fb6dfa3f75d325e644262887adb24bfaf138216bb9cb419c107a02f85bcb99ae

Analysis

user interaction
yes
max time kernel
112s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kouma_update102f.exe
Size 820KB
Sample260627-aahawsgs3l
SHA256 fb6dfa3f75d325e644262887adb24bfaf138216bb9cb419c107a02f85bcb99ae
MD5 8d202228bd9a2decf71d54dd4a5b7b59
SHA1 1513e58a1476e6dddf2543234271d97cc99b57b7
SHA512 fa064ad1e8abfc04ceee3de18ba3f36d7a9298e14a252405db0a96cd28eaee19a948cc2e0bc4b723f784d97cde8c0c9907417989f8710176fef7a23486486123
SSDEEP 24576:aA3T8EoTOTNuu/MpjAAsvlQ/NhCtQfBcpYsjQ:jDnLTNugLvl0sQfmpFjQ
TLSH
T1BD05D023953BA223E94D4B7BCA7F1F6D8B776122315B30490643B8E46E70374D9762E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kouma_update102f.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	firefox.exe
Token: SeDebugPrivilege	4792	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe
4792	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4792	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4792	3772	firefox.exe	94
PID 3772 wrote to memory of 4792	3772	firefox.exe	94
PID 4792 wrote to memory of 2812	4792	firefox.exe	95
PID 4792 wrote to memory of 2812	4792	firefox.exe	95
PID 4792 wrote to memory of 2812	4792	firefox.exe	95
PID 4792 wrote to memory of 1500	4792	firefox.exe	96
PID 4792 wrote to memory of 1500	4792	firefox.exe	96
PID 4792 wrote to memory of 1500	4792	firefox.exe	96
PID 4792 wrote to memory of 1500	4792	firefox.exe	96
PID 4792 wrote to memory of 1856	4792	firefox.exe	97
PID 4792 wrote to memory of 1856	4792	firefox.exe	97
PID 4792 wrote to memory of 1856	4792	firefox.exe	97
PID 4792 wrote to memory of 1856	4792	firefox.exe	97
PID 4792 wrote to memory of 2824	4792	firefox.exe	98
PID 4792 wrote to memory of 2824	4792	firefox.exe	98
PID 4792 wrote to memory of 2824	4792	firefox.exe	98
PID 4792 wrote to memory of 3016	4792	firefox.exe	99
PID 4792 wrote to memory of 3016	4792	firefox.exe	99
PID 4792 wrote to memory of 3016	4792	firefox.exe	99
PID 4792 wrote to memory of 3016	4792	firefox.exe	99
PID 4792 wrote to memory of 1104	4792	firefox.exe	100
PID 4792 wrote to memory of 1104	4792	firefox.exe	100
PID 4792 wrote to memory of 1104	4792	firefox.exe	100
PID 4792 wrote to memory of 1104	4792	firefox.exe	100
PID 4792 wrote to memory of 5944	4792	firefox.exe	101
PID 4792 wrote to memory of 5944	4792	firefox.exe	101
PID 4792 wrote to memory of 5944	4792	firefox.exe	101
PID 4792 wrote to memory of 5944	4792	firefox.exe	101
PID 4792 wrote to memory of 2640	4792	firefox.exe	102
PID 4792 wrote to memory of 2640	4792	firefox.exe	102
PID 4792 wrote to memory of 2640	4792	firefox.exe	102
PID 4792 wrote to memory of 2640	4792	firefox.exe	102
PID 4792 wrote to memory of 3272	4792	firefox.exe	103
PID 4792 wrote to memory of 3272	4792	firefox.exe	103
PID 4792 wrote to memory of 3272	4792	firefox.exe	103
PID 4792 wrote to memory of 3272	4792	firefox.exe	103
PID 4792 wrote to memory of 4548	4792	firefox.exe	104
PID 4792 wrote to memory of 4548	4792	firefox.exe	104
PID 4792 wrote to memory of 4548	4792	firefox.exe	104
PID 4792 wrote to memory of 4548	4792	firefox.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\kouma_update102f.exe
"C:\Users\Admin\AppData\Local\Temp\kouma_update102f.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4608

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {99111348-d538-48bd-8c45-287e88500a5b} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {2d885152-7460-419c-a5f8-1171f10fb4aa} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 27274 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {f2488c71-093c-41fd-9cee-8062f039e71a} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27274 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 4164 -initialChannelId {09382d4d-e6e7-4e6f-98ee-d6ef17a016d9} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712 -prefsLen 34773 -prefMapHandle 2792 -prefMapSize 270279 -jsInitHandle 2944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2768 -initialChannelId {a26ace5c-6a1f-4ba0-9036-152ca6083fa9} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4936 -prefsLen 34822 -prefMapHandle 4940 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {43910506-d510-4a00-9edb-ee4b35a050b1} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2752 -prefsLen 32952 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {40822cac-1d59-4992-a588-575852ff8a7f} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5684 -initialChannelId {86e81abf-73c6-4d6c-8f32-55071ebfbeaa} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856 -prefsLen 32952 -prefMapHandle 5860 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5872 -initialChannelId {bc634426-ce2c-42ab-a42f-405e4223e24c} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2640 -prefsLen 36541 -prefMapHandle 1636 -prefMapSize 270279 -jsInitHandle 1640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1240 -initialChannelId {a5a417b9-98ef-4eab-83ed-937f33ffbf14} -parentPid 4792 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4792" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hfzslj2z.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 a44710a273b54d8d0dc7dd400ab3f627fab6df1d427bd43caef878b6ad1da74e
MD5 3a025302529f3e77a712244e567a0d61
SHA1 c0f6b05721fb2be0ce7601fd66a2c73ccae8cacb
SHA512 f6cf251b6600d7c4edc2351e4159e2a1c59c1b8159394455f8f78bd794c0fb621c7d3a353147c27786d7d681efd6f720f3382eda602adc905a0860f2f0ac8283
SSDEEP 384:HPC9iO024Y0o6J+Sl1xDnZBPsac4j0lpDII+a/yvp7/yvQ+:v9ZY0o0+Sl7zZlsac4ID8LoyRTyh
TLSH
T17E529EBE9F0238AE1927D1A5D5FE9244CD04E6BFDEE2905619143C04CA447B9F4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\db\data.safe.bin
Size 29KB
SHA256 7b5cdbb7721893ef924017cfb6d8e865a69c0c3af7f7eda1153a5a4204aecd9c
MD5 423de582d8af8d6e1929a884393114af
SHA1 757c1261b13b3476aea0d438399f935623f69b44
SHA512 d3d80963f1fed91223f8fff5c3d1350ed9a54889bceba755270971d047841796c17e146d05aa375d33740681f0ca105e199551c74944c95109ab7bc60432cda3
SSDEEP 768:WCZOUT6ZGcm+unh7RiR8H511AbJbRb/bjQY1irb:WCZOUeehdiP4
TLSH
T165D2F144EB2E513FD46912BBDCA507042F79BC8A590A2F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 46e734b7a7ae63ae95a188a9c90f05b46f8b793944514894addc9bcb7dc25e78
MD5 b702d30182173cec757c0a8825959fb1
SHA1 67a5106494ca600decdaad703592f854708c4482
SHA512 e4f7d0d820fb503cb467eca83741c0e33515a2f0007bc62f5481b6e8f04e7ded055e55c0a9a72c93b7faf0c58e4349ece367d8675beaa18323792252d3282e84
SSDEEP 768:GvwY1lCZOUT6ZGcm+unh7RiR8H511AbJbRb/bjz:8CZOUeehdiPz
TLSH
T1B5D2F144EB2E513FD46912BBDCA507002F79BC8A591A2F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 5982138dc102e51c8d77f3fc0afc25470d1b324c49bf14c8acbe282004cfad02
MD5 54fea8d6d2f0b73b0544f0f6445382b7
SHA1 fd4006053dbc5acda5c5935fa200ed7efabd19ad
SHA512 0d46e2b5d7f27eb5dd8fe8f8ef6c49aeb9583e89a6ca8a35b39dd8ff6e2d88f7a1e777dd4734456eedb7a5e762c8e0c97a4501844f98fe4e2c1d69939a51bf55
SSDEEP 768:gY1lCZOUT6ZGcm+unh7RiR8H511AbJbRb/bjfdb:1CZOUeehdiPJ
TLSH
T159D2F144EB2E513FD46912BBDCA507042F79BC8A590A2F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\events\events
Size 1KB
SHA256 903cc0da05fa697775311c82e14bc161ef178f3b70b5b49fa9dcec0207f1f9c3
MD5 7b7b0cac3ea234475e842a14f9185419
SHA1 076e9ecfae895638adaa5ae15c93e3fad3d3970b
SHA512 f426c8f1bed9072f9c04a0d029a3120750afa4934b5502719da6dcd6317ac8d2e75e8c479368ac9cb4ac25cb2de492e2bed25e9e452c65db97fac2f734c4402e
TLSH
T17E21485C3DB84D2AA8EAF2987456028E93954A060D871D474D13FF8DCE85ED9326E439
MD5 SHA1 SHA512 TLSH

Submit Download

286c016c-088e-4d4b-8699-d5e58079a879

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\286c016c-088e-4d4b-8699-d5e58079a879
Size 235B
SHA256 d099be20bebc2aad9d929a2e9e0f195573d5e7f15b9d635f1a43ed1a7c993e98
MD5 ac7e6ec8602ae77879924f13ecbc3c71
SHA1 3e5d5cc22087adcd3133182697361514f3ee3475
SHA512 ae410185e65559b4eb7a7bc49abd39964ed9abf0087b783352c83870b024557746e15c2fea185dd62d13f46b1122243ea72d32d9b351f9f37bcf71dd0f558250
TLSH
T145D097D01C882B5C0C100F02F0A069C330448C3314729850C59989B59AFEAC8025286B
MD5 SHA1 SHA512 TLSH

Submit Download

61dc918b-7596-4ca5-8354-b7f60facee9b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\61dc918b-7596-4ca5-8354-b7f60facee9b
Size 235B
SHA256 70050a55ed563d5d3e71604abcd9f7c01121721c9ad2040c7fe239c5ff02c787
MD5 250441a0293ce50b49a840c3cbc8bffc
SHA1 c2453a2b1d66122d18cd4d3fd1fffd857ce8e2ee
SHA512 27896f79395cb5cea55fb5febe1a1df7ce80ca792668829eef8568e70edf5e1372bb160b8dba2c05ae9fa74d0f61310c870c0edfbb0a1cdcc2754edd71cd15d4
TLSH
T14DD097E0188823BC08240F03B0A0A9D2304C8C3320795820D96446349AFAAC881A282B
MD5 SHA1 SHA512 TLSH

Submit Download

7562a6fa-5d17-4929-86f6-c47b47e080f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\7562a6fa-5d17-4929-86f6-c47b47e080f7
Size 886B
SHA256 c82605e2e2291ae8255c7b1a3f503e414f7e6cd33d26e45b4eced61a4c40cb18
MD5 ef3e8e3ae8758cadff5eb698611f1520
SHA1 153d95d801ba036f2b68114d527e98ccaa079890
SHA512 5eba5fadf422cdbacfd6c0cf118dc4780225665ee662f033fca1cecaf270d8fe0249fa6f5bb0cf9bcd224a68c744bbb6a4b999137ed59526c88dc8b2ca0046e6
TLSH
T1C31100508679B5B2CC7CC24B84917B8B8BE03413D0DA58247E946B184EBB21E67AA307
MD5 SHA1 SHA512 TLSH

Submit Download

c6c252db-8fe5-4cbf-8d40-e296e0d0fbaa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\c6c252db-8fe5-4cbf-8d40-e296e0d0fbaa
Size 2KB
SHA256 8feba1ee4af9bd157d1427480f3209288feb8b7d40d44db9e2e14c9daef22ca5
MD5 b21efd6bdf5b0b4126104ecbb55ffdac
SHA1 180f899970fe3c8373f1a85a3f9208041c501624
SHA512 24e2b282f4cbeaa05dbd0fc094dd0e3d8a2e2c0c87bf33aec14f8c4c8b2b88abc7c5dbf1e1cac28cfc65291aad5a389ada7eaaf0ab3ecf532bddd73de9175056
TLSH
T1E841115D3B785C7A9DDAF25DE442328E9361890300826C83AE51EF4CCE9269E236A11F
MD5 SHA1 SHA512 TLSH

Submit Download

f0e52e41-83fb-4cf6-9d1a-9084acb8fc88

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\datareporting\glean\pending_pings\f0e52e41-83fb-4cf6-9d1a-9084acb8fc88
Size 871B
SHA256 5e8933355c595fdcb4c957cd755b15ba70c119877aba0ad45bde803a8db107ed
MD5 70ca796a3f97e403257231c444905f64
SHA1 ae298028c3c7ea089eebb2c9450b2db5acd35a36
SHA512 72e86a49beb82868044d5991f85634ffa93971b239a01fad05d15bbd5c8568af2090b743e3639b71b0bce4cd199c52d611902643579f2378a9492c70d787f7af
TLSH
T188110C80CA35B1B2CC7CC24B84913B4AC7B4751380CA48143CA06F484EBE61E976A307
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\extensions.json
Size 16KB
SHA256 16a71da187f950932d898cf2b2cb89a9c182443ad05eb276bd3409a1a5b3282a
MD5 0d857d410ba82fb9987f1eeb99178a56
SHA1 0855f7be6f0253c894d8ef3a671c7f5136ab44eb
SHA512 addc3231239f8a7c67e68dcfd59f9231e607709903547cd657e22d5aca800356f3f982fcfb05bf1dba3a522b4ea1c401c6ac08ec1f6ff3246b720f3acf0fa868
SSDEEP 384:/2kI4v5Umldv08dhW/94zf96oGL4HKL4PJL4HeL4HhL4HRm4h1:BI4hRfdXS4p674Y4Z4E4Z4M4b
TLSH
T1E872531545049EB8298EA79BAA367D01C37D433B60845C78F4DD8FC802FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\prefs-1.js
Size 7KB
SHA256 39e42c14d403d296d91a581ce0b2e0f89871d6fbeb583842fbb0bbdba1190bd1
MD5 bbb459fb6aa119d6e9cb7eae5a08dd88
SHA1 381cbdfabef643efa696a7aafd5136e31d952e28
SHA512 86065c12f9c277da81f1658724a72888d47f00e33fcfc769e9c1f530d39e1450f037ca8334654a16bb7f44ccd5962783ac2b03aea2e48aabd7ca7cf37b639f85
SSDEEP 192:yhIgjAaCeRufqToTTqKNuBcTBGSSmz0JcR6IBw88MDivBA:yWgjAaCHiacoPzt6+wcDiv2
TLSH
T1A3F10E789504CB7FB4B6766CAC6888315A72023BB7BF68C650B954C4015CF3486FE6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\prefs-1.js
Size 6KB
SHA256 0d1e92e075c873a0b98635609ddfb30b60cf96af2ec41cbb8c0eaad73670430f
MD5 32d38c46caacd8ab91e94f3398154916
SHA1 2ca6dedc70e3037845973f8c7bb6997a8d691d12
SHA512 8dea57f91119f86638f1beeae76db076a70b80825b083dee1740c91afcfc06de97317513ac2960fe9bf3bab76c27b77017bc1fbcfe7ecd91d054a38a634f6c64
SSDEEP 96:xHchUTUXqGqufrqKN1zSIBcTBGSSlAdv9jXOnwH0JcatBw88u8L4cnH9om:yhKRufrqKNZBcTBGSSmz0JcKBw88LP
TLSH
T1ECE12F789408CF7F68B6776CAC6888316AB2013BB7BF68C650B554C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\prefs.js
Size 6KB
SHA256 b50712be9e3c723be1e74df20aee1f45e4f98c1e943e368461d4548d9a9bf37f
MD5 7ec1896375e725a91a889a53a6e34beb
SHA1 95b30d14855aaad6887cb0040263d4aa8df4ca82
SHA512 6d6dbe69a8b0abcd2e568d13c798fe1a233129068c471e366f739daff776284768476ce619efcf188784523d56749bdfcbf3cc68aebda48da7becb02a199ba56
SSDEEP 96:xHchUTUXqGqufrJ01zS28SSlAdv9jddnwH0JcatBw88u8L4cnH9om:yhKRufrJ0v8SS/0JcKBw88LP
TLSH
T107E11E789508CF7F68B6776CAC6888316AB2013BB7BF68C650B554C8055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\prefs.js
Size 7KB
SHA256 60d98a02edc075806cabc07a28e5f4b12f755404e751a20d1e467bf0bdf14c4b
MD5 f79bbe8b51add6937a5e23ef57e5f40d
SHA1 6e65bda907f5f15b640be950e60e0bef97f710d6
SHA512 08d4a67058f8ca402313f9f28350939fb07bfe1953b4cfc71d3c745f1bf99a397079cf8a7ef26e96dd4ad79d7ebf95ca5abd7fc080a0782aab23f8487d2d7583
SSDEEP 96:xHchUTUXqGqufrqKNObzSIBcTBGSSlAdv9jXOnwH0JcatBw88u8L4cnH9ofGS:yhKRufrqKNuBcTBGSSmz0JcKBw88LA
TLSH
T183E11E789518CB7F68B6776CAC6888319AB2013BB7BF68C650B554C8015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hfzslj2z.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ef5e6ba0e63021f8959d4fa11d2214dde0ea9101d77e5487edab1d7d87e6ad39
MD5 f1762a50df54dbe0913af8e194288d16
SHA1 8f48b367c53b164005c035f464ff440c1798dc8f
SHA512 8820120bec592592bc808d9691ae8d88865fe76e5581eeabd4adb6af1eec49543b75f81c9527dd7e66972984564c3e2ca9cf41d0e5cf47a6f6ec356f03ac0dd5
TLSH
T1FD210A139C6B29F57B515119CA435FF2C76E2430847438E081CD4F03B19F545B285129
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads