2b030f6eda59e36dc335d7229dec3ce8459c327d1ada71b1dd661a5f9266b5b9

Analysis

user interaction
yes
max time kernel
28s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 21:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http-browser1.6
Size 47.8MB
Sample260703-z5fszsgv21
SHA256 2b030f6eda59e36dc335d7229dec3ce8459c327d1ada71b1dd661a5f9266b5b9
MD5 4cc69c55d05f630f38fea60fddea671f
SHA1 e7c7c9efc7cd2887de920e6eab9c6348aea748b6
SHA512 b9ed5c9605d51b69a4397b6eb1d16fb7f475776a2b5d0004397cca91eb2aedb2a4483d1e064b12c754d6001d8b98423eb5108b93b9dc9b929f597a651cd671c9
SSDEEP 786432:FuyPtsgt1j9ubslD/3+WTjnCD2WllgQdSrY+f/I4B1Y:fGgFubslD/3+WTjnCD2WllgQdEHwI1Y
TLSH
T13AB7900BB2E31868D1A3C034476F4252A732F8265235ABBB314D97702FA7EE45779B71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\.6	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\6_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\6_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\6_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\6_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\.6\ = "6_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\6_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\6_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\6_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\6_auto_file\shell\open\command	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	firefox.exe
Token: SeDebugPrivilege	2396	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
6448	OpenWith.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 6448 wrote to memory of 6072	6448	OpenWith.exe	91
PID 6992 wrote to memory of 2396	6992	firefox.exe	94
PID 6992 wrote to memory of 2396	6992	firefox.exe	94
PID 2396 wrote to memory of 2876	2396	firefox.exe	95
PID 2396 wrote to memory of 2876	2396	firefox.exe	95
PID 2396 wrote to memory of 2876	2396	firefox.exe	95
PID 2396 wrote to memory of 1672	2396	firefox.exe	96
PID 2396 wrote to memory of 1672	2396	firefox.exe	96
PID 2396 wrote to memory of 1672	2396	firefox.exe	96
PID 2396 wrote to memory of 1672	2396	firefox.exe	96
PID 2396 wrote to memory of 6800	2396	firefox.exe	97
PID 2396 wrote to memory of 6800	2396	firefox.exe	97
PID 2396 wrote to memory of 6800	2396	firefox.exe	97
PID 2396 wrote to memory of 6800	2396	firefox.exe	97
PID 2396 wrote to memory of 5428	2396	firefox.exe	98
PID 2396 wrote to memory of 5428	2396	firefox.exe	98
PID 2396 wrote to memory of 5428	2396	firefox.exe	98
PID 2396 wrote to memory of 2840	2396	firefox.exe	99
PID 2396 wrote to memory of 2840	2396	firefox.exe	99
PID 2396 wrote to memory of 2840	2396	firefox.exe	99
PID 2396 wrote to memory of 2840	2396	firefox.exe	99
PID 2396 wrote to memory of 6708	2396	firefox.exe	100
PID 2396 wrote to memory of 6708	2396	firefox.exe	100
PID 2396 wrote to memory of 6708	2396	firefox.exe	100
PID 2396 wrote to memory of 6708	2396	firefox.exe	100
PID 2396 wrote to memory of 3928	2396	firefox.exe	101
PID 2396 wrote to memory of 3928	2396	firefox.exe	101
PID 2396 wrote to memory of 3928	2396	firefox.exe	101
PID 2396 wrote to memory of 3928	2396	firefox.exe	101
PID 2396 wrote to memory of 5180	2396	firefox.exe	102
PID 2396 wrote to memory of 5180	2396	firefox.exe	102
PID 2396 wrote to memory of 5180	2396	firefox.exe	102
PID 2396 wrote to memory of 5180	2396	firefox.exe	102
PID 2396 wrote to memory of 1040	2396	firefox.exe	103
PID 2396 wrote to memory of 1040	2396	firefox.exe	103
PID 2396 wrote to memory of 1040	2396	firefox.exe	103
PID 2396 wrote to memory of 1040	2396	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\http-browser1.6
1⤵
- Modifies registry class
PID:5852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\http-browser1.6
  2⤵
  PID:6072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {c4b6b78f-2064-445e-ae33-5910b40c24b4} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {bb6e297f-93c9-4f5a-b884-1f9a9acf4d0a} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27274 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {542e7de8-2f37-40b8-bc28-eda5b4c5584e} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:6800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27274 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {0dfab9c0-5995-432c-bd19-15f51a1e6de2} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2704 -prefsLen 34773 -prefMapHandle 2784 -prefMapSize 270279 -jsInitHandle 2788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3156 -initialChannelId {1cda78eb-8561-44a2-9f58-8331ea337a74} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2680 -prefsLen 35010 -prefMapHandle 2848 -prefMapSize 270279 -ipcHandle 3276 -initialChannelId {b9c762ec-0642-4f0e-8a7e-4a78434c28f2} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2992 -prefsLen 32952 -prefMapHandle 4928 -prefMapSize 270279 -jsInitHandle 1624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1640 -initialChannelId {ae1b7567-a9e6-4922-a1f9-938e9958d930} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {81b8f837-b7de-4c2e-943e-14c59e95e3e7} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {e17de3b7-4b1f-42de-b17a-85557a45d75c} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 687c4c339b3cd118e93cada111701c667eed7e9557cc06cace16a83a6e6f1fc0
MD5 65a98f80686ad671878fd8ff6195f32b
SHA1 3bed9851cc3e4eaa84cb95e0e474c439e7dff75e
SHA512 cab9e3953b19772331bfdbd821161bc81b74e0733bac87f469f9d2d55f9cd4b269efe71dde48f1115eaddd3ae67a1a43570211bd82c398313a7060efa797b928
SSDEEP 96:cBDSdF95/7bkW6ArcEDWryUR6nWZJF/kHRCFRBFReFRI/dd66JoztdzgClKtmc0d:mDOv5zbo8bDWryjWB+SNWI1d66JoztdH
TLSH
T1A5C1CA68E229963BC409423BCCA60B400F76394BA84E3F2535EC641D3D572DE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 681232e406d4928ac0ccd31ce0a10ce615db3d13d3b658696b1961cc255c90f1
MD5 d6875512221275d8b7580dc729335526
SHA1 0295edb1351933ac89e26e68aefaef3f1e6098ee
SHA512 30b5369d5618261de8f360f1894e71116e3e69c839e7f2717fb8968843d91daabbb52b095497d2508b989a693b1055ee4e4bdb92ec640e18aff9d69c734d850d
SSDEEP 192:D+SNWI1d66JoztdzgCl6mc0d+DOv5zbo7zhZDWryjkMN:DJd66Joz/zgC1jbboRZDWryjX
TLSH
T178E1FDA4E628863BC404037BDCA61F400F39398A9C4E3F1975AD611D2D572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\events\events
Size 1KB
SHA256 df59846354c74286eb594a719b3117096313afa4cf7325e34d6732c3999c190a
MD5 7ce89139f3bc1ab3264afa5655791716
SHA1 735b5f26b1bc23a580a7a0d31260e04a50505649
SHA512 aae5322808188bda783973ff09633b8a3967440d01a0f84fe2958c4a1b1316628066fc1f49016d11d89443417e18762d79bd1362bc40ce1b16e119ec9bb4907e
TLSH
T1ED214C9C7ABC4D2A9CC7F29C749006CED3554E4E44471D874D53EE8DCE81ADD326A839
MD5 SHA1 SHA512 TLSH

Submit Download

0b08fc31-774f-44a2-8d2d-51ec50a179d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\0b08fc31-774f-44a2-8d2d-51ec50a179d8
Size 16KB
SHA256 062c1d3152b901827f9e683a5b091a601990127a9cb85491cb7426961a8d1cab
MD5 0ecb697769860be34075cf28acb044cf
SHA1 2460e13c919ccab4fa24d60e9c1935d67375c113
SHA512 c685f7ee6678094626ce2c19d6f0d565037dc02a26db6656aaf9f77e540174be9004f9ea476c4c86e2d174b1ab6fa59240c9d46a64dd423221ec4fd5f3d48eb4
SSDEEP 384:MPaTAvsLs1G6Y227dtTFJllLG7Mv4cMmI:eyQGT20eMv2
TLSH
T1CF72DB162870497A8651E76894FCBFC3E5F538CF4C419FCA9BE0BE0469DE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40a0a329-7e19-450b-a78d-e0823bd10ac8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\40a0a329-7e19-450b-a78d-e0823bd10ac8
Size 886B
SHA256 06a15614a4f5ed3761e8c6396fc22792ca82a33be4ae22a089a12df0697c5642
MD5 494140c375e82f4265a388ac1fa11050
SHA1 a30220ef113ba041f8f7e362081990419577127a
SHA512 937bb1c713691772845f4baa9b8193137f387e97ae4efdca00e36306f5cb7a5e8e7180c8d7df18dc62e661855914f195054cb006a8c17e05e5b1f4cdd0693da7
TLSH
T16D1148904211F5B2CC69D24B989277014FD4721380CB18047DA557188DEB12EA32710B
MD5 SHA1 SHA512 TLSH

Submit Download

56658b40-8ca9-4c9c-b564-6c3c4dd360e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\56658b40-8ca9-4c9c-b564-6c3c4dd360e6
Size 883B
SHA256 2f9caf406771e8969e57bfda2365339af7d8869bd092825717e034402545719a
MD5 72fb86cc8173a1752b4a487f3afb3d95
SHA1 af9e66cbb7fedfd9d2b028da1df0c5be95631551
SHA512 c20454219743343e5192dd815712fe6732f7425d5851eb38cdb289b42b2f96e6fb1f55cd86cd54afdcb43b0f16ab411706438f7f55075ace6fed3da3663e43b3
TLSH
T128112381A325F9E3CC68924FC8527706ABE4761380CF54147EB55E084DBF51EE36620F
MD5 SHA1 SHA512 TLSH

Submit Download

88e92990-51ba-40aa-ad53-cf27dd5cc98b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\88e92990-51ba-40aa-ad53-cf27dd5cc98b
Size 235B
SHA256 aafb5aebfb14cca570f72019f0ee98354ef6fba29e6ded8520f5799b9700113a
MD5 241080b1089b57b2c7aa4eadce6ef293
SHA1 1df27b47e9d66e475ce7913b144f5704ba24c03c
SHA512 cdc11e546dae528888e1572c7bc07087442ce1d3d4e8167b9cef1b00042c128128680e793b64dff6e3a1c241fe85f32f06a829cf3e7b2cb85d883cd109e3ad04
TLSH
T1F7D0978069987B6D08280F1BB0E528C730884C3320A06810DA520B78C9BBECC012281A
MD5 SHA1 SHA512 TLSH

Submit Download

c467a735-f906-4485-9688-58f3b2795577

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\c467a735-f906-4485-9688-58f3b2795577
Size 235B
SHA256 f110964bc7fae962db38fba9b3f066a00092636f0bd360a5627b1e3b280f4b9b
MD5 84a62fccb3bc1a8100cb1061345a9ec7
SHA1 face812e44e40e56b30179028aa78ad282559782
SHA512 ee4a5601b5eee41deb24a94244234b8e4c87c0f62ca2f9566af3074d9f22a4abf5d872de797f1155499bfdad1b8637b06a4dbc91eb917975a81c9fd0fd4b8218
TLSH
T151D0978114AA736C08100F03B0E069CA719C8C3354B8A824CA628238EAFDAE58251C0A
MD5 SHA1 SHA512 TLSH

Submit Download

f7857973-ac3f-401c-a397-d6d7b773afa6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\datareporting\glean\pending_pings\f7857973-ac3f-401c-a397-d6d7b773afa6
Size 2KB
SHA256 577729f489c47bb9dcfb8312ee0b05c881f0e72af0145d708bb885b6db86a1cb
MD5 56f624eef23010e57d1bbbeb27db8e5f
SHA1 b8ce41f77789d56337145858447f45283a305dfe
SHA512 a9b195d953581fc4c76372d56636525a8f7bf5e431f3833984a60106d36ba2ecdcc3ebcb8de223207c5f07dddf9da8b1b25e234fc1879a552e4828f70a3f9b90
TLSH
T1E541345C3B789C779C9AF54D9442238E5BA49A0700C72C932E52EF0CCD9539E236E42F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs.js
Size 6KB
SHA256 76ad699e4ce0bcdf230ff1693e23f61abed6e4a9515d9c3c96b207782065985c
MD5 69fb8f1b1c4ea464ff9f8973f5506801
SHA1 be3b4d4898ec732ffcc0d3d337aed070fde6dc23
SHA512 0d69b22740b4e65353d99a99495c0a852b5ae85ea06eef9f135c97cdcfc1cad189a388ac1544a64f7af8bc8bb1d010badb39b4b59843f332bf6098cc5eb48494
SSDEEP 96:xH3UTUJ1qGqAjfNba1zSPXSSlRdv9jZnFLHDyuBw88u8L4cnlEJZy:t2REfNbauSS3zDJBw88Wy
TLSH
T1B3E120789508CF7F74B6766C6C6888716AB2013B7BBF28C750B65484015CF3445FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5tf1ldr4.default-release\prefs.js
Size 6KB
SHA256 d51adb1fcb05bc030d53c4ad441ecb7abf3bca409ce6fabbf678ba89d843b28f
MD5 3a587d3a2c7e328012cd448396fd8cd4
SHA1 692b73782530663faa6a9846808c1b3f534fa95a
SHA512 f6d019618eeb2df36a9b6b48b68bc8f78bf9bb35d7c933ad5d7e5200d03ee416c47733ca6adcfcc0c90ddf26cb399303595b85fd3b7213027e3a1e1058ed8572
SSDEEP 96:xH3UTUJ1qGqAjfNbi1zSvSSlRdv9jUnFLHDyuBw88u8L4cnlEJZy:t2REfNbiWSSUzDJBw88Wy
TLSH
T125E11F789008CB7F74B6776C6C6888716A72013BBBBF28C750B65484055CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads