hxxps://t[.]me/import20266

Resubmissions

09/07/2026, 09:59

260709-l1kz9ags3r4

09/07/2026, 09:57

260709-ly5xmsgz7s1

Analysis

user interaction
yes
max time kernel
50s
max time network
44s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/07/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.me/import20266
Sample260709-ly5xmsgz7s

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	firefox.exe
Token: SeDebugPrivilege	3848	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe
3848	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3848	672	firefox.exe	81
PID 672 wrote to memory of 3848	672	firefox.exe	81
PID 3848 wrote to memory of 2988	3848	firefox.exe	82
PID 3848 wrote to memory of 2988	3848	firefox.exe	82
PID 3848 wrote to memory of 2988	3848	firefox.exe	82
PID 3848 wrote to memory of 388	3848	firefox.exe	83
PID 3848 wrote to memory of 388	3848	firefox.exe	83
PID 3848 wrote to memory of 388	3848	firefox.exe	83
PID 3848 wrote to memory of 388	3848	firefox.exe	83
PID 3848 wrote to memory of 2068	3848	firefox.exe	84
PID 3848 wrote to memory of 2068	3848	firefox.exe	84
PID 3848 wrote to memory of 2068	3848	firefox.exe	84
PID 3848 wrote to memory of 2068	3848	firefox.exe	84
PID 3848 wrote to memory of 4604	3848	firefox.exe	85
PID 3848 wrote to memory of 4604	3848	firefox.exe	85
PID 3848 wrote to memory of 4604	3848	firefox.exe	85
PID 3848 wrote to memory of 2932	3848	firefox.exe	86
PID 3848 wrote to memory of 2932	3848	firefox.exe	86
PID 3848 wrote to memory of 2932	3848	firefox.exe	86
PID 3848 wrote to memory of 2932	3848	firefox.exe	86
PID 3848 wrote to memory of 4728	3848	firefox.exe	87
PID 3848 wrote to memory of 4728	3848	firefox.exe	87
PID 3848 wrote to memory of 4728	3848	firefox.exe	87
PID 3848 wrote to memory of 4728	3848	firefox.exe	87
PID 3848 wrote to memory of 2172	3848	firefox.exe	88
PID 3848 wrote to memory of 2172	3848	firefox.exe	88
PID 3848 wrote to memory of 2172	3848	firefox.exe	88
PID 3848 wrote to memory of 2172	3848	firefox.exe	88
PID 3848 wrote to memory of 772	3848	firefox.exe	89
PID 3848 wrote to memory of 772	3848	firefox.exe	89
PID 3848 wrote to memory of 772	3848	firefox.exe	89
PID 3848 wrote to memory of 772	3848	firefox.exe	89
PID 3848 wrote to memory of 2248	3848	firefox.exe	90
PID 3848 wrote to memory of 2248	3848	firefox.exe	90
PID 3848 wrote to memory of 2248	3848	firefox.exe	90
PID 3848 wrote to memory of 2248	3848	firefox.exe	90
PID 3848 wrote to memory of 5660	3848	firefox.exe	91
PID 3848 wrote to memory of 5660	3848	firefox.exe	91
PID 3848 wrote to memory of 5660	3848	firefox.exe	91
PID 3848 wrote to memory of 5660	3848	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://t.me/import20266"
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://t.me/import20266
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {3c73556d-fce8-4c89-9026-a537c2763bb0} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {9fc849ff-1236-4741-9306-fecac1e64869} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3488 -prefsLen 25164 -prefMapHandle 3492 -prefMapSize 270279 -jsInitHandle 3496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3504 -initialChannelId {042eaebe-e7ba-485f-979f-85c6d9247b94} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3652 -prefsLen 27274 -prefMapHandle 3656 -prefMapSize 270279 -ipcHandle 3724 -initialChannelId {c64035a4-c89d-43e7-8fdb-66f00511f906} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4544 -prefsLen 34822 -prefMapHandle 4548 -prefMapSize 270279 -jsInitHandle 4552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4560 -initialChannelId {5f2a4ccc-025d-4114-b71b-6a1a027b7d65} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2696 -prefsLen 35010 -prefMapHandle 4776 -prefMapSize 270279 -ipcHandle 2688 -initialChannelId {a088820f-2b6e-4f06-b373-a974e36bf615} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4980 -prefsLen 32952 -prefMapHandle 4984 -prefMapSize 270279 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {ffbbcb18-00c4-4337-b98c-55f19f8a2703} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5612 -initialChannelId {62ddf232-308c-4783-857d-97c9d13fb0da} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {85a40919-ad86-442d-bc57-8d8d1a916eba} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6076 -prefsLen 33610 -prefMapHandle 6236 -prefMapSize 270279 -jsInitHandle 6240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6280 -initialChannelId {1bf51da6-1c42-4bbb-9711-6e8464ebcee7} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 4bf6aebc0ffcc1faae92627d080c1f807cc407d110901667994d0e48f5513192
MD5 0db7a7dd3a61e0f9bdd9d041cc249fa0
SHA1 058f8f524c59e58d2a0a5271ee57c20204f8200b
SHA512 a74b4e347c6d0e33ac8e56dfc4e7bb2573bb583fb67640f55e6fbd77163400cf9bde27d71ce7428a65047ff9310c5ffd8f86a87db96ee73800d69893129955d8
SSDEEP 384:H9XghOiO024YWdcs3hk2nhfdDE2Ba/rIVy8eD/b:dX+ZYWdv3hk2nhfS2sDIVy88
TLSH
T1BB728DBB9F016C591967D585C8AD9369DD15FDABCBF690A608203449CB8432AF0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 17ff2e6fe990ee0eac91557f7e3c41038a05cdfcaaa27d53e855087b848c89d7
MD5 260898052b6b79e733e6f80f7e1b96c8
SHA1 88d16544b7bd717842d664f120e0bf60840b1664
SHA512 6b1f940aff782103d39e6982a7bc4e99c87647135ac10e6c6e4eebd57213248deeb37cfef8c412da0e3d6e30281e66c3b36156eca49e3f00a8b654612658dd3e
SSDEEP 192:85qqrr1d66Joz0dzgCl6mc0d0Ov5zboHzzMY4yjlyL:cpd66JozQzgC1jFboHMY4yjA
TLSH
T114E10C64EA28863FC414023BCCA61F414F35399BD84E2F2935AC614C2D5B6DE7B8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 027afa9d76a7dfb7a70443eb2d73cfb575fd3d2e0c973261f5f9be057a8341d0
MD5 1a5f970adfa3cf857d8e7b2bdc647540
SHA1 79536249eeeae1795931d8fa21db0fd006db84df
SHA512 add589ba89720b31ad37514ca5d041e74ef94ab9118c586ab81998bc8652d8eea2fa3b8dd1adb4a27cd9a78d5fe444bdc30e60286e3e7baff0299813f9adcdf7
SSDEEP 96:cTSdF95/7bkW6QXjrcEY4yUR64WZvF72FRlFRaFRaFRrr/dd66Joz0dzgClKtmcs:IOv5zboobY4yjbu5qqrr1d66Joz0dzg4
TLSH
T1EBC1EA28F628563FC454023BCCA60B811F72795BD85E3F2A319C604D2D5A7DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 aa9505f8161afafb9b2ebc0f5913b388467e57bd37468dca3d2099f1fe7859fe
MD5 8566a485a379aebdcb33c792b4736a3b
SHA1 0c9ba56bc6610966d4d301fbe95339cdbd6ea4cc
SHA512 d2f90dde6173798e64eaa91a7ffeae0a4baa618f78649e1dccd676a2ef5482ceaa628b853bf191119f51bd57439b4e1bf8f5bbdfdc6ddbdceb9b359f91d8f39e
SSDEEP 192:JOv5zboHzzZY4yjlyg5qqrr1d66Joz0dzgCl6mc0d:GboHZY4yjbpd66JozQzgC1j
TLSH
T17EE12D64EA28863FC414027BCCA61F454F35389BD84E2F29759C604C2D5B6DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e146903a10663584c46645358ad4c18ea79229f2bf764fb3a0454801c724bbab
MD5 65b5b09780b1992b098419b18d2258d9
SHA1 d2c04fe6aec02a09c00a05a6a0c41a0b75b72cb1
SHA512 c0113abf06242a3afa088945984746463f8dc3a091c092af02c14b2860e1d5e37265d7a4315c176a242ff7e4f422df6c98e99c9204b92719a1476bf448b468dd
SSDEEP 192:85qqrr1d66Joz0dzgCl6mc0dDOv5zboHzAY4yjlyL:cpd66JozQzgC1jCbo0Y4yjA
TLSH
T17FE11E64E628863FC414027BCCA61F454F35389BD84E2F2935AC604C2D4B7DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b0df4d1089b8dfebe4aa1cbc6c050da5523c42c012c78c2823be4aea73b11da7
MD5 f78f7f347df319204c1fd2b723672d03
SHA1 53c029187313c3236eb61331e3206f70aa8dd42d
SHA512 6a123f940448d461eeb7bdcb522d4a2ae1a8083bd4d645cb7354a8e609fbc2d02ef61ef277a065dba58e662266e872267b3cb1eb689d6e4c0685ff2d9e6f47ef
TLSH
T1DB217F5C3AB84D2B5CC7E6AE7451018DD3504E0744872C930D42EE8DCED1AED326D43C
MD5 SHA1 SHA512 TLSH

Submit Download

30bb0896-7edd-4153-b674-52dbf62053de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\30bb0896-7edd-4153-b674-52dbf62053de
Size 16KB
SHA256 bf053eb7746c5427af01835e6f0a3a45dc557cbabc8ed18a9dd74376d712bb86
MD5 6dc8eb14c894f2e291a03a411921a9c4
SHA1 8f604e9c45148e5b52a24ed2df8ffbada5f8dc10
SHA512 1f0508aa90df47bb0cc871aefc8e7d50208d368530e98f0325ac833916ff134d1e3d0c88fd39678036dd8ffdbf57d87f07d6f24875a6f96987ce213ea6e396d2
SSDEEP 192:5chRV1zx7i0KrR3y613iX4BgLqmt0yM4oFhmHu3N4m5LbZeMbUtrE6LELRNO1A3c:aV1l7i0KrYt4CLEyJoPYA3H75GZb
TLSH
T1A572CA56682055BA8251E36D94FCBFC3E6F538CF4C019FCA8BE4BE0859DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67923d10-184c-461c-bf6d-d13f230dcae5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\67923d10-184c-461c-bf6d-d13f230dcae5
Size 2KB
SHA256 0ed5da666a9e951601404b903d57bc034bef15c15df98792fd6f0a695e8f0790
MD5 1f6aebe7762d0cde70f92644becad64f
SHA1 8bdc90bb772e7780a93bd79a22a6b6dcd2a5223d
SHA512 002b25a3dc62565c660a5afb4706ebf2ecc9788d1ac51c1ddf6a9cfb50019866b56876d3e768a80d259a0ceeb5d2f1f7b6a665de1e6128e32ca3d5e3fdd1060f
TLSH
T11F41211C35744DB78CEAF28DD482274E97A48A5300C65C872DA1DF4D8CDAA6A336A53B
MD5 SHA1 SHA512 TLSH

Submit Download

ad831f30-1386-4822-87cc-0fb0c511e856

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\ad831f30-1386-4822-87cc-0fb0c511e856
Size 883B
SHA256 fd97c3724c30b6a9d22bab893a5b821d02ba804463d91615993efe1f799b1f21
MD5 9200d40c70a3c7f0985b6e4e93c26bc3
SHA1 2244f8fa5af086a4a8e0d19e7de928214f7c0a58
SHA512 b493245f7b41723bb7541af91570555ab8d6d120f9bc675f24e3df837e7d5f4836cf6264d922b839813b7c962ee51ccb7798404b0777a403c6b1b8af0a38ff2f
TLSH
T1C411C041A5357AB3CCB8D24F85923B039BF4B523C0CA44583DF55A050D7E92EA7AA74B
MD5 SHA1 SHA512 TLSH

Submit Download

d2e66694-1a25-4c8c-9094-8cab0fcae115

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\d2e66694-1a25-4c8c-9094-8cab0fcae115
Size 886B
SHA256 e7b3fc7862687cd746610e6014281d83d73c668cc06acf2dc1c3d44b181122b7
MD5 9b69aa8259e0792e9a65013f0ddb7280
SHA1 6c0f60b2084991fb3d89d5122f85c17395daa984
SHA512 af598824fb98c3a993bee04ee9b564e5e836ee8a4efab3f3641d44a6e06a0dfcaa82761427ebd56b1a1a5a3c48c06879a928acc4f8759cc8658b7d4bce47731e
TLSH
T12D11E34595757BB2CCB4D14F94E13B435AF0B133C0CA4C587D985B084EAE91FA76670B
MD5 SHA1 SHA512 TLSH

Submit Download

e5139f72-b9da-4c3b-bdef-3f8f20c29fc3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\e5139f72-b9da-4c3b-bdef-3f8f20c29fc3
Size 235B
SHA256 19a70ffc7f6f676e401d89b1dd499e9dedd57f589d0d21c43c3cc4cfaa6d116a
MD5 94b0d866529d57299a888b5ee32ef68b
SHA1 a244f2836c49f8c94fe0ba4c8b41e074a0616bcf
SHA512 7dae9115afca2ac9a3c2e278d8b55aa4147d42385154b347eb2b6b9a85497922a1ada5d3a42aeb8ea2f8945d3ca0d01ba184a5cb34542812ef5748687ccfeec6
TLSH
T18AD0978424A827AD08002F0AB0B028C230888C3718B8A820EAA2043489F8ACC8261A16
MD5 SHA1 SHA512 TLSH

Submit Download

e807ecee-4588-484b-85b9-f146f92bfc3f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\e807ecee-4588-484b-85b9-f146f92bfc3f
Size 235B
SHA256 9d9f7ff64be0aba3746fdf23d20742ce5f7fb164c50674d6f207920de74f9a66
MD5 fc3527ae0f855ed87d2369ab39bb076a
SHA1 d430b54600f226c9f3ff19b70fe3a5d9903a9a00
SHA512 3deaac397845c27d465734ada7f391b01701feee7298b0506c50abe262e4fb32399855648e94dce6bc9ff10107689b31261394808957b77df78ce9cb22876530
TLSH
T182D097805888671C48108F02F1A12AC230884C3714B09C10DA918578AAFCECC02A2E16
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\extensions.json
Size 16KB
SHA256 5c3efcc745f5d7dc8ba8e3d5a49ef552eefb9478b9027bf813756437c107c458
MD5 9b584827d80db50d1ef3e760d7748b17
SHA1 664e86ca8265f02d82fec5772a54f6bc683f5b2d
SHA512 a5edae3313456be1cecd49545fecf0d1e2e160be4d7dfa7dff3356cab36fc42bbca29f07a37a0ca25d9674916b8bf5290892aa434a79cd40e4487ea47c7fe5c2
SSDEEP 384:SkI4v4Umldvu8dhWZO94z396oPL4HFL4PIKAL4HCKAL4HgL4HiU4hv:lI4ARfDXd4h6s4F4wKi4iKi4i4j49
TLSH
T1FC72521545049EB8298E979BAA367E02C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 7KB
SHA256 72f03eea1b604bac212e0748e80bcc0beaabed8a78b6ed6b9bd252a3d6cc8009
MD5 89e537ca76dc7d0cf0a13b787adc42e5
SHA1 672e2ee87cb2ae43c81f46b3cd951c4b2f9d09d8
SHA512 8c33dba9c9bc0919ac6e7d45d62edb58929385ec2b437e16c3f518eac823da5039a80b2e536500002d9766f4c3dbac5e400726d4de723838e530f653b964f077
SSDEEP 96:xHPxTUkqGqDf8EFObzSCTSSl5dv9jGn+WRM8ySIHBw88x4C8L4cndpc:FiRDf8EFMTSS4R4SiBw88L
TLSH
T169F10D389008DF7F64B6377DBC2489716A62023BB7BF68D610B95485050CF3851FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 6KB
SHA256 96a02b27c52ffe04e9fe35f28612a3c67cb92fb2d40818a3d3db129cd4a249ad
MD5 38207a62a8cb5a878412f6fa0b0baeb1
SHA1 4ad1ce37f8a78a66d7fd1c7f2c278c19324b1b7f
SHA512 6a0286878cd08a09284f7feb4b010e5f46c54220a11942a7796b482baff784d72d2b60f230fc8fb42592519e52c8117ec3ff58ede3a02942aabefed3e43e7e1f
SSDEEP 96:xHPUTUkqGqDf2EF1zSCTSSl5dv9jGn+H+StBw88H8L4cndyc:FHRDf2EF/TSSx+StBw88O
TLSH
T17CE12F7894188F7F74B6776CAC6888716AB2013BB7BF68D710B95485050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 0352678675e0bb9d93fa3f5f4bcc7c9c3f8acf6b98bfb39a82fd7afa0f77681d
MD5 aabe27e1a4b532487a1fd23e47dd8f4b
SHA1 0b744b3d24410764b0adf30c2cba25cb366a8d12
SHA512 d8bf3c95191dbd0ebd622c23c2befa931e4a27d79c42803b54a0c1fb89db7581934a098123d56e390d90b04dc5666cc6e82e4c0db9f318cc292ba928f452ee17
SSDEEP 96:xHPUTUkqGqDf2h81zSWSSl5dv9jzn+H+StBw88H8L4cndyc:FHRDf2h8LSSU+StBw88O
TLSH
T16CE120789008CF7F64B677ACAC6888716AB2013B77BF68D750B95485050CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 cbeb8bcd4a832b0fd8e4c0ddebda9c9328f893229f620ba9931ae103437ceaae
MD5 ff4fa771f763d345e58f6ba5708c031a
SHA1 a40d6f69e92cf4b005d17d0e7be0d981e7525f3b
SHA512 76fd1acc3f633a65994ece9332ba1698049e0c10301106a431381a203ae1ef1bca5329fb82f8693f43583585e423c5144a0bbf10f372d85af4911bf90b58bc71
SSDEEP 96:xHPUTUkqGqDf2EFObzSCTSSl5dv9jGn+H+StBw88H8L4cndyc:FHRDf2EFMTSSx+StBw88O
TLSH
T168E11F7894188B7F64B6776CAC6888716AB2013BB7BF68D710B95485050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 1b92ed88e6df9be76dc8c10e505e479caf66030add2b8b83e4566d9c4f3081f4
MD5 a73a9d4b8a8df822bc1d057f4dc0ab35
SHA1 9e4e1869189a259e7eb87629056dc45e02d7a01f
SHA512 5ce4fcad60cde524abf497bbe7d188963b4bcccadde83bdb4110eb290c7752068bbac0efa888d030d75f9fe8bcaff8de0b85dbd1d81665bdacda598296650643
SSDEEP 96:DzVNk49+O29PTK2o+3nrp0aob0N+Q09YAHMRDPQw3dxYl:s49+PbK2o+3r6aYmGYAsJPdtxYl
TLSH
T130915D0363D7839BF6206693D02C5FBAC640F0E047A06AD8F86ECBE0572B64B125C36C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 e1076314db4a26878d89f39b8440d520a9b6ca0e41f79ebd41feaf42f38eab73
MD5 1636c1f6e4c03863c3c07ede86795fd0
SHA1 2032eeee9fa0d5c3102ff61b5fc3d8ee96b32004
SHA512 8774f031d53a63bce16d7a73297b850450800913a5ea5479d0f9993e34a301e6ccf240cf92b142ea6ffe1900f30432a0a42b0e9a524321d364c8e4369de2d042
TLSH
T1A6210653EC172EB5BA18A466E0881FF1CB863072C9B058F0C44D8A0223BC14C338A14C
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads