88d6c1f4c6f3d4d722423a7c9f1069ac345b11362baadabd3c4b7a303f452f6f

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
protections.pyc
Size 12KB
Sample260630-pegbqaex4r
SHA256 88d6c1f4c6f3d4d722423a7c9f1069ac345b11362baadabd3c4b7a303f452f6f
MD5 fa57937acabfcc1ae5c251c0e11e2c9c
SHA1 c61ca7ce8f6ab74a539b959204ded1fcd11afd88
SHA512 da0f870ed3d9b2dc78165b61663456abfcd37c4ff8b31994bbb04f6780ead79787ad7a1e687ca898a94202d7a990b70f4dcc5d1a1d7259ee7e95aae226abee98
SSDEEP 192:tHoTd3sa3N4Q5urc2PLFpuBLUuHdG/k3vaIIvXvU+uvsjyzW3V+9:uJ3sa3u6urpHuBLhHdck3c9kMV+9
TLSH
T13A422A7892A0A0E3FCD4ED3435D7388A7373C2959089E653BC74CCD1BE8591F5A6022E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	2024	firefox.exe
Token: SeDebugPrivilege	2024	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1336	OpenWith.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
2024	firefox.exe
3780	OpenWith.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4120	1336	OpenWith.exe	89
PID 4120 wrote to memory of 2024	4120	firefox.exe	90
PID 4120 wrote to memory of 2024	4120	firefox.exe	90
PID 2024 wrote to memory of 5884	2024	firefox.exe	91
PID 2024 wrote to memory of 5884	2024	firefox.exe	91
PID 2024 wrote to memory of 5884	2024	firefox.exe	91
PID 2024 wrote to memory of 4088	2024	firefox.exe	92
PID 2024 wrote to memory of 4088	2024	firefox.exe	92
PID 2024 wrote to memory of 4088	2024	firefox.exe	92
PID 2024 wrote to memory of 4088	2024	firefox.exe	92
PID 2024 wrote to memory of 1444	2024	firefox.exe	93
PID 2024 wrote to memory of 1444	2024	firefox.exe	93
PID 2024 wrote to memory of 1444	2024	firefox.exe	93
PID 2024 wrote to memory of 1444	2024	firefox.exe	93
PID 2024 wrote to memory of 3720	2024	firefox.exe	94
PID 2024 wrote to memory of 3720	2024	firefox.exe	94
PID 2024 wrote to memory of 3720	2024	firefox.exe	94
PID 2024 wrote to memory of 1340	2024	firefox.exe	95
PID 2024 wrote to memory of 1340	2024	firefox.exe	95
PID 2024 wrote to memory of 1340	2024	firefox.exe	95
PID 2024 wrote to memory of 1340	2024	firefox.exe	95
PID 2024 wrote to memory of 2400	2024	firefox.exe	96
PID 2024 wrote to memory of 2400	2024	firefox.exe	96
PID 2024 wrote to memory of 2400	2024	firefox.exe	96
PID 2024 wrote to memory of 2400	2024	firefox.exe	96
PID 2024 wrote to memory of 1524	2024	firefox.exe	97
PID 2024 wrote to memory of 1524	2024	firefox.exe	97
PID 2024 wrote to memory of 1524	2024	firefox.exe	97
PID 2024 wrote to memory of 1524	2024	firefox.exe	97
PID 2024 wrote to memory of 2028	2024	firefox.exe	98
PID 2024 wrote to memory of 2028	2024	firefox.exe	98
PID 2024 wrote to memory of 2028	2024	firefox.exe	98
PID 2024 wrote to memory of 2028	2024	firefox.exe	98
PID 2024 wrote to memory of 4480	2024	firefox.exe	99
PID 2024 wrote to memory of 4480	2024	firefox.exe	99
PID 2024 wrote to memory of 4480	2024	firefox.exe	99
PID 2024 wrote to memory of 4480	2024	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\protections.pyc
1⤵
- Modifies registry class
PID:2848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\protections.pyc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\protections.pyc
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270331 -ipcHandle 2036 -initialChannelId {5c4ed7f4-0bce-41d7-9e72-1081f69fc8fe} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270331 -ipcHandle 2444 -initialChannelId {1e4007df-708b-4a11-b4af-a37205a1e8b6} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 27274 -prefMapHandle 3868 -prefMapSize 270331 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {40c536d7-8c6e-4ad8-9b6d-4ff8efb9ffb8} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27274 -prefMapHandle 4032 -prefMapSize 270331 -ipcHandle 4044 -initialChannelId {1c8e5ea0-3b52-44fa-9dc6-7af22e54cbb3} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4464 -prefsLen 34773 -prefMapHandle 4472 -prefMapSize 270331 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3100 -initialChannelId {153f901b-a63a-42b2-80ce-b28108e6e121} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1340
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4504 -prefsLen 34929 -prefMapHandle 5216 -prefMapSize 270331 -ipcHandle 5228 -initialChannelId {a63369eb-ec85-4012-89cf-1eecb9dca772} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32871 -prefMapHandle 5720 -prefMapSize 270331 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3168 -initialChannelId {b7fa9ddc-39a4-4697-a373-d7efc1132786} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3172 -prefsLen 32871 -prefMapHandle 3040 -prefMapSize 270331 -jsInitHandle 3140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5888 -initialChannelId {4155e3cc-1d78-47f2-a456-fbf3ee657a01} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5896 -prefsLen 32871 -prefMapHandle 5912 -prefMapSize 270331 -jsInitHandle 5916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5924 -initialChannelId {0c26f445-f6ac-4c3e-89ba-b06e3302a66e} -parentPid 2024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s9p00y6l.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 66eca31b0191673f9e7e60aad119f848089eef2fcc1415813c6904a17093ef78
MD5 4ecb2280622d6321ad7cb138ab455dc2
SHA1 8308505804736f22b35e320e9c1adf4014678904
SHA512 ccef73c7173695d9bccc07ffb02cb5e5abf51f409be224b7195c3c55c6551eee59985c3b66600497a6740400ef95ab4cee75ce95220ec3bff45e1f9348fe94d8
SSDEEP 384:HPC9iO024YTo6J+Sl1xDnZBPsac4j0lpDII+ffz:v9ZYTo0+Sl7zZlsac4ID8LT
TLSH
T109528DB99F0238AA1927D0A1D9BD9244CD04E7BFDEE2D06616543C04CA447B9F4F68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s9p00y6l.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 de2e8d4b58e26d09649ea242004049d19b0a9014ef82230bbca9e98819e60708
MD5 0b072d085bab900385d7bf7e3c36f51a
SHA1 f4394824d008226fee5e80125bd57a09c5e7b911
SHA512 24856a9288884b6da2c1304c833a36247833e25bd4efaa82a90cf7ff7d946e1df3bf435ff59ec522c4d70ce813b5d6d9e5164126a1dae876ecdbf2440e97bac9
SSDEEP 384:H9XghOiO024Yzo6J+Sl1xDnZBPsac4j0lpDII+HL5:dX+ZYzo0+Sl7zZlsac4ID8Ll
TLSH
T1D7528D7E9F0138AA1E63D194D5BD9244CD04A6BBEEE2D0651A143C14CA847B8F4E64CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cec0d1aa-d537-48e8-8540-7ef68c547103.zip

Path C:\Users\Admin\AppData\Local\Temp\cec0d1aa-d537-48e8-8540-7ef68c547103.zip
Size 3.7MB
SHA256 d594c4c1e82d2293c2996e1a0d9f687db132fc85335d037bf53ae54d0d2bf4e5
MD5 85be32534f6db5e64f5fe96dd890234e
SHA1 43b8d5861b73ce5184717c7e31e93d5b10b3adeb
SHA512 1945d9efdc163ad64cbe3001456324768022556704ff3d8a99a1bb42f1a820c76a3daf1e3707a1ca7b59af452fbf5b7b084086b206c57a2fa930078f468b0ce5
SSDEEP 49152:MtrhrApFrJipqGsR2ubf9PvX1ccJkYhcqIqKDWl2YGAqS42PH1Uqcxhcq2MzcwMD:MtruGLUNX17ZgDWl9GA9Pl6Tzcw1s
TLSH
T1B406F175D69C1A09CDCF83BE850C2FC2987C4FA68054A96BFA6F99715CA33E61F448C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 b74c7b5aaa72cc67fe9a3246ee71fcda1247e43d2fb6791bb05e51f1b3b431d7
MD5 bee7f8425f42799e64e77c487e6f9d2f
SHA1 33ed7b41d543831e4714b022353b8a587355d25e
SHA512 37baf72b6f3180edc6691f70074e4ec0fc82e8c9701643cbc3ae42398ad1b6fb4f43393f6e39e82b66ea5f703815f9fcf76cc3035d38aad5eca90e67ef386930
SSDEEP 768:Wcy1lCCxS81rGcm+uaQRaxA1lGbdb0bebw:iCCxSQjQR
TLSH
T1BFD20144EB2E953FD42912BBDCA50B002F79B88959192F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 641897b702403d6b9a77f6d7c04b9ac4d7cc530f3d964701d2a4417733f6d573
MD5 54f48a06314d09c313df3af8903717d2
SHA1 c0706c6f0f3416c51456d099e647844f4938ff04
SHA512 c072c213e7b389e2cee186751e4425446ec08a66afd22c8d9dbf3b3a9b4bf4f0c68361d6a223c90a624788ca8d4fc085c60538c45ff0880563110a1efc8a40d9
SSDEEP 768:TZVV0FAGcm+urAQKDYPvA1BPbjbKb2bebir1sNO:TZVVkeQqJ
TLSH
T1F7E2FE44EB2A953FD42812BBDCA60B002F79F88959192F573A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 a4dfb0d753ae086bc360acebbc597f20d8c41a3e6ad4e6e68614b00b3ed1fced
MD5 939137c604626560d9b7b617258779b9
SHA1 a9806d28596f253a85ad01a0b8fcb5f78959839d
SHA512 3d7eb09f22c015b40eeeabf41abfe7f50c059476482d2ab7b54faf717ad441278f880647e2bf6f87d6810b390ff4bbc1fd53cc77b1dd36642aee5b1d97644ffe
SSDEEP 768:e1cZVV0FAGcm+urAQKDYPvA1BPbjbKb2bebi+NO:ZZVVkeQqp
TLSH
T186E2FE44EB2A953FD42812BBDCA60B002F79F88959192F573A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 3610ecf360ee7aa91af374ebc185f247f7b5da32d8ce397d7ddba36bfcb7a329
MD5 a11b88214be77ff217759d3f775f4eeb
SHA1 dff884e5f12ee0bb8c8b5fcc456971c7db2be018
SHA512 e7af39e88d93bff565c098656c087b347d1620f61379a9dd33d5660ff29bc174280193a110c4a250074d42982f6fb4b066f6ed8fd6d2b3abae58f7726adec9d9
SSDEEP 768:xNy1cZVV0FAGcm+urAQKDYPvA1BPbjbKb2bebi:lZVVkeQq
TLSH
T1FCE2FF44EB2A953FD42812BBDCA60B002F79F88959192F573A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 713337a06c72a18871b9c94c749f9d0c8e8b0ed24d22ea58efe6198f87fc9b53
MD5 d3104c4069718447b2eb55b5cdde1594
SHA1 451fec9369a9fe8e3f8d1c5bd9ad26176ca2e046
SHA512 88fd3e36b2451d767e0417a1eca96c598a53731247578ce40a08788eb08b479673db0df70f616896dbae9483c368be997f25a55794df1e81984b4299a3990d0e
SSDEEP 768:+jR1lCCxS81rGcm+uaQRaxA1lGbdb0bebwq:oCCxSQjQRq
TLSH
T14ED2FF44EB2E553FD42912BBDCA50B002F79B88959192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 702cff92c8975e7ab438982f74ddf9f2215db7d98e433cf0ca1adee8e2d28399
MD5 66a9c3ab85a406ff9b1211d696ef7a0e
SHA1 1254125a53a715b9161015bc017bb43bda431bf8
SHA512 d28852094524f717c318f9247b4ecbcddf287187c7807ad5a12127e568862700af43af59055d600ad7d164284ebf7ffceff903f53185c41f46723f76cc04164a
TLSH
T13821035C3EB88D6EACCAE2987451028F57598E4246C71C431E42EF8DCE91AD9327E439
MD5 SHA1 SHA512 TLSH

Submit Download

1c7532cb-22bd-41cc-934d-88a0b48c78be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\1c7532cb-22bd-41cc-934d-88a0b48c78be
Size 235B
SHA256 6414696de606feccabcbd2e6340283ad142ee72a8117e4b627ab621be65caddd
MD5 8c7cbd763944f67021629deb185204ae
SHA1 b0025b10ea88f27ec84ab185d8157283837617cc
SHA512 1e924efbd6091d8e0740527189b6f8b779e936750c1ae425f1210b23f6d5812fc9c5d8dc0d0a32c31da0ee507f097b880e4794b5d81b5e2aab17b470c23f9fc0
TLSH
T19BD097816488732D08205F06B0A029C630884C3350B4A850EAA109B8ADB9ACC01B282A
MD5 SHA1 SHA512 TLSH

Submit Download

31eaf860-109f-401b-ac23-5b70957070ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\31eaf860-109f-401b-ac23-5b70957070ae
Size 235B
SHA256 fe44d6007aeb7240e8755869ddafea50c077e40de23040c5eab421598b78716d
MD5 8810fe0f6c1529cf2747ca94e5d154fb
SHA1 cccf276d84225fdc6be1f8d564cfd12889b37c56
SHA512 5b7841c385f4c66f5d3a1bfff70ed3a0f4395c3818882596477e7442165a8d9bf6efba7ef8f75edd741083e5eff13be8dcf1a61b250c13b57be886f23a0edf0d
TLSH
T114D097C818D877BD08280F1BF0A02EC6308A8C332071682099904438EBB8EC82361C1A
MD5 SHA1 SHA512 TLSH

Submit Download

3c60b0f8-9d25-44ae-9eb0-a23b290750bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\3c60b0f8-9d25-44ae-9eb0-a23b290750bf
Size 2KB
SHA256 a4161a8f4f901b9c4b950b44f2028587c39ffe595c06c69f6bf1a0e1168f5276
MD5 80ebe3447b277ff872233641e085ff29
SHA1 a361aea09c56c2daeb2178d51dc2f2c4bb50d42c
SHA512 17a4dc28823b1646eca29fd5b4b00cfb156d7c1a1caadc5c06f8e739545919f877626f108a5d3c33af69ba61821e3511d6bda02385b207a748ac18cfb7cb285c
TLSH
T19D41445C3E78AD768C86F65D9082238E53A49A4311C228833E52EF4CCD967D9736E51F
MD5 SHA1 SHA512 TLSH

Submit Download

88a0ae48-04ab-4a83-9aee-c77f9ad2ac4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\88a0ae48-04ab-4a83-9aee-c77f9ad2ac4e
Size 871B
SHA256 8f6c5a80ba419958884f6d3fe96d9b84fb067ed868d785d43e769a33e453ee8f
MD5 35e1b0d479d02361fb7bb387d8ad0684
SHA1 1b3318a1bba241bf58d2a1905e303960055e2955
SHA512 f7eb972669b66a7f48ae6088562988ee9ab5ef09a15da6df19784f54544e8bf0b9c27d8e752c822d8d0d7285ef77e6ad75e768d736c63ba74f3cdef4562a3c84
TLSH
T1F4112380C734BAB3CD68E14B81A237854BB4792380DB58143CB16D0C0DAF669D79AB07
MD5 SHA1 SHA512 TLSH

Submit Download

b63ae7c4-2c34-42cb-b40a-04924e3735fe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\datareporting\glean\pending_pings\b63ae7c4-2c34-42cb-b40a-04924e3735fe
Size 886B
SHA256 79edd6439ce70989680d2eafb2f7c6be85f28e968ced7e19497c59b16bbde1e8
MD5 442fe7a4dec362cb2021b7f246570189
SHA1 130e20a10f595f86a4a7c77d991dddd7f31bcea2
SHA512 642b4a99bb83402a21a402e5d9f37e7cc53d738dd247b89c32079ce5fb04e18c0c92a733a7e6ff83dbaf636e5ef478d5ebb8392d0a9066149d5461453f97050d
TLSH
T1BA1100818624F9B2C96CA15B85A277828AE47523C0DB0D047D75AE0C0DEB59DA39B70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\extensions.json
Size 16KB
SHA256 af613e5cedd781fad2f473941f5a3c3918a3d87f6003c54edc1f0736f97c8fb2
MD5 3cdcff04ba98d64c991fe8b0fd63bb3a
SHA1 70543dcc5d1add61280ed5697640d9b19b7ffd18
SHA512 007f2b76eda52d2ae4fa60ffc5911b7dc733b4e191198f7478f8750c93fbc3dcc24523ea6abec82e00a00e96703691fc9f2e34d26726cfb10c01489452055da3
SSDEEP 384:5kI4veUmldvc8dhWH94zc96oTL4H5yL4PFL4HLL4H5L4Hl14ho:aI4GRfFXW486o424d434R4H42
TLSH
T13D72531545049EB8294FA78BAA36BD02C37D473B70845C78F4DD8FC842FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs-1.js
Size 6KB
SHA256 2fdafe0767336b6b6d045bcec2630a41ce6a597674c69c3c668691d395eb066a
MD5 b9bb783a3e8411dc31d1a323f78258ab
SHA1 7292e80bf8d389023a30bdd0f0d16884d4953abc
SHA512 8f3c12c8565fd69dff7cb29e6536e58983c11a25aadbd1a218e84d79ffede7d6e46f42be5dae41ce0ec09272e4b5dc77027a7d6208b1e3b28012be9742130608
SSDEEP 96:xHV1UTUDqGqOTfkyA1zSuSSl+dv9j3In6HHPtBw88u8L4cnbIeZ2W:71eRCfkyALSSIHPtBw88GI
TLSH
T1ADE13F7895088F7F74B6776C6C6488716AB2023BB7BF28C350B65484050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs-1.js
Size 8KB
SHA256 d5e9776c8db7ed8c22f787eaa40fb917c533a1ea8346ada10a3fb5642c2dea0c
MD5 bd456fe095884dffe57d4a2dea55f9ef
SHA1 77f998a941338ce3220afc8ad9cddee4f3de4a9c
SHA512 fec98bb0ae86f3a9f3a6ed4e89f412900d1fca311fa1f8688879e47b98de4e7d48ca1b424337b2120a0a1bc91c990d4032d5d361dae9453a3288db84b6bac1f0
SSDEEP 96:xHi1ZTUWPqGqOTfkyAObzSWSSl+dv9j2n6HHPQs2nKBw88kbWW/8L4cnbIeZ2W:41HCRCfkyAcSSSHPj2nKBw88eWWNI
TLSH
T18402FE7855048F3F68B632BC6C6449725AA2063BB7BF68D311B95485050CF3446FEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs-1.js
Size 6KB
SHA256 11ab5b09fd403e58b57dc63e53751e700d1638c94d3fb71d22ea1ec2c829190d
MD5 efac320dfe90c3b1b056cc2462761056
SHA1 1a8ddf29c897a3f8744e7d944c6c443fecdff4e9
SHA512 af26c7a92acad2f7889e22c9d571b7258af40148748905b7d6c6329ed987cba34fed05318c9a49a41ca446699e43eac4d7ff35db4d8f795daf243b30596e3fa6
SSDEEP 96:xHV1UTUDqGqOTfkyA1zSWSSl+dv9j2n6HHPtBw88u8L4cnbIeZ2W:71eRCfkyADSSSHPtBw88GI
TLSH
T133E1407895088F7F74B6776C6C6488716A72023BB7BF28D750B65484050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs.js
Size 7KB
SHA256 2ab10f55ca57c35b6c4cb6c48fc48e022e890f0c217aadc95738eebd6084191d
MD5 57e5e61e2fc0d47cd399451e2bf47225
SHA1 cfb89af9fdd4a0e2f7dab0b25b1cfe0e433e8934
SHA512 45ea2f45ab2ee7037ec73214c6fa43d60bfe5c16dedcfff83a21e0b272b731b94787973a137d5db88bf7d99df910eb920be92834255a4b3be5100e1892326391
SSDEEP 96:xHV1UTUWPqGqOTfkyAObzSWSSl+dv9j2n6HHPtBw88u8L4cnbIeZ2W:71GCRCfkyAcSSSHPtBw88GI
TLSH
T150E13F7895088B7F78B6776CAC6488716A72023BB7BF68D350B654C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\prefs.js
Size 7KB
SHA256 a7f6c1cf84cb09260f7a60ebc3653b58a69b3123ee3ad4e81fa586577797a833
MD5 9481c88eff863d139f5a02dec5fdc4e9
SHA1 e16ba06c887d685b17f7c928f48868d2ab45003a
SHA512 e452cb8aba4b2eee5d4148c87db31bb3a3d606f60f90bc15d82a1e3497e3ffedfb73a49c41ddb06baa1ed8974aff2720e8af35d511070df14572563f7d988bdd
SSDEEP 96:xHi1UTUWPqGqOTfkyAObzSWSSl+dv9j2n6HHPKBw88J8L4cnbIeZ2W:41GCRCfkyAcSSSHPKBw88jI
TLSH
T1C2F1307855048F7F69B632AC6C248D716A72023BB7BF68D310B954C4054CF3846FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 7e783d5223147d941732700eba0e8c7f990b9e9e22f4ff4d72744dfab8c13202
MD5 337e92ef085aea62524632e9753700d9
SHA1 f97b7ccdab6a87e9a1e1e725f3c99819623ba649
SHA512 0e34aec99814f4444872f25fcaa5e6ecce226ff991e2243adc30e5a76520c4c2f4b230d82439687c4b21697bdbad5c1d409cf2036ab45d98a6bf255d870d116c
TLSH
T13111E9125A1FDB759B20E12BC4E62BEE0B571006073D04E0F2ED230024686E7B2ED74D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s9p00y6l.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.8MB
SHA256 977334391c38dfd32ebae2e37774a617ded2acd299441aea355e5304e9775011
MD5 14bf938e3ca1ad3c3a931656818714ff
SHA1 99daab117f7bab6d28afce9d362ab7412c653ccd
SHA512 3056450aaa4172731308634ec42ffc99617c3a4806f2fea8696dcaa7d4a6926dd0b575199aca9e0410fbfd1f34ca4539ffbfbbd285149350cc23576833b3f3e3
SSDEEP 49152:qqtXGPYa5tsuxBYmNmbpGFpw8oDyny16TBDJGB+3SbdpzfmQcI7afPJFqaM86+yl:/VkmbYF68oDL16TB9QpC
TLSH
T16CE63A9270E0D692EB0186F2B31F43EB317FC1DC20E589941678B65C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WqfK9DR0.pyc.part

Path C:\Users\Admin\Downloads\WqfK9DR0.pyc.part
Size 12KB
SHA256 88d6c1f4c6f3d4d722423a7c9f1069ac345b11362baadabd3c4b7a303f452f6f
MD5 fa57937acabfcc1ae5c251c0e11e2c9c
SHA1 c61ca7ce8f6ab74a539b959204ded1fcd11afd88
SHA512 da0f870ed3d9b2dc78165b61663456abfcd37c4ff8b31994bbb04f6780ead79787ad7a1e687ca898a94202d7a990b70f4dcc5d1a1d7259ee7e95aae226abee98
SSDEEP 192:tHoTd3sa3N4Q5urc2PLFpuBLUuHdG/k3vaIIvXvU+uvsjyzW3V+9:uJ3sa3u6urpHuBLhHdck3c9kMV+9
TLSH
T13A422A7892A0A0E3FCD4ED3435D7388A7373C2959089E653BC74CCD1BE8591F5A6022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads