hxxps://appstorrent[.]ru/1078-pixel-sorter-3[.]html

Analysis

user interaction
yes
max time kernel
60s
max time network
62s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/07/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://appstorrent.ru/1078-pixel-sorter-3.html
Sample260709-jml92set3q

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 56 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Pixel Sorter v 3.1.0 U2B [MONTER GROUP©].pkg:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5644	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe
Token: SeDebugPrivilege	2376	firefox.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
5644	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2376	4076	firefox.exe	80
PID 4076 wrote to memory of 2376	4076	firefox.exe	80
PID 2376 wrote to memory of 2552	2376	firefox.exe	81
PID 2376 wrote to memory of 2552	2376	firefox.exe	81
PID 2376 wrote to memory of 2552	2376	firefox.exe	81
PID 2376 wrote to memory of 1220	2376	firefox.exe	82
PID 2376 wrote to memory of 1220	2376	firefox.exe	82
PID 2376 wrote to memory of 1220	2376	firefox.exe	82
PID 2376 wrote to memory of 1220	2376	firefox.exe	82
PID 2376 wrote to memory of 4888	2376	firefox.exe	83
PID 2376 wrote to memory of 4888	2376	firefox.exe	83
PID 2376 wrote to memory of 4888	2376	firefox.exe	83
PID 2376 wrote to memory of 4888	2376	firefox.exe	83
PID 2376 wrote to memory of 4564	2376	firefox.exe	84
PID 2376 wrote to memory of 4564	2376	firefox.exe	84
PID 2376 wrote to memory of 4564	2376	firefox.exe	84
PID 2376 wrote to memory of 1716	2376	firefox.exe	85
PID 2376 wrote to memory of 1716	2376	firefox.exe	85
PID 2376 wrote to memory of 1716	2376	firefox.exe	85
PID 2376 wrote to memory of 1716	2376	firefox.exe	85
PID 2376 wrote to memory of 4568	2376	firefox.exe	86
PID 2376 wrote to memory of 4568	2376	firefox.exe	86
PID 2376 wrote to memory of 4568	2376	firefox.exe	86
PID 2376 wrote to memory of 4568	2376	firefox.exe	86
PID 2376 wrote to memory of 3864	2376	firefox.exe	87
PID 2376 wrote to memory of 3864	2376	firefox.exe	87
PID 2376 wrote to memory of 3864	2376	firefox.exe	87
PID 2376 wrote to memory of 3864	2376	firefox.exe	87
PID 2376 wrote to memory of 3788	2376	firefox.exe	88
PID 2376 wrote to memory of 3788	2376	firefox.exe	88
PID 2376 wrote to memory of 3788	2376	firefox.exe	88
PID 2376 wrote to memory of 3788	2376	firefox.exe	88
PID 2376 wrote to memory of 4516	2376	firefox.exe	89
PID 2376 wrote to memory of 4516	2376	firefox.exe	89
PID 2376 wrote to memory of 4516	2376	firefox.exe	89
PID 2376 wrote to memory of 4516	2376	firefox.exe	89
PID 2376 wrote to memory of 4084	2376	firefox.exe	90
PID 2376 wrote to memory of 4084	2376	firefox.exe	90
PID 2376 wrote to memory of 4084	2376	firefox.exe	90
PID 2376 wrote to memory of 4084	2376	firefox.exe	90
PID 2376 wrote to memory of 4044	2376	firefox.exe	91
PID 2376 wrote to memory of 4044	2376	firefox.exe	91
PID 2376 wrote to memory of 4044	2376	firefox.exe	91
PID 2376 wrote to memory of 4044	2376	firefox.exe	91
PID 2376 wrote to memory of 464	2376	firefox.exe	92
PID 2376 wrote to memory of 464	2376	firefox.exe	92
PID 2376 wrote to memory of 464	2376	firefox.exe	92
PID 2376 wrote to memory of 464	2376	firefox.exe	92
PID 2376 wrote to memory of 4924	2376	firefox.exe	93
PID 2376 wrote to memory of 4924	2376	firefox.exe	93
PID 2376 wrote to memory of 4924	2376	firefox.exe	93
PID 2376 wrote to memory of 5044	2376	firefox.exe	94
PID 2376 wrote to memory of 5044	2376	firefox.exe	94
PID 2376 wrote to memory of 5044	2376	firefox.exe	94
PID 2376 wrote to memory of 5044	2376	firefox.exe	94
PID 2376 wrote to memory of 2760	2376	firefox.exe	95
PID 2376 wrote to memory of 2760	2376	firefox.exe	95
PID 2376 wrote to memory of 2760	2376	firefox.exe	95
PID 2376 wrote to memory of 2760	2376	firefox.exe	95
PID 2376 wrote to memory of 4104	2376	firefox.exe	96
PID 2376 wrote to memory of 4104	2376	firefox.exe	96
PID 2376 wrote to memory of 4104	2376	firefox.exe	96
PID 2376 wrote to memory of 4104	2376	firefox.exe	96
PID 2376 wrote to memory of 2060	2376	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://appstorrent.ru/1078-pixel-sorter-3.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://appstorrent.ru/1078-pixel-sorter-3.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27098 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {9b16dd07-20e9-4e83-8888-60469de455d8} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27134 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {d10ae013-6381-4959-a1a4-ea572d7efe65} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 25164 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {bbc6f75b-61b9-4e4f-b03c-a99ce867626a} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27274 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {9a9e1bd2-a96b-440c-a884-74d66078557b} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3052 -prefsLen 34773 -prefMapHandle 3224 -prefMapSize 270279 -jsInitHandle 3228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2884 -initialChannelId {3572838c-dff6-4408-a222-f9b31260fb08} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4924 -prefsLen 32712 -prefMapHandle 4928 -prefMapSize 270279 -jsInitHandle 4932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4940 -initialChannelId {84b210b4-0fbd-445f-9fbd-f1d002ce1761} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:4568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3276 -prefsLen 35010 -prefMapHandle 2776 -prefMapSize 270279 -ipcHandle 5096 -initialChannelId {ffbd43d5-5b00-45c9-9953-2f2f406b818f} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
    3⤵
    - Checks processor information in registry
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4588 -prefsLen 32952 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {62a12fcd-a512-48a3-9547-e747aea29153} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 32952 -prefMapHandle 5800 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {b94fbdd8-590d-431e-925d-215647c550ef} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5916 -prefsLen 32952 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5932 -initialChannelId {4ecf2d13-ad33-40db-8b36-4630b3aa9a35} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6104 -prefsLen 32952 -prefMapHandle 6108 -prefMapSize 270279 -jsInitHandle 6112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6120 -initialChannelId {48978efb-5ee0-4073-a11d-390681acd384} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6440 -prefsLen 35062 -prefMapHandle 6336 -prefMapSize 270279 -ipcHandle 6448 -initialChannelId {5924107f-c86b-425e-b519-d58bfb578d23} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6472 -prefsLen 35062 -prefMapHandle 6476 -prefMapSize 270279 -ipcHandle 6484 -initialChannelId {5ad8980a-f686-4418-a9a9-702d1442de93} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 1400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {e86ef4e0-9ad6-47ef-a36c-70aae424d7b2} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3412 -prefsLen 32994 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 6356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6112 -initialChannelId {3393f738-e183-45f4-a50a-bcafda4a2106} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4640 -prefsLen 33056 -prefMapHandle 2900 -prefMapSize 270279 -jsInitHandle 3208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4460 -initialChannelId {17923b6e-aaba-4060-96ce-70828be06a67} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7104 -prefsLen 33056 -prefMapHandle 7108 -prefMapSize 270279 -jsInitHandle 7344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6996 -initialChannelId {f4aa0e4e-43bc-4767-a7ac-e98acef2e499} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:2060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7692 -prefsLen 33615 -prefMapHandle 7696 -prefMapSize 270279 -jsInitHandle 7700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7668 -initialChannelId {8ca2d369-5111-4f7c-a2ea-76afed047e56} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:1952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7888 -prefsLen 33869 -prefMapHandle 7892 -prefMapSize 270279 -jsInitHandle 7896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7776 -initialChannelId {6be6f28f-076a-436a-ba5e-d0511afb08f7} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7924 -prefsLen 34508 -prefMapHandle 8096 -prefMapSize 270279 -jsInitHandle 7632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6936 -initialChannelId {6e35a879-d236-4bea-873f-d115a932e80d} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4684 -prefsLen 36743 -prefMapHandle 4752 -prefMapSize 270279 -jsInitHandle 4696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7724 -initialChannelId {fe4eb27b-8af2-4b7f-8d70-af9bcf330c4f} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:1728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4636 -prefsLen 36743 -prefMapHandle 6872 -prefMapSize 270279 -jsInitHandle 6876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2784 -initialChannelId {0ff1850d-d156-4b20-8c5a-d85967b6810e} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7340 -prefsLen 36743 -prefMapHandle 7096 -prefMapSize 270279 -jsInitHandle 7584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7288 -initialChannelId {fe7010b4-ecf3-446c-99a3-8ff557247c02} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:5712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8084 -prefsLen 36743 -prefMapHandle 5432 -prefMapSize 270279 -jsInitHandle 8164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {fede0b01-8a23-4942-bac4-02797cf54734} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:5908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8572 -prefsLen 36743 -prefMapHandle 8576 -prefMapSize 270279 -jsInitHandle 8580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8588 -initialChannelId {49e567f0-6e10-4fe7-95dc-a77165b82a00} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:6136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8724 -prefsLen 36743 -prefMapHandle 8720 -prefMapSize 270279 -jsInitHandle 8716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8796 -initialChannelId {77424e2b-3f6e-4b89-883d-9bb769949d2c} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7300 -prefsLen 36743 -prefMapHandle 7288 -prefMapSize 270279 -jsInitHandle 6932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8720 -initialChannelId {f117b3d3-a03c-4e3e-9b3c-dc8a9314cdc0} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8972 -prefsLen 36743 -prefMapHandle 8976 -prefMapSize 270279 -jsInitHandle 8980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8988 -initialChannelId {7f479895-1875-4cea-abf0-d0618c36e4f7} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:1432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wvdcag27.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 1bef76dbe84e17b774002c86c38b1d205bd1144119efad13b7019d600b0bac09
MD5 e37e96e6f3eb322b4cf0d37d21cf3dea
SHA1 d9da293b724d6d97e392264d0dd764585b72635c
SHA512 c7e8e040a72b3591c8c4f6326982c9498ef2de5b8b38ced0872f50a8bb29e283496aa53fc59e79552b1e3a3a9b3e40342ede2988273e82cbc50c778232fce063
SSDEEP 384:H9XghOiO024Yrdcs3hk2nhfdDE2Ba/rIVy8eEZ1:dX+ZYrdv3hk2nhfS2sDIVy8B
TLSH
T1DD728DBF9F006C5D1957D585C8AD9369DD15FEABCAF690A618203449CB8432AF0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\AlternateServices.bin
Size 47KB
SHA256 6321c8c25c3a1c03f7d9d048529394c0da19031120f7e14275f5cc52f13e67ba
MD5 eb444e4a6e206b43fe0c2681bafef4b8
SHA1 7a4e730535b3ab5d355d82515b635d8ca96eb8d0
SHA512 6dbe2a8e214d4daa517a36a4880716169414be32123f77b88b0f9ffea03af8313732be79d29ad74399bf82d718a33955710c803e09eeb43fa5f807c537315df3
SSDEEP 96:DFTOJJEuEbEwTsUAyMn/TPKwiwrHyXSzrvP/YJaYGuCDfHILKmGrjvEeLTOOHOlW:rbgwTsyqMVhxYbpjPlcC4YZokktY
TLSH
T1ED2368FB9BF264A6F4B34FB48099709C9C3315652858C4849B09D0AB0396BA5E17FF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\AlternateServices.bin
Size 52KB
SHA256 3fdb41613a6ada255739c5f20331ab545a3f8abd8fc7e7d8fb6a09bd03c1168a
MD5 17333d7d5a136d90c7e20cbd1c0fe388
SHA1 c0ef32c5cc203bd449c219172df8a86102519e91
SHA512 159af405fefb3e0c22f0d54d27bc41a9052f0456c60a162a774563e967f62774b1864ea12c170d5e19dedc501eefc489cacd143d4032ce01449f1e6c01783dc1
SSDEEP 192:3bgwTsyqMVhxYbpjPlcC4YZokktYnzQf2:3bgwTs/MVhxYEYZmf2
TLSH
T1DE3379FB9BF164A6F4B34FB480A9709CDC3315652858C4849B08D0AB4396BA5E17FF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\AlternateServices.bin
Size 8KB
SHA256 37cb0cdab6b6aaef565abafec27c7e36493d40f2e4d5f3b24fdc3516fb69747e
MD5 bd6f70f0e250b3b817795e46efc8ad98
SHA1 e226eec0b0bba46ce5870231cff49a5eeacb95d0
SHA512 f95132120e9346517f143d2e9a5ca9c255c92026f5172ca9897056d24554609fafe303b1675c8d8c4869f2afd444838a86d322bf9f01085754eab919601c4273
SSDEEP 24:HuhMZrAkBkEpqkvozsm7V2NGsmqss0JRyYEeLElcBEbEM+:5FERAG8OJJEuEbE
TLSH
T17B02EBFB53736275F4627FB94058B4ECAC33121A2D9498784705D0AF02967A6E31E7AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 79e0585a4e5f8fe41e3c08266d54ef7e156afbf5f7ad1875cb28b9ff39a1e976
MD5 2a948a3e89558eb35b0dfa33a67fea8a
SHA1 bf32a451533a3b55162ec745a94b616c55d7933b
SHA512 7759b9c7e17d3a5d31b97ec61a28b47144b6a9213cd8aef33e1765b5f34542bad5988e40fea473f26ad5403634b107876f7f3f7cb6906b7d60492b0198a4570a
SSDEEP 192:giJfQ1d66Joz0dzgCl6mc0d+Ov5zboHznZU3yjfy:gd66JozQzgC1j7bozZU3yj
TLSH
T1DAE11F64E628463FC404127BCCA61B414F39389BDC4E2F1931ED64582D572EE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 75cbc0d3a3ac614ae4013acca77c6fd1a8baeecc02906f679b05190e695b0889
MD5 92dc04db846a678ee521c23c01b9ab74
SHA1 bb08265fd863d141276780d7a2af056da1a5bdb1
SHA512 d84c34282140a79ca246895ce370e395ca02297d81867e9b7f4a31c5b88a03eb315d8c1ac022250692fda39bed11a302df4e72482c2382406b5bd9323112ef6d
SSDEEP 192:MOv5zboHzoU3yjfyiiJfQ1d66Joz0dzgCl6mc0dz:vbosU3yj7d66JozQzgC1jd
TLSH
T155E10F64EA28463FC404127BCCA61B414F39389BDC4E2F1931ED64582D572EE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a277d5d34e0923099d97b7c6f3962b086a9510cbbd1804497f0ecdb5303dbd92
MD5 a7afeb2d51e0248352f05198127d2076
SHA1 16877fd47fe02794fd829d5707c9d960048fc057
SHA512 cf5629e749f7f9acc07c787f228e84f56dc1c7d94c9149dfec3b961dfcad8b35a43e8c0b0b8c27476e35fc53740a2e26cf96134acd07cca927f5108e5853c91e
SSDEEP 96:nSdF95/7bkW6QXjrvEU3yUR6rWZBFSHRyFR1/FRHFRQ/dd66Joz0dzgClKtmc0dM:nOv5zbooMU3yjCOiJfQ1d66Joz0dzgCz
TLSH
T1B9C1CB28E629463BC444423BCCA61B404F35389BAC5E3F2531EC644C2D572DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 806547a4a61b4662e6ab119045c266117cfea6cd309116073cdb5aebbc6ada41
MD5 8367ef2a73cbf3dfcb2a1c6fc0e58e90
SHA1 aade8c5e9646dc92d17c35e425668535f8703f2e
SHA512 4e90bf3578d7184b46c1df549880eaa8320b6266ddd7611dfc1a0fe0f06ec30d9dd20d676a76bc7e7d80ade729db429f588c696cd506c8e83048787bef9a0ef0
TLSH
T1F521295C39B94D6A9CC7E2ACB481028EA7A54E4745471C434D13FF8DCE91ADD326E83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 4KB
SHA256 6ecaa8c38d2c1b2e69cb3fbd2d23a2942ce0c023d8a999dc3fb6a86b206ce059
MD5 3bb9bca56d048776c1161cab9459c184
SHA1 3dc4edc762a0e659d9501c2051a773d6029d6608
SHA512 f6dc17e5802f1b62620b636be77f3e4d30832ca093f938494345659883e6bc16cdfba9cdd6b4ec33ea9d963e3a09cdd9f2d9cb59d142abd38cae4fdfe26f2e4b
SSDEEP 48:YYMcGMNYFRYGhqkKIpB8WzWlFW81WFWy4WV2WBUWPh2WOAPJkFB6pmtIF+rsMPIk:n8ZF62NsYrh5+BipmPzx
TLSH
T1C981E10C61B94CBEAD87E3ADF8410A9D92995B4254D72C470EC2FE49CD86A4E325F03D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

048028ab-86a4-4b8c-80c9-88e96137d385

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\048028ab-86a4-4b8c-80c9-88e96137d385
Size 886B
SHA256 ec797a4dd84ef33743ec869916106b3c285e1236b7eedcaed1afb7fca33dca18
MD5 58de5f3e1d92285b1f5ac2c9be0c1b59
SHA1 e724694eabf869cac52f2e3c046290a4e9a69f54
SHA512 0d2c1d39431008f36db0bff12b897147bf83bc0dbf0c7d0fc16fe6e20eb87ba726558995fd10f0e8ab38f13138bb87f4b9580f34ccbca5a675062f7293edf185
TLSH
T11C110054D6657AB3CC68D2CB98D577028AE87523C4D609183DA49F0C0EBB12FA36B207
MD5 SHA1 SHA512 TLSH

Submit Download

36967413-5756-40b1-a9b0-907db41c9d5b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\36967413-5756-40b1-a9b0-907db41c9d5b
Size 235B
SHA256 4dde4cb246b740a8416bc12899afbdb0be0b446b889aa543e786044b9e0e3d89
MD5 1e63f60c16f0b7ef8ab53ae672b9ab02
SHA1 2dc880591ab093a5e67a26a93bb5723602d3ff31
SHA512 400dce81c33afb180b40fc9f1ae92b3149fb238dc6121e161533fc8c3870003b4419d74e5f3ffa8ce9fde11f9e3c774eb671c4f858a80a659cd6d3a353bb62b7
TLSH
T1BDD0978464E8733D08140F23B0A07EC270484C3720706810865101B8A9B9EC90351916
MD5 SHA1 SHA512 TLSH

Submit Download

626e50ba-b0ef-42a4-8e58-897b936dd922

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\626e50ba-b0ef-42a4-8e58-897b936dd922
Size 235B
SHA256 bc63458c5d07fd7876f557b09052ede62cdb2e1f509a38dfe07e83a35b76af66
MD5 6935e0e6175ed8133f4bb19a88a211ca
SHA1 4309f31e65cb325bb49e17d6209b02b4929592db
SHA512 f15f1e9f08bb42662a019df775887a00e07a1b6a5c7d49e502b4d24161a0467451752ca951ee967dd1a20fbea4f3039695974d1c58868a106ec553b323ad47a2
TLSH
T185D097901498AB5DC8041F0AF0A07EC330554C331070682086918238D9F89C48221A16
MD5 SHA1 SHA512 TLSH

Submit Download

86e24414-6458-4f66-847d-4ff50fc11ff9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\86e24414-6458-4f66-847d-4ff50fc11ff9
Size 2KB
SHA256 932964218021a8f853f95dfe2761253e74fa458ef62c83e8740546e48f306f3e
MD5 d2acfaa020433d1e289210bfd8b26068
SHA1 a04e84447c0ccdc38f3b8109110e2058606ae6b7
SHA512 45f9fdcf71fa8377dc64732651cf1253b17cb72123077097a0b2ec216ad29ddf57eb4f787f01041b2875f776b45b8b8570a19f15455998ba8565061ac579b6ef
TLSH
T1EB41756CB5789D779D9AE1CDD042324D43F08E1300C61C8369A5DE0DCC96AA9273B53B
MD5 SHA1 SHA512 TLSH

Submit Download

cc5a0327-4e45-4f42-9681-74e513c3189f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\cc5a0327-4e45-4f42-9681-74e513c3189f
Size 16KB
SHA256 19af85f6f083a88073d6add34a27119bb5fcdf416f579c6c4d734c57de982572
MD5 863ebf3cfdec1243455b6273dd08e8aa
SHA1 722d5d45fe56bfc5f2ee574438811df5543cbcb4
SHA512 27912cefd27f9b3e6738ff055f56ef3bbc008bac90f606f5224d6f9f8ac6c91323d6592f6aa70f3bb24b2fc8a0e14e7af80bd37fb003e0f6cb4bac2fe86965f3
SSDEEP 192:CTD9O2EruBuYRf4Vjl2nlUiAfM6nXwi2Ez/0zN2jZ4tSro+XXPS7lqzgxWYuzY2X:7EEK6p28NTc+XXPS7lqUxWvE2QWS1PPg
TLSH
T18F72A956642045BA8251E7AC98FCBFC3E2F53CCB4C415FCA97E4BD0869DA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d30d5bde-8ad7-4c29-b87a-c9851cce17c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\d30d5bde-8ad7-4c29-b87a-c9851cce17c4
Size 883B
SHA256 d8b4188be8d6855755efbffc56fe4b28538bee94859223f622b76b2bf222645a
MD5 8f9d06901b08de2eb32c42edbc58c638
SHA1 6435901881bae7f8c638db821f0414b52ffe4dda
SHA512 e309f9a948fc561e473b83a15d5fb09661f9f1177bf32dd0ba0a2782619d104301fdfdc51dcf0f12c5c6cdf749d34c34d511b001e5ace695b9a13dba09c7b03d
TLSH
T1D2110051E634B9F3CCA8D24B89923B418BA87523C4CA45183DA59D080D7B52AA37A74B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\extensions.json
Size 16KB
SHA256 4285a13b6c0f333ef406d02d4d3b37d3163b12cdb2ce4a49504f969f5f191097
MD5 00e540ab54bf807e37026c663ab6aaaf
SHA1 b95592ab665b8e7e0b6bbf7ae7095b4b0c2328ec
SHA512 33a17eb33238d46602d7953635f7389d86fa4a81b14575fd3ca625a2bdee7c6055695b85c2bde7c84f50120c959640b22cb93b7ab29c950f9d20705a7b46d4b6
SSDEEP 384:ckI4vIUmldv18dhWx94z/96ofL4H4BL4P2L4HUL4H4L4Hzw4hv:zI4ARfmXY4x6k46404u46404R
TLSH
T13372421545048EB8294FA79AAA367E02C37D473B70845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 6KB
SHA256 6ce46e5583ef87088c17f92e905f476e5d734300778500368f4cf8742f4783c2
MD5 24b9f62d01df845b9375dbc84f642dee
SHA1 44d729bffabedfd9580f55dbc190cf547f20198e
SHA512 b42cca27dde9913dbbbe801f5e6e309878dec4392a5707748edffac127f53d5281096273e91709e17b00d5c7ab1caadbacabb7727cb6cdae2cbaf9f2d94943a3
SSDEEP 96:xHkUTUNqGqZfB3Y1zScSSlqdv9jRwnumHb4nNzw9Bw88H8L4cntev:+gRZfB3YBSSmXob0sBw881
TLSH
T1A8E12F7894088B7F74B677ACAC688831AAB2413BB7BF68D750B554C5010CF3442FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs-1.js
Size 7KB
SHA256 3683f2f730f114f856c6fa125934d4fb68c48a73ca9836f78b00d714882103ba
MD5 34a7714542e4e3d622a9c49e06f34a69
SHA1 8324c901ae46050fda6afdda2aeb4b1ef0344359
SHA512 da7cd918a467d0f9d7e416fe8bab7dc7eeb2b8b82d4ed7da8e3ec8f8a20a648c54c8beb012c1e27ee1ef73519fa224a89e876e26a4964e6720c261560c8c74da
SSDEEP 96:xHk9TUNqGqZfW3YObzSnSUmSSlqdv9jRwnumHb4nNzwRBw88YFYu8L4cntev:+9RZfW3YlSUmSSmXob0cBw88YF
TLSH
T18BF1FB7C9108CB7F78B6766CAC24487159B2427BBBBF68D610B954C5050CF3842FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 b19eaff094c4e64c01ae57c24eb6781d22814ca31d12798c18c1c5988c674791
MD5 46b5da543bb0b110552e9d7fa4632e26
SHA1 b283e169bf5f8acb0e5013e89065018b05ff6e9c
SHA512 4c790e8a41f410f0c6096abe375d32d009b3190d83072fe7ee241916d9f0f9372e44ac93d5547cf5236953706eb73273f160d79aaebd6b1675b11dd56f96ac3f
SSDEEP 96:xHkUTUNqGqZfBD21zSySSlqdv9jvDnumHb4nNzw9Bw88H8L4cntev:+gRZfBD27SSqSob0sBw881
TLSH
T1AEE13F789508CB7F74B677ACAC688831AAB2413BB7BF28C750B55489050CF3446F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 c38636aa52a04fa8d2e2b5e92199c9f9e66c10cefe2b0d14da175674194b7ac6
MD5 4489464ec6bf6784e0e78cf1e1b3e554
SHA1 42664ae053c3efd0adb8feb871a251ad0b5999be
SHA512 370320c7c077aaf42a8222ebde24f4fe1a16a46f0c355557b99ad822fd797d8a18a22fbe15d8777bd24cfbc047b84da0961eb3d2cc961028c46b39eef5cb560d
SSDEEP 96:xHkUTUNqGqZfB3Y1zSnUmSSlqdv9jRwnumHb4nNzw9Bw88H8L4cntev:+gRZfB3YeUmSSmXob0sBw881
TLSH
T182E1107895088B7F74B6766CAC6888316AB2413BB7BF68D750B554C5010CF3442FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 17bbfc8d6490f4fccf2e89397b953c512f2a1b3f293fc9b12a085a031cf9c6cf
MD5 d86b71a6f48d1ed40d9e669456654793
SHA1 33591802bf2d6af97ef8b8b13b3550b8e7feef59
SHA512 d671afca2c9587e9039fcc9a2eea6cf98e73adb8a1fb3daa6a4f29e4a42a4b41f4cfde8bac90e7050ade62b89014b4e3183217980fd60dc5770826f51092fc7d
TLSH
T16231DA9BAC3F39E97722626ED8454ED7CBFF202245B65CF0D44EDA11115DD44369A10C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 833e6d7d01b45a2cd9b101b744cecf1905745d869cbf285f4a93dd33949c6ccf
MD5 6525f6327112e09e370963e194a92a4a
SHA1 8ddf59b064a19464a01057ff990e212a7df912e5
SHA512 5b55212a8c0bc7a6ab7eaa438c10f89eabe53b62570ee850c7eb67b79577c0caa3f00c9810725efbcc1f1420425ee7130381798345989290222b5abbaed31811
SSDEEP 96:m3fUj93iBEQgpHMo9OGyYlDNUpaW59+bD2dofw9TueiH12T:qi9y3gRMo9IYAdKfw999
TLSH
T150915C539C673CD163A6A079889A3F529F66042BD4A1D8F4DF8CCF74432EC48278BA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 f46568231743c93c5347068521ade4923c8ab21d09088e8af0023f6622b46700
MD5 a683f40759827ccef05266c8d405768b
SHA1 e4e651fff0422d04a0837c5529985bf41e4c58f5
SHA512 8b1801cb4e55c9017573f59c5439faf49a78b425fec8ca5277fa38cf964de4a0649af5684ce283948169bfd24ebf3b61ccd61d0d4ce178af10508c8052c88f5f
SSDEEP 49152:KLQLyGaeUT6QC5zYYzafJ5sk151e7nj4MS2O6fKCddMPizMrzmNc20iY/jCZtYBl:zAmVYV+JSGvdLPInZX
TLSH
T12C665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 ea80e706eefc10a0e24277bb8660eca169baf8e7095d5998e3a87da0abef050c
MD5 18a9bda3eccc9382325192bde302b6d8
SHA1 4bb0c049524886dd416e125efcb159c0917fb1d9
SHA512 e24518c2ff87362ce097d2f5f612939f8a8e35ead6bb1a5693a8bb50b33705c3f5079d6f5da8c224703eb8f9bb51b30d0bec44cc625fb55b672c7045d4295d62
SSDEEP 49152:vwtRK8Xdg+ziwU7RnY7SjxXlXfotzk0sr2M7+7:YtRK8Xdg+zMjRlXfo5k0+FS
TLSH
T1172639F820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 c68f33a66c551c592daf9b6e7d8a72a34bc78421a6f7bda6ef695f34a966ec49
MD5 24aa83e2e191a941f39248ae65e9a0b1
SHA1 8f2ffdec0b2ecb531204efccef048acc8ce0c4aa
SHA512 c4eab6f14bec58ac0f3a0191119819532c5d3af4e0f915c7d1ea4a009a573e0fd532ed9eebbfccf8644ce25303b3472e9ed203b2ac8da5101e7c61c81a6ff486
SSDEEP 49152:m6OizMrzmNcg0iY/uCZkgIL+JwkglvdLxFGMb3pXKcUu033/K8VTH57I21fIa9m3:3ymjg4+JSlvdLrG0ZX
TLSH
T18D665CE420E29252F38540B3719A53EB11EFC00C6077CE445B9896FAA5B4CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Size 2.7MB
SHA256 02951ebddf2b9648d983a36d342942a0e6b4ba992b1aa387e1948dc9ab16ef0c
MD5 20fce81b7c019b8cb16f098c917cdf22
SHA1 28d15c7cf4eb7a27d736425e550cec060df08546
SHA512 10df9bddb2734ce9257438b04f23b10e68fae4481cc339be064f54787f036babfcb1c8ca0154e259e237bda786b88c3b33ac76b24924b4ad63fc6edf63e9a55c
SSDEEP 49152:JHFUhwNsNTkjGoG/bPXptknQVrUlhXXsx9Xm+hmkvTj2Ucjc5ODXJ/qda9:rD2Uk/jXbkeshXXI9W+mkvTKUDeEa9
TLSH
T14FD533162F8D24C3E0FF65B6C868D03DCA0CDF539735A9F06ABA49F901A7C963067586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads