hxxps://hackinghappy[.]krtra[.]com/u/L4K7J/kb8j/gvGM

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://hackinghappy.krtra.com/u/L4K7J/kb8j/gvGM
Sample260716-labnwsds3x

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	firefox.exe
Token: SeDebugPrivilege	880	firefox.exe
Token: SeDebugPrivilege	880	firefox.exe
Token: SeDebugPrivilege	880	firefox.exe
Token: SeDebugPrivilege	880	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
880	firefox.exe
880	firefox.exe
880	firefox.exe
880	firefox.exe
880	firefox.exe
880	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
880	firefox.exe
880	firefox.exe
880	firefox.exe
880	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 880	3952	firefox.exe	86
PID 3952 wrote to memory of 880	3952	firefox.exe	86
PID 880 wrote to memory of 2072	880	firefox.exe	87
PID 880 wrote to memory of 2072	880	firefox.exe	87
PID 880 wrote to memory of 2072	880	firefox.exe	87
PID 880 wrote to memory of 5056	880	firefox.exe	88
PID 880 wrote to memory of 5056	880	firefox.exe	88
PID 880 wrote to memory of 5056	880	firefox.exe	88
PID 880 wrote to memory of 5056	880	firefox.exe	88
PID 880 wrote to memory of 4060	880	firefox.exe	89
PID 880 wrote to memory of 4060	880	firefox.exe	89
PID 880 wrote to memory of 4060	880	firefox.exe	89
PID 880 wrote to memory of 4060	880	firefox.exe	89
PID 880 wrote to memory of 2096	880	firefox.exe	90
PID 880 wrote to memory of 2096	880	firefox.exe	90
PID 880 wrote to memory of 2096	880	firefox.exe	90
PID 880 wrote to memory of 4380	880	firefox.exe	91
PID 880 wrote to memory of 4380	880	firefox.exe	91
PID 880 wrote to memory of 4380	880	firefox.exe	91
PID 880 wrote to memory of 4380	880	firefox.exe	91
PID 880 wrote to memory of 640	880	firefox.exe	92
PID 880 wrote to memory of 640	880	firefox.exe	92
PID 880 wrote to memory of 640	880	firefox.exe	92
PID 880 wrote to memory of 640	880	firefox.exe	92
PID 880 wrote to memory of 1604	880	firefox.exe	93
PID 880 wrote to memory of 1604	880	firefox.exe	93
PID 880 wrote to memory of 1604	880	firefox.exe	93
PID 880 wrote to memory of 1604	880	firefox.exe	93
PID 880 wrote to memory of 2396	880	firefox.exe	94
PID 880 wrote to memory of 2396	880	firefox.exe	94
PID 880 wrote to memory of 2396	880	firefox.exe	94
PID 880 wrote to memory of 2396	880	firefox.exe	94
PID 880 wrote to memory of 3452	880	firefox.exe	95
PID 880 wrote to memory of 3452	880	firefox.exe	95
PID 880 wrote to memory of 3452	880	firefox.exe	95
PID 880 wrote to memory of 3452	880	firefox.exe	95
PID 880 wrote to memory of 1832	880	firefox.exe	96
PID 880 wrote to memory of 1832	880	firefox.exe	96
PID 880 wrote to memory of 1832	880	firefox.exe	96
PID 880 wrote to memory of 1832	880	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://hackinghappy.krtra.com/u/L4K7J/kb8j/gvGM"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://hackinghappy.krtra.com/u/L4K7J/kb8j/gvGM
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2040 -prefsLen 27099 -prefMapHandle 2044 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {5250bd63-4c13-48aa-a8e8-b275bd37b3e5} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27135 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2528 -initialChannelId {8d2ea27b-da5e-48c2-bedb-b909d73709bb} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 25164 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {942947e5-e74a-4399-b2fc-8f422db7f468} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3928 -prefsLen 27276 -prefMapHandle 3932 -prefMapSize 270279 -ipcHandle 4016 -initialChannelId {fbfdf83e-a269-4eb9-80f4-eec25f94fc4b} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4296 -prefsLen 34775 -prefMapHandle 4300 -prefMapSize 270279 -jsInitHandle 4304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4312 -initialChannelId {cc7b3c6e-2e8e-4a46-9cb7-5d8c8dac6b93} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4924 -prefsLen 35012 -prefMapHandle 4912 -prefMapSize 270279 -ipcHandle 4932 -initialChannelId {d4c9558c-09da-43f4-b62a-4bb98f5db438} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {9f5fa71d-fbc7-4679-b5a1-b24a50d986b4} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2772 -prefsLen 32952 -prefMapHandle 5420 -prefMapSize 270279 -jsInitHandle 5424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5432 -initialChannelId {a5ea9cec-4093-4ab4-a1ed-eb0c96025855} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5604 -prefsLen 32952 -prefMapHandle 5608 -prefMapSize 270279 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {b47062c9-ad1d-4896-ab41-c21e5f659aa1} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 32952 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 5808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {2a6fa62a-a8b0-43d6-b1c6-37609b0f3916} -parentPid 880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 b9eb982e571ef9b0d664b669d23c61149c542cc0b502e5c92cb3c20025b40240
MD5 7d729c457aad478210046f47fe43e471
SHA1 3ffe7580f6b0d87bcb56bf31449cb1f844f50e08
SHA512 aac5470abe2c6f0414f643b2c4b7865b3016c518036b33a39edaf517505bd85db404bbf950810edd6a1b7d3e777824af802b4618c7c118e15c70751578e67327
SSDEEP 384:H9XghOiO024YcXdcs3hk2nhfdDE2Ba/rIVy8e+aGaM:dX+ZYgdv3hk2nhfS2sDIVy8aZM
TLSH
T14A729DBB9F106C5D1D67D585C8AD8369DD05FDABCBF690A608203589CB8432AF0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

100ce626-4ffa-48e3-914b-a4da91c40b03.zip

Path C:\Users\Admin\AppData\Local\Temp\100ce626-4ffa-48e3-914b-a4da91c40b03.zip
Size 3.7MB
SHA256 498cd95d4ad3d13775954bc0a3cfa5c98839545f3a3e62ebd7ec1dd4337a2cfa
MD5 816f5ce3ca8627515b2f6852c703ac4d
SHA1 7e6ad6561f45c5b196c808b3c95fb37dff687938
SHA512 bcd9ad8fd4715c8dabbd58410a9e34b80f828950a0dd2834ac302dafc17c63b9bdf3b73f340fb77547cd8da18effb8843d61e3896d388c2d5e70419ccd9a4b6a
SSDEEP 49152:nnNHRvMRBzv6NJSkZm+TrRV7bZA0pwQhQCgm+T2tqwSA2q8GDxtoGEB9cWucbUMs:nNHVS/w/bZbVwT2tNSARDbeTbUMZhg
TLSH
T1FC06F1F5D65C16C9C9CF83BACD0C3FC2984C7FA68054A96B6A6E9971DCA31E31B74840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 54KB
SHA256 ae4f59bf691fdf84a65df7222e034c06ee838ef4dc7518389c495d9bf98feed4
MD5 be38d9be22d075bb219c9029790e199e
SHA1 b0a60432eeb8dad6e312e76d14e544c1c9a1356e
SHA512 61518285357a4c935ecec59865b6adfada5694bf06c6a08844173e2c4e126cf5d11d47313877b954f58862a3bb37dc0610e7c081856bb4035ba2e7669e3648b0
SSDEEP 1536:G3AwUTqgunbKtawUIMsNQPLJVIW1ht+mfto9v7:G3Ajm5nbguWSt2MtpSD
TLSH
T1A7432244EB1E953FD82802BA9C921B007F79F889590A2FA7371C54786D873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 54KB
SHA256 d5933546b40d40545577c9fd0b798a349a6002ee2ddda7eb077240b52e3e3211
MD5 cb54624222f97e3b738bee736c09fd88
SHA1 45f27dbccc258454e4b7b685e458f9afa1aa436b
SHA512 dfe48f0a46e1f0bde96178c7bdf6be3380128a763e6b4262a496552c03901c9cb6955959b7d6888dd5ab314a057232c2df739a1efa917f811f9412c2641e4efc
SSDEEP 1536:P3AwUTqgunbKtawUIMsNQPLJVIW1ht+mfto9v8:P3Ajm5nbguWSt2MtpSE
TLSH
T181432244EB1E953FD82802BA9C921B007F79F889590A2FA7371C54786D873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 54KB
SHA256 4ad869eb3f3711e42bc7812000535a8c978b1bc7fc4a9e727f470f037d721fd7
MD5 1c04863d10b2c160968f22c2e9a8c380
SHA1 34577aba9976696e8fb83330b3fdd6cb0380d00f
SHA512 5d2a895fb8aa0710cf6055173ce5560f40d6b9b35bc7d132c9d59d2326a72fa98acb637dbed72fdf3c27c23e6a15a28e640ae82981c50310cefa622de33b66de
SSDEEP 1536:33AwUTqgunbKtawUIMsNQPLJVIW1ht+mfto9vM:33Ajm5nbguWSt2MtpS0
TLSH
T166432244EB1E953FD82802BA9C921B007F79F889590A2FA7371C54786D873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 854dadf821d7d2aae60fb73a3df607e9247c2135c7983d5477e78b9a5c0e2e88
MD5 e65110dcdd27b9366bf3af6e5083aed3
SHA1 49773fab8cfad36046d4285d7e44fabc01ca735f
SHA512 d3b855e6f1fb5663177ce49dc32cd32887adf7e1bd8e07bc4cca9eb0487fa86fdb28f4bbc630e89b332c283ca6a7d752e0194d9c0492bea87badbb4a179441b2
SSDEEP 192:aOv5zboJZ+fyjq+/1d66JozGzgCl6mc0d:ZboJZ+fyjjd66JozGzgC1j
TLSH
T18DE11D68EA28867FC408427BCCA61F414F35398B9C4E3F18759C641C2D5B2DE3A9E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 65e4227fede080b722084ca4232441529653f72a8de29d734c34b793175d1084
MD5 8524b010e4d6b0c3daad671a9fccdc6f
SHA1 0d31391645863aa47eeeffc0d5af5c3903cf64c2
SHA512 a6767eaea54042420527a08816fa3e42e4967a532c6ecd96d91f236d853a1c16baf3eafdad9bb6cc8c4822ba2c562582907286c62a3d8940cbed1793fbf5cadb
TLSH
T19D618558F2298A3EE4458139CC861B405F707443A8AF7F2A39AC604D1E5B2CE768D17E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 404a524078bd3020fe46f09c2931780f3275f16cdaf2983dc793cd91591fa05f
MD5 07eaf1627100024e0f07dca5d855cc74
SHA1 938d7ad4ba5ffb8460c00a56e28712540116c394
SHA512 023f5cad456648df89ed33dc52e4fa70308f015ca5e66d304956ad566ba37b32110e96447b971a4b31360de699c0ba226a2011fc1a21c93de61e74478dcdf8d0
TLSH
T190217C5C79B94D2AACC7E2AC7841128E93658E86048B1C431D22FE8DCE81EDA316E43D
MD5 SHA1 SHA512 TLSH

Submit Download

0124a3dd-37bf-4abf-8aa6-733c288e186e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\0124a3dd-37bf-4abf-8aa6-733c288e186e
Size 15KB
SHA256 f1adfe9b3dbe849ad4c9997971185e6f08ac4fade9d2fb7b1fdf286a215f3fe5
MD5 33bf5803047e8d7f4c5ab7121dd7c513
SHA1 c6504bf1b078d6c651e0ae35965b876817883127
SHA512 0c72829795f5dbe75bb9d761f5973308a98216c24837d4ca9de110c600fc98953b90697dcacabb2a06c4e536fc6b7beb2c3d391083ec16e1896e911e431104fa
SSDEEP 192:H8wOpB+1KNaj94ZZsWDagE2zHghC9SKzH26lbODf+cE8X0jGr0fqwjB2ji1aqD/n:H8li5WZsWDN78eSKb26lbODYVT0f3DQ
TLSH
T13A72EA56283045BA8291E3A894ECBFC3E5F528CF4C415FCADBE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

409e2d93-b0cd-4862-9985-ed2bbf4ea79e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\409e2d93-b0cd-4862-9985-ed2bbf4ea79e
Size 235B
SHA256 61f301986d8a71d4bd0a0c5e49d9f66b99a6d4cbe531df04f664ae02f138b4a7
MD5 94fde1ed12227128543f230c094c6811
SHA1 ab5d29bc170974c5ca070c550205f553e0bb9534
SHA512 2919a6cd6703d0dc9c2dd6df91027a4ad56fd821ed2e4fe78ba8917596373538b6e44e890a4ccd09352161a13ec08b40eb897be2fbdf310959fc4d42b37eed71
TLSH
T1D7D0978254D8379C48040F07B0E069C270C54C3310B0EC94DDE00138E9BADC841A1A0B
MD5 SHA1 SHA512 TLSH

Submit Download

46d3b886-ef5b-45fc-ac06-3b5ab62760d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\46d3b886-ef5b-45fc-ac06-3b5ab62760d9
Size 883B
SHA256 aa257f3b34c83257e951e6a2b1c64d37d481ddb7a78c9f53047bd922aa0a7607
MD5 ba45e53170d850fdf55c39f5b3355c3e
SHA1 44e63368c081bd31bc6e7c87836f5fd61202c57b
SHA512 3daf22882daa3792715bd085a53ede8711126cb6fd4111b23f69b2d8eb8e3619ade78e6333958582e79ff3beb4737b08370efc6853ea2ef639ed0830c1c33a3d
TLSH
T1A811C0459A74B8B3CC68D24BCA9677028BE4B21384CA54043EA569290E7E91EB76630B
MD5 SHA1 SHA512 TLSH

Submit Download

65a91aac-fc87-4609-b8dc-7c6f2ee9f84b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\65a91aac-fc87-4609-b8dc-7c6f2ee9f84b
Size 235B
SHA256 8be4b5d45899a7a37f27288b2d90b5914df47d0b5b9d5126e0a729a9e0da1ae3
MD5 fc0d8d6ebffad45f58a2b421d29ef431
SHA1 dea130d0158c5a246b81b5c56b10bf032b309a7b
SHA512 429d6e0de6dff5673d2316b93a4bf6729e9979af871ebffb253a195aee08a47c3424a370d6075a67fcd2694ca7eb1d2238b979652ca5d38e89d13bc0feec3d48
TLSH
T1AED097D054886B6C48280F23B0A428C6B0984C336068A8309A6042389EBA9C84251C0B
MD5 SHA1 SHA512 TLSH

Submit Download

916e68b9-f7c6-4821-9b0c-a72b484bb9ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\916e68b9-f7c6-4821-9b0c-a72b484bb9ca
Size 2KB
SHA256 9115aea9341061527e05310d7807dbeb9d8cc40d5982b0be719a5452c68c2157
MD5 80bb6ade8a40fc1bbf8f05b0a47e7bd6
SHA1 774ba995a7210153b36145c2d109cf15c5d33015
SHA512 9559026b42ca2875e26007ea42443da8557097980a7476d7f6facf616dd6231a86e6019d9c5067c80540913c0888074f12d003186341ac2614a54a6376ef7751
TLSH
T10041449C39785CB74CEAE58DD583234D87A58B0300C618436D55EF4C8C9AAAE337E53B
MD5 SHA1 SHA512 TLSH

Submit Download

b62bd48b-5d6c-47cb-b8eb-4d62aaf547b7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\b62bd48b-5d6c-47cb-b8eb-4d62aaf547b7
Size 886B
SHA256 3d0954c6f7be65b6b2d93f30d42753eb0d30fa3d06fd2a8a0617868836933c3f
MD5 ddac1daf6a556d48587a1073bb3db057
SHA1 089778655dc05ec9984b278e199de013cb6c188c
SHA512 738ca53dd5c65069ad3a05f96fef9fcc7b90e3d2936ba56ce41a14ccd69e73b4c8cb3f81010def5019f5cf82cf488c3284dab051d4d43da4ada40ef63514a15f
TLSH
T1E41127859A74B4B28C58D24B85D677428BE4B213C4CA04147D615A2C0E7E55FB3A6307
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\extensions.json
Size 16KB
SHA256 d68192941c1846fe44d8267478b8ab22b0a8b4f8eb7408b1d3b492e6c41241ed
MD5 fa1e0a739486d3577552f16b307d816d
SHA1 f7cb1331861ea3d05f558da9cf48cc12c9aab46a
SHA512 63fd8a8683ed92e42317af6cfe5fc84f4c6ebb0fc7a3e1a2268c9131efa96fa5fe608f8c28e0a3f0d33b27e9c82178ed61fba33ed495b32153ff2b7092b6f240
SSDEEP 384:HkI4vYUmldvL8dhW894z/96ozL4HHL4P/L4HdL4HsL4HBoV4h0:EI4gRfoXV4J684L474d4G4hM46
TLSH
T18372531545048EB8294FA78AAA367E02C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 6KB
SHA256 bf06ea268dfd05f78b8dc9d58027608182c0ceafa8368c79d592c5d28504fdf7
MD5 ef8ff741464b0020a1fd85fb97a494ed
SHA1 b9162687b3c391ebdbbbc7ba10a67747d7f40795
SHA512 bf541dbd1a97112f113eeb04a54019b9417a5b5b834554de082aa613c76a0f58926f994dfcb3e6f7e86cafb3d765a576da2dfb95cb6198c92e62dd448ffc38c2
SSDEEP 96:xHrUTUmqGq6fz1p1zSVvFSSlfdv9jMnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fz1pUNSSO9NWBrODBw88Jr
TLSH
T122E120789508CF6F74B677ACAC6488716AB2013BB7BF68D710B59484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs-1.js
Size 7KB
SHA256 1c31fa001d9e7198a02cc2e295cce7e21d54deef39af3e914a06bf01ec5c5ce1
MD5 094bb9084bcb20de1942495afdb6d180
SHA1 a6ae808efc2c39916696d57f2f35500b32fa8f25
SHA512 ff9b9608c2dbe2c42b56e770dae862efba6e19071fec3ea4dfa94dfa5a0208e8310506300d47c2cf5494c0fcd75cc8bedc3d8824da0078854b7275ae6542a8a5
SSDEEP 96:xHr5TUmqGq6fv1pObzSVvFSSlfdv9jMnpRHNWyS9JO2Bw882+8L4cnuFPqGS:1ER6fv1pbNSSO9NWBrO2Bw8824q
TLSH
T1E5F10D789104CF7F74B276BCAC2448319AB2027BB7BF68D650B99484051CF3451FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 ce1cc7dacbee5e2882ed0985842405d907329c107a952ae644efe3faff85ef3d
MD5 a6bced39467cc75d12f3384f2a2d6399
SHA1 326c6b2126611a52458ec273120b93dce1a37afb
SHA512 b8fae5298b9bff930f7e4aa8e09297c87d36265fe847ce8bd92ba6e56837aec1f30a1182309e2bb8f53533ba98d3fcf4ee64a406e1e2ff15c03073632a118811
SSDEEP 96:xHrUTUmqGq6fzUL1zS5SSlfdv9j0npRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULgSSy9NWBrODBw88Jr
TLSH
T147E11F789508CB6F74B677ACAC6488716AB2013BB7BF68D750B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 12KB
SHA256 22649b8d6f3d2484499901a8d93d925fab14061efaeb713193aebb90ba43f7a9
MD5 ecdcc30a4212388a342bc350fe3a0864
SHA1 b2bbcbb632f0967393509ec77c044077fb2e747c
SHA512 5cd263e91ad4136ce44dda538e29165dfe4f0032f5a8589f3f4b14c40f084b1af47b786d73775ba2ed1a2413eb90dff0ee3773ad1daa0fdc65bb5a55e7211305
SSDEEP 192:iER6fv1pbNSSOXLR0rWBrOUOBw88i0jqT7nq:4P+RIWAvwjyjq
TLSH
T1F242DF38A1408F3F20B3327E6C215D709AA10267B77FBCD319F9A491445CFA461E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 d6c788f72b2edd75a145cd53e6ba09f5ee08722ce9917f10a9b82e7989da25a6
MD5 183d382d68f454bfc84a7bd761c0162e
SHA1 a70f8f441ec6c083103bad2f66f6144a387381da
SHA512 8459a62c82090e40ad64961c56ca9cb5eed2ba605cd9a56f5fc74f57f6d20aa546b4d0e8f4da7ccb8b67f3ae1ebb042a846e4db228e4f65bfd8e221edd2d1833
SSDEEP 96:xHrUTUmqGq6fz1pObzSVvFSSlfdv9jMnpRHNWyS9JODBw88n8L4cnuFNj:1BR6fz1pbNSSO9NWBrODBw88Jr
TLSH
T16FE110789508CF6F74B676ACAC6448716AB2013BB7BF68D710B594C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 fd43860824bc2637dd2341d22e332997d4418027176ba4a26be1cf8ca2d20bb8
MD5 34bba9e2ed4688545b247ddbdcb1856b
SHA1 fd419b714b4864419586635b8baf5f8b15f44b85
SHA512 991068bfd7c4a2d7d7e9e4a2190582b0330d3c6f48b379d8890daa71bb7f8445e0af6e2912d2fbc7ec66d39dd1f9ceff7301015bddb1b6ce7f1546949bb4446e
TLSH
T1BE211943D50A3DE87AA2511DD8854FF1C346702A00B688F082CFCC8292DF2CF3207768
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 1a47ed2882f0fa61c5411cd6eb5d42a740d1740af1151d14253f552f704d6d71
MD5 127245f8e4f4e8516c3f73a8ac3a05ba
SHA1 f151680501de1702eb4e3c1213fb8a1dfee87813
SHA512 b422371b711906729f4b6acf6890beeb4a42f8779ac163bfdc309307038f5ae3620a06cbe4e8509e9eb8aca0986cfd6f2e619fbd0764b9ada8da6fc5918456cf
SSDEEP 96:+jve4LESQSDfDW7fLJocqx1fwGdBTLGu809KWpvCHlI:49EY7iqFxJw29LGTr2KFI
TLSH
T167916C88B3063CAC7E39AF04B8D52F528351BD26587BCDD5D4856D010A2976D798AFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 95b28519fe1073592779b805e40dde7fca196066c90adcfedb671e9319997360
MD5 915f0e2cb277e676c917707e2f877518
SHA1 dc52d2ce1ac85e9518b4cffacbf95eff2b81a607
SHA512 b8436e446330d383da3fd29b02c893fee4bcd8e21b032a3cc9d020b1b9c8e075e31c8a86658b127ba66474cbba6305e6af9feae5e0fbf91cb3b121bbca6d95df
SSDEEP 96:+jvL4LESQSDfDW7fLJocqx1fwGdBTLGu809JWpvCHl+:4AEY7iqFxJw29LGTO2KF+
TLSH
T197917ED4B3063C9C7F35AF04B8D51F52C351BD26587AC8D5D4856D010A2976D7986FC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 39ce8776ab71b2f88ccac28e30ef71ee2110988065b0c77a545c4c3cf1fc3d90
MD5 2b75c22aa07bdaf0c58f70252a7b407c
SHA1 38b76877eea8c20a9d3567a910c711f956d561ec
SHA512 bfa3d8b8cf898f1d2bbf8d2da8a37ec4b25580a41bd0fff8d6d1d9d1141b5335cf06479e25cd48a407006fe50bb5131518d7a60104a27428bfc529af5142d909
SSDEEP 96:IjvT+L4LESQSDfuW7fLJocqx1fwGdBTLGu809nrZp2hp:mL5EY7XqFxJw29LGT4rfM
TLSH
T163918EDCB20B3DAD3E39AF04ACE567128315B92584B698E9C48A5C000F3D79D7986FC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 11.2MB
SHA256 23da719394c2bbb6a69df30c6e0e2ee3f6db1700b3adb9f2183c8c2c5bb5f298
MD5 6c1b4be618de1b81edc5767be81d72b0
SHA1 bbac3b1467cf9e7766c3e3ef6429e517ca64893c
SHA512 91cb35fef49aad1355fdf0201717ff4eafadb4fa28259f2095644a10f173ff19f4c17aad3cc45b92966a1388b973177c6c7dd5e61fce1dc23952d7d2e917c41f
SSDEEP 49152:5SLZLyOaeUT6QC5zYYOf2J5OltzRFzdTJ66uoogyHvWgcH/qubCzYuwAZE1ZVd80:NDkZE1Dd8cymBVhOEq
TLSH
T1F3C67C9570D0D692EB4185B7F34F03DB31BFC18C20A5C98017B8AAB868665DBEE5F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads