwdPwvKxs6UxdhM4juXCrnj8
TLSH
T1C5230044EB1A953FD82812BA9CA60B003F38F88D561A2F57375C64787D872DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 872ceb3f73fa3d852584dcf00377e8dbdc0ff0b2b0bb8241230f1fe575093141
MD5 a95cd1e383b2d5cd3c4d37536f6b3502
SHA1 386e9a4bd45e6ed61f9ccb9153c17507652afc4f
SHA512 4cfe2360fc46a757d68aceac2013b7df1c65e912dfe48fea0d54d957a01aac7ace7ba719b69810f94540829daadf988c1b35420550986b683add82add2b4b750
SSDEEP 192:uOv5zbo8ZjryjFx7a1d66JoztdzgCl6mc0dD:lbo8ZjryjjEd66Joz/zgC1jp
TLSH
T1D3D1FE28FA28963BC408027BCCA61F404F39399BA84E3F19319C64483D5B2DE778D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7d1921ab7ea39a758ffff13ac3d3cd50cb05d7c0bb53a883ddc3b19693ed253c
MD5 70833821b78483dae19e3a49355c0768
SHA1 16ae52b7d1ef4bdae5c0e0070780883f3c403c41
SHA512 f2b26f9c9049c17fb7b80261d9d87f690feb6dd8d920c0519ee49793551bcb5fd31ca7ccb4a05f1b1495ff78c32940865e3e71eab3fa71c995f9716335325e45
SSDEEP 192:6a1d66JoztdzgCl6mc0d8Ov5zbo7vZjryjVyC:6Ed66Joz/zgC1jVborZjryjV
TLSH
T189E10C68F628963BC418027BCCA61F414F39399BE84E2F19359C65483D5B2DE378E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 9eacf01331c442e2ba09e6b0b89073a14ed8d3e2ea92649c57976f2849a10ad3
MD5 205e5e9ac4c3157a594c13adc8afad27
SHA1 c78a932a15c26c3600f2f38be874b0b8b8d990f0
SHA512 050988b47e76a6dd3ef5b70abb39cc1458e38f3ba0936c9dc577f5efe161dacc06c2cc4192ea198ed19a785537492e3ab97183a8e4330fb4ababb332d9963945
SSDEEP 768:wfPV6T1jC2Gcm+urldPC/vKKslBx5XwmbQCbXb1bMbRbKbBbhbVs6UxdhM4juXCH:wfPV6T1jwdPwvKxs6UxdhM4juXCrnjf
TLSH
T172230044EB1A953FD82812BA9CA60B003F38F88D561A2F57375C64787D872DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\db\data.safe.tmp
Size 47KB
SHA256 8e433e991873e231989016805456ea614dc0971df9b345162a7d2aa8d095f20f
MD5 fe204f9c462ce46b90a86183a1d972db
SHA1 58ce71ed63ed7ce1ef6cce5a8112dc837705de3e
SHA512 6398e2cf1d77d9605905808bea576dbc64aaa04a691bae5f041a30ff456ae26f67dc6653af4aaee6b08df85840deb52cdc87bc829b8c1dd08df7d85feffeddfa
SSDEEP 768:D1LfPV6T1jC2Gcm+urldPC/vKKslBx5XwmbQCbXb1bMbRbKbBbhbVs6UxdhM4juz:9fPV6T1jwdPwvKxs6UxdhM4juXCrnjg
TLSH
T170230044EB1A953FD82812BA9CA60B003F38F88D561A2F57375C64787D872DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7f7613f3d7a9cb8fde5a1c484134bad61b65b8117ed7c3eacea84f502b43ee31
MD5 b7f6bc86ef976bdf2258b41e4302e195
SHA1 e779b119cad3db53e955afeb3d2976159a30f2bc
SHA512 ba30425c757c0e09d01f5b31458efc2ca05f4886d914c4c94f55e2418227e0f2e805b03692d3ece6404cdfc9e790606fef6ca5563cfaca95d5f9082b8dbd06a5
TLSH
T15021AC5C7CB88DAA7CCBE29C7450028E57644A4B45CB1C430D23EF8CCED1AD9326E438
MD5 SHA1 SHA512 TLSH

Submit Download

0bbe3ea1-e509-4c0e-8b22-dfef14f1e9cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\0bbe3ea1-e509-4c0e-8b22-dfef14f1e9cf
Size 16KB
SHA256 eb8a2bf3ed141362c1843f710d5811278da6c4504e121db8366ed9745d123461
MD5 7a1a603053614e2f35d5d1eaccea7f78
SHA1 afb8c5e24a2322f769dbaeedebbf589d8088a59f
SHA512 29fcd3137f5b5be2aa972033375dfb5da7777a3412f4085b80737a69e1086149616dd97bdd4560807327f08165204fa1db65d268fabee698e015bc5d1357db48
SSDEEP 192:2leZCc26/qsWOMwHO8q3mAsgmOalKsstkRUEd5M3JeYDKaBKD5uKKzxqG7suBw2X:OeZCcT/NOmNflaBKD0KKlJduECKx
TLSH
T10D72C95A582055BA8291E3A894F87FC3F1F628CF4C419FC99BE47E086DDE06E5127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24e07f23-af9d-475b-8be4-656b722a7ece

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\24e07f23-af9d-475b-8be4-656b722a7ece
Size 883B
SHA256 6b27c1e2559d96d8d2ca5ff6f389d1210e6062a37ef8b26ee6e297d46a1f1b6d
MD5 06cf70c92906b245e613b6dce105bf89
SHA1 70ac2017c42fef5a3190645f8d94258191c0dc2e
SHA512 a3503de4dbe577b235735a351a23654997adcb2769e46c4be4291c5ee4093c6f12cafcc3c17945a0c070a91c6f7bff890290a2eb73161d2e8b891640e65236f0
TLSH
T1CB112340A635B6F2DD78D25FCD963B4697F47223D0C748147EA0AA040D7EA1E53AAA07
MD5 SHA1 SHA512 TLSH

Submit Download

add3900d-b680-4149-abbf-4b1b1b955df8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\add3900d-b680-4149-abbf-4b1b1b955df8
Size 886B
SHA256 694ced07fc441e1cf9cb4bd632ce527a1dd0b824f271db0f46ea05d285fa59b8
MD5 b85c0bd954b9974263cce5d0c0a9b8c2
SHA1 425cde3b3e6c187c5119b40232fbe8a08dd2ab73
SHA512 8f03a3e8e69144406cfbf1fa18708cdba642618fdab9e09faa36f27852613f1db03c8982c6d6d3767722b8708a9ce31ac451d10609db36b118fc87faa34cae63
TLSH
T16411274095B8B6B2CC7C929B98E17B4697F47113E0C709143D90AB445DFE51E935A507
MD5 SHA1 SHA512 TLSH

Submit Download

c449a702-43e4-45aa-8b7d-b22ca6dae809

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\c449a702-43e4-45aa-8b7d-b22ca6dae809
Size 235B
SHA256 c3207126bf2ded4260bc010c8d5faff0f9532232b749963d39b9b6826bfdd498
MD5 c3fd4017040e3309ebb7a8d4ab3f3977
SHA1 3f092cf9c8d77daba3693aa7095f98acc7ea2ee0
SHA512 d981b7510f2b0eafb7138489ce65eeccd9d5ef72002b16e18d66f179d42db7fdc96cb641e64cd9d85293d42f93b3b3d522227bc5316ec8d32d9d458a8203d4b7
TLSH
T13ED0978628C8A79D08080F8BF0A0B8C3318E8C3314706810CA60017489F8DCC1262907
MD5 SHA1 SHA512 TLSH

Submit Download

c9899e42-a2c3-4a87-a379-0ad20e6e9cb7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\c9899e42-a2c3-4a87-a379-0ad20e6e9cb7
Size 2KB
SHA256 38cb0e13e0e59db533ecb424af24a7422ea9ae7f04d035394ef5259cbcbfefd9
MD5 4ddf2fe74ace6f75b59b580a730498b5
SHA1 c709969a76e3ac50ed1a2c304b78b52c00ead1e0
SHA512 d14a75cd1d1a58fcfad01d9e16c9091890172b54f381d3aefa0122a235e1e4936ebc66d72fde9b397b183f81ee114c1a0e82fee0d2238e12662249a71195e00f
TLSH
T16241115C35789DBA8CDEF55D94C3268E93A48A1310C23C83AD51FE4C8D96699336A41A
MD5 SHA1 SHA512 TLSH

Submit Download

e758f275-f1ce-4b69-9b1d-5a1eec3b6f0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\datareporting\glean\pending_pings\e758f275-f1ce-4b69-9b1d-5a1eec3b6f0a
Size 235B
SHA256 0738b400ff7f940612a465730308bcf0622deb2a77d19f1a4425a75c8778755e
MD5 4c2eb1b0e1e505058a9993e9fd065c2e
SHA1 2aae5c0c46e6af4042e2b8a4e122f9c043bb71f0
SHA512 ca04026ef72a35229f70be99850abda1d81faf5836e2c12f0da4a8841a2c087c76316be78f49e8362c8b5d7cbf4c57289f54d9ad27dd98e1ede5739b4761ed2a
TLSH
T1B3D02380148CB75D08040F0FF0E068CA315C8C3314745830CAB54178DDFCEEC0291C67
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\extensions.json
Size 16KB
SHA256 252aba6bdd5912c7bf1c28610c971d226626f448e2b74989cb2770af92d0a5bb
MD5 bd105ae28160a8894187d0215a28271a
SHA1 94e6ceb5d3d4bb5cd828768e67f558ffb2017d76
SHA512 0ea84deef053dbe46bf3d1dcb2b4d07c58a5c1fbdba3b803ff4ebd89950dba1576c5b995589ba113efb9e148248b1743ea8a9c22a6696b72a5e6fe4c9c613779
SSDEEP 384:ikI4vwUmldvic8dhWz94zF96o2L4HWL4PZL4HCL4HiAL4HD54hs:VI44RfmXC4v6H484J4Q4Ci4t4i
TLSH
T12F72421545049EB8294FA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902BBA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs-1.js
Size 8KB
SHA256 1ed290f3319f6216231ee2e8c89567acc22754e3b02e21b4aefa635087df7f32
MD5 30c93d0dac14d318a5ab7746e78e4f20
SHA1 b2b79b9be1433acdb44df280fdff10b3d802381d
SHA512 22b7d1ab076060d922f4c3c86acb3ba8fdabef7bf747ae2cbbec8f7a1a22e9c3d738d66503aab515fa0159584e12275d6d5d6086d8bccf07f7acbb76bba40803
SSDEEP 96:xHI1TUzBqGqcf3m4ObzSZJSSlBdv9jKntRWRNb/H+63Bw88Q0750t8L4cnTgcXuv:qRRcf3m4XJSSa8R9NBw88Q20X
TLSH
T17902CA3C9044CB7F74B6366CAC2849715A72023BB7BF68D214B94485055CF3846EEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs-1.js
Size 6KB
SHA256 0e83a84f07686ee32c3d86d6680273efa943acd3eea550f659c16a0b16cdc93c
MD5 5bba0725acd80168d53ee6094e1be59e
SHA1 3e04dffa61b142820bc8cd78f8916f9542d83bc6
SHA512 5cae9706aa9a95a23a273bd2955c40f081c2ca7209d8cf98c0424ef42a75438bdf637aa0c3c42a6435434f549533c46f97b6357bf85c02f712c663db5e4967cb
SSDEEP 96:xHIUTUzBqGqcfum41zSZJSSlBdv9jKntRHv/H+6mBw88u8L4cnTghuv:qgRcfum4gJSSa9vwBw885
TLSH
T19CE11E789408CB7F74B6766CAC688C316AB2013BB7BF68D210B644C5055CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
Size 6KB
SHA256 58a0e0bb89c3be8eb145110022dfab5558e7f413b0a1a7bcfdd346dad597d664
MD5 ed6912863dc7bda65c55a6274ee7a9f2
SHA1 063d874bee514ea02a2c172225166f698211f290
SHA512 8aa46d84e57f6d06ad20b225dc934b7e82371ef04daeaa976795c12f82ff557806b78301530b39f8665192d86927e85e16e279b7059625b7ca59c241352c5bfc
SSDEEP 96:xHIUTUzBqGqcfuoK1zS0SSlBdv9jPyntRHv/H+6mBw88u8L4cnTghuv:qgRcfuoKZSST+9vwBw885
TLSH
T143E11D389008CB7F74B6776CAC6888316AB2013BB7BF68D250B654C4055CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\prefs.js
Size 7KB
SHA256 7b3ef0c03fce3f3ecdb47120080f5f7d103553df0e04bde45f4e1d14226c575c
MD5 747d4116c0fa979e207ac7e3e4adaf24
SHA1 b625e2abb571f5bcf0908cb5ffe99b13825b93c3
SHA512 d532af3b5ea098e490eafe30860c5311e2efa91dcb8dfac54a7f15db5c2e75a0a6f93f0e704286161c3b0a59a1b15ff6c7b34e1913e71de2414c0245fe13d471
SSDEEP 96:xHI1TUzBqGqcfum4ObzSZJSSlBdv9jKntRHv/H+6mBw88QX8L4cnTghuv:qRRcfum4XJSSa9vwBw88Qs
TLSH
T1B6F1FD789008CB7F74B6766CAC6889315A72013BB7BF68D210B944C5155CF3846FEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 caaa135865624d86efe69623770b1611366852c3e54ff10a2e453ceb3a102b99
MD5 3859baa3d3857fc169f87150bf6fc223
SHA1 e4b9c42bdfab037b48729197c3c04c8b1f47a659
SHA512 22db082477f597f2373191f329ec2e48be9c72aec93182fb0d4bb53eccf7b97873d8e94d685c15dacd0db7d9a1b1546afa07df59a7855e3d711ebdfc8d7367be
TLSH
T19D21D80BC8A73EF9B605829BE080CFF18692303141F16CF19588C956139E84D73CAE0E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 4339e980125250bef39b637735e68b409abd659cc2a3621a2862320ff55f9de8
MD5 029dac02b7793afcdb30499d405bcb59
SHA1 8459a654c9399b3506bacb8ef5ed168067ccf123
SHA512 2b302d87aa1cbba1b2bea1ed993fcadfcfbff5df09eb71c0a8a46f0227c2904439b403e22c5cd37fff7ef3568e1f1d55249a0a390a528bf85d80f5f31814eb3c
TLSH
T1A321B84BCA773EF97616429BA0808FA19692303141F528F06548C95556AA84DB3CAA1E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cmxtu0cq.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8c9126496141e08e7f068362b86833a7a652370fc5563e184f28ca57b36835cf
MD5 8bf258b1981ec2a09fe19047c1b36be6
SHA1 039cd65d4141e012c5affa973fdc7fe605fe4ebd
SHA512 5fef2260c968451c4519207fd57d5668e7de685c59b4512107c817549ac21f3bb9c1122bc7f51a8f6a12fda00b57a03bbba3dcf7933416e4b3cf369e633f8e79
TLSH
T18521D80BC8B73EE97605429BA080CFF18692303142F16CE19589C956129E88E73CAE0E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads