hxxp://74[.]112[.]77[.]213[:]4567/

Analysis

user interaction
yes
max time kernel
32s
max time network
46s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://74.112.77.213:4567/
Sample260718-pg3mqsew71

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	firefox.exe
Token: SeDebugPrivilege	2608	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe
2608	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2608	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 2608	5536	firefox.exe	87
PID 5536 wrote to memory of 2608	5536	firefox.exe	87
PID 2608 wrote to memory of 6120	2608	firefox.exe	88
PID 2608 wrote to memory of 6120	2608	firefox.exe	88
PID 2608 wrote to memory of 6120	2608	firefox.exe	88
PID 2608 wrote to memory of 5716	2608	firefox.exe	90
PID 2608 wrote to memory of 5716	2608	firefox.exe	90
PID 2608 wrote to memory of 5716	2608	firefox.exe	90
PID 2608 wrote to memory of 5716	2608	firefox.exe	90
PID 2608 wrote to memory of 3696	2608	firefox.exe	91
PID 2608 wrote to memory of 3696	2608	firefox.exe	91
PID 2608 wrote to memory of 3696	2608	firefox.exe	91
PID 2608 wrote to memory of 3696	2608	firefox.exe	91
PID 2608 wrote to memory of 796	2608	firefox.exe	92
PID 2608 wrote to memory of 796	2608	firefox.exe	92
PID 2608 wrote to memory of 796	2608	firefox.exe	92
PID 2608 wrote to memory of 2872	2608	firefox.exe	93
PID 2608 wrote to memory of 2872	2608	firefox.exe	93
PID 2608 wrote to memory of 2872	2608	firefox.exe	93
PID 2608 wrote to memory of 2872	2608	firefox.exe	93
PID 2608 wrote to memory of 1708	2608	firefox.exe	94
PID 2608 wrote to memory of 1708	2608	firefox.exe	94
PID 2608 wrote to memory of 1708	2608	firefox.exe	94
PID 2608 wrote to memory of 1708	2608	firefox.exe	94
PID 2608 wrote to memory of 852	2608	firefox.exe	95
PID 2608 wrote to memory of 852	2608	firefox.exe	95
PID 2608 wrote to memory of 852	2608	firefox.exe	95
PID 2608 wrote to memory of 852	2608	firefox.exe	95
PID 2608 wrote to memory of 1316	2608	firefox.exe	96
PID 2608 wrote to memory of 1316	2608	firefox.exe	96
PID 2608 wrote to memory of 1316	2608	firefox.exe	96
PID 2608 wrote to memory of 1316	2608	firefox.exe	96
PID 2608 wrote to memory of 2564	2608	firefox.exe	97
PID 2608 wrote to memory of 2564	2608	firefox.exe	97
PID 2608 wrote to memory of 2564	2608	firefox.exe	97
PID 2608 wrote to memory of 2564	2608	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://74.112.77.213:4567/"
1⤵
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://74.112.77.213:4567/
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 26983 -prefMapHandle 1952 -prefMapSize 270110 -ipcHandle 2036 -initialChannelId {61ec87fb-897e-418b-b183-0bda55e47298} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27019 -prefMapHandle 2436 -prefMapSize 270110 -ipcHandle 2444 -initialChannelId {bd894a7c-9c0d-4486-a74c-c5f33c34236a} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25069 -prefMapHandle 3856 -prefMapSize 270110 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {79e1b17a-542c-4018-8b33-1b441727cb84} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27160 -prefMapHandle 4032 -prefMapSize 270110 -ipcHandle 4112 -initialChannelId {d404c2f1-ca54-4bc3-9155-058b8ffdc388} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4540 -prefsLen 34780 -prefMapHandle 4544 -prefMapSize 270110 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4556 -initialChannelId {93715e0f-0179-4c01-84b8-9b74b6c586e4} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5068 -prefsLen 34971 -prefMapHandle 5072 -prefMapSize 270110 -ipcHandle 4948 -initialChannelId {7235c159-6a88-4618-972c-5f2491a354e7} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32928 -prefMapHandle 3096 -prefMapSize 270110 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3216 -initialChannelId {87175cdf-4318-49b6-a8ba-a737a4e476d2} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32928 -prefMapHandle 5516 -prefMapSize 270110 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3076 -initialChannelId {34e33169-09f6-4069-a1a9-f5b1a0b655ad} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32928 -prefMapHandle 5852 -prefMapSize 270110 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {57a13415-ad08-41cf-8d57-df0058b0e571} -parentPid 2608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 45a6020dd7dc188755dbf6f0b4c24d7836ac1f88fd9ba0e3a38fe87bfc9fe519
MD5 4ab49c32996f2dd4e70a861978c1b79b
SHA1 5ad4e4f88bca0307d3bf3dd481af592baf27e086
SHA512 5173ad4e6de250eaff3963ea51cf28b59453a687f66d51aefeb0c98fb27a1881b1b11ae12ed9035e8ecad48e47f9bb54b412051692f106267bd128e923c74260
SSDEEP 768:9yW6J1t6uLO9qsMT9Y72qXWH7hOh9Nr4Q7OHbKuGahuJFyI0TDetg4jhldyH/gmi:sT19O9IyX+o9Rc+R3tg4fmXre
TLSH
T1E97319E396B9B1FB1BA137C72C0FB65712E20595E74506C9ECDECA2C81CD654023A6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 658d393c55d7e9c7baa091466d5c95a431cd792ab501a1dab94bea2bfb60c8f1
MD5 e2cb96e9cc93931ba4c98320e896e813
SHA1 709f0cb05e51740ee385dd478341c8489b296ab9
SHA512 fee7ad94395ce6d520cea16ffa866e708407ab24ef93263d0c184fdee90001dc1864e79ea4305004ebaae44537ffeb72f12eb2ba3ed696d318450c0c96fd22e4
SSDEEP 384:HwCe7iO024Y2dcs3hk2nhfdDE2Ba/rIVy8eY7+M7+p:QqZY2dv3hk2nhfS2sDIVy81+g+p
TLSH
T1CB728DBBDF516C5D19579585C8A98365ED05F9BBCBF680B608243049CB84326B0FA09F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 58f5eb86d7abbd40afbf23e343ddc338b92db4156c798ca5b177a495af210d00
MD5 c3b21e6215b4f0d31e4fe2b5d79233a9
SHA1 5df743ed83517859744045464f141caf22240893
SHA512 0049d8b9ae4b2901d370bb70a9bcd30434b560162ba36ecaa03de3210f88629f4f25aeb33df8d91d17b46bd2f9795d8dc6c60681e7458f4b53fa3966ab56caef
SSDEEP 384:H9XghOiO024Yhdcs3hk2nhfdDE2Ba/rIVy8e35kUW5kUU:dX+ZYhdv3hk2nhfS2sDIVy8+5w5u
TLSH
T18B729DBBDF106C5D19579585C8AD9329DD04FDBBCBF690BA08243549CB8432AB0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 1.8MB
SHA256 da3b1df947e14ee173d955274d442cc9e9b5abb826c1215dcffc87732a9a932c
MD5 8bf4adeb75866a3f12b917315a213da5
SHA1 c955d5c5fc041b1ba4ca4e7bed5ea66f3f0a8729
SHA512 d41b89d700520a2d53bf7c14723dcf22e913d5f9c77bc595fb79454aba5c5ee136d57328bfa2785ddc56e23af33af66d046cf777b6d3460f64e0f51e4b399681
SSDEEP 24576:8tnoz82AYPxoJpyj4y83c7aDYGR+WPtFdLAOg:8lRYPxofyjNa5R+WPtFdLAOg
TLSH
T12B8507ED937351391D1F9CE05A3D69A1481C30AFA029D3B909EE897552B1BCE3F1AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6aea052f5981d7d83a3bca6364830dfc022604f180a9db35fa8e8fc07c56c947
MD5 b53abffb50e886aca18f287601d192a8
SHA1 756df0ad6b04296ddc16c3786d3188eee466bbb8
SHA512 907413794ef21fdcd8fcba8dda8c62b678c2285fe390ff8043a27b60d0aa3cafb4e43e8d1500ad88d810fe0a5def5c1ece39de119cb6486b256e6f9b5b388695
SSDEEP 192:jOv5zbo7wZ4hyjycC61d66JoztdzgCl6mc0d:sbokZ4hyjvd66Joz/zgC1j
TLSH
T14FE110A8FA28867FC414037BCCA21B410F79388AD84E7F19759D24582D5B2DE7B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 be117fd58d9a5350b3b37a3ed03b3c9840b61e8d3485b92f849bb187f0ac2100
MD5 75d4c84a747d912f23af34fc47460298
SHA1 b209fcb5696e8f9fec9bd887efb91c9377d477a0
SHA512 449d24c518c8a37c3aa391cfd34edf50ccfb5423ea54145c239b332b9c44d532c0289608046832b0cd503ee45c2f94808310f22a647b21694f71d90e8db81761
TLSH
T1C511809C39B88D6A99CBE25CB442118E53224B5654431C830D57FF8DCEC2EDA316E579
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 2KB
SHA256 7c9946bbe5d3e9c28b5673a1169160883b0a6b448030338dca68ca65f62e3202
MD5 3ee8b784fdf747452b4728d9926aa6cc
SHA1 23e0007cb25dc1e068da8b8dced8fe31a729f05f
SHA512 bf0d2c4bf2833bb61372291ac14affc7d08e9fcbd0e055bc0e2e96514c1e677e171909dcdddc391465e8d7bab5718fec49cbd90b7e7eda95df2bf5ec0c2a4963
TLSH
T1CB51AE4C61BA4C7E6CCBE39CF801068D52964712D4831D834CEBEE8DCE43A9A325F56D
MD5 SHA1 SHA512 TLSH

Submit Download

1e59d1fe-8dc7-41fe-9067-eb6d64bbe4b2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\1e59d1fe-8dc7-41fe-9067-eb6d64bbe4b2
Size 15KB
SHA256 0608f0bcd2cb10c99b4f4881cb7d215da794f31108d9d44049149841100372db
MD5 d37af157b385de14bc4c201d544d6c0a
SHA1 5d07711b07f2d588944ba2a2c4e64f5c98d2c507
SHA512 3a9551560f61b82545d10dea86b3b7a5c4f8b41668b5feec6e4e90b301f7c813d1a93847556ecb203ff10dfd962336568899ed9791c6cf0d96634d5cfc2e65dd
SSDEEP 192:z/4C7QyC4UZw09s74BayUy1id9Y0BJZcaDEKPARj50zxSyUUrAAmCE1zBAXd4ht:ep+y4dFRccEKPARj50lSyUYPqPt
TLSH
T17862C9566430497E8691E368D8E97FC3E2F518CB8C019FC99BE47D0869EE0AE5127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dd668db-76cb-4b8e-a2b7-8e1b12363838

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\5dd668db-76cb-4b8e-a2b7-8e1b12363838
Size 883B
SHA256 b40aca3b40f142e25ad03ca7ac177b253d9ce9a47b007b8aa522ab6133dd126a
MD5 9dc2fe4fb9aa25173facc31d209e6390
SHA1 8df68094e0c304ae019a9559cf095213034b2d4a
SHA512 227b2c0ef528d5b2f7fa768afec1406b18b003b21d3270ea09e9535b16b3c130a1732b1fcbb7aa46b1e4c25eda396a3c5b1cfa7717c1b1fd576877529306a2ca
TLSH
T110110054E535B6F3CC78829B8991370687E4F423C4C695143DA54F040E7F20FA75B247
MD5 SHA1 SHA512 TLSH

Submit Download

759139a0-3400-4d33-a796-5c83d19f1d68

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\759139a0-3400-4d33-a796-5c83d19f1d68
Size 2KB
SHA256 81011a97982965b6e7174e94029f916d1220174e9af9acea99832a38ddd5ef52
MD5 130efae8ab7800b2ff6db3c996b8bd1c
SHA1 bd1d75022179eaf9552689b0b1be0bdf91f5402e
SHA512 b0ad0dcee0b067cc6ff48ef24a7092bec9d3b600e0832d742fd60844740bd6ace28c80075ead76a128a290c311cbd0b5bd27ec3c257faba3466b0a6d28076d6b
TLSH
T11241536C34789E779CDAF25D908233CE87A49A1340C36C432D45EF0C8E9279E636B42B
MD5 SHA1 SHA512 TLSH

Submit Download

84b5bc0d-cdcd-4bfb-9da4-f937cb8b3210

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\84b5bc0d-cdcd-4bfb-9da4-f937cb8b3210
Size 235B
SHA256 6e8100b82f46a4a7049ca7fd210128738f165085125ec8bd4fa427c733934d3f
MD5 010cd157450d0fc2efe57cd7cec6e442
SHA1 206af2d4a9cf720c4d90c46309780e37accee0d3
SHA512 5d818c650dc9d96435065d59d40249ac8c3541ad631511ef2a0cfd467d8064af7038f519f02cd24f9f39bd6d33cbff5b83599f7655996ef05c9892e7404112ef
TLSH
T104D097C5189CB72C08100F03F0F07DCA306A8C33A4B56C10899400BCAAF9EC441B281B
MD5 SHA1 SHA512 TLSH

Submit Download

be470926-a51d-4d4a-b652-0619e3830a4c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\be470926-a51d-4d4a-b652-0619e3830a4c
Size 886B
SHA256 f8226cd6ad7c0df5c29c6900af83b3c57a2ec9034adebc9b20de09ff34fb5bd1
MD5 88831d4e0a6b440b7ae402ad763eaa6e
SHA1 58dde1efa2b6bc7379e4e8fd0d5945ae8b784204
SHA512 9ea9fca81bb821e475b39b388ea55d9498bf78592ac4157cec20f93bef031c497f8d9d79f7f7af62f23a85910948285fdfbe395f72cade7859397fcb841d6ce0
TLSH
T10C1100A4D934B6B3CC7C969789E1370287E4B023C0C649047DA46B180EAA14FE7AA24B
MD5 SHA1 SHA512 TLSH

Submit Download

c35af70b-d33c-4a0c-87f0-8995ade02699

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\c35af70b-d33c-4a0c-87f0-8995ade02699
Size 235B
SHA256 325b206b26bc16f795a0ec2dbcf646fab2e7d877c4625e2a66271850ebf03eb0
MD5 2402e097f9d577e02dc7d00c3a82b51b
SHA1 36f418ea8784222f183a4b13e4578033b8da45e3
SHA512 5bb1e28e84c43dc0760149ddf296773c3eb75a55ba37ae6a92d5ef4c973c050a3e9af95cc1c937a55be470ffe1eb71fc583c179a48e52c8599bac58decba8a94
TLSH
T1BBD0978118A8732C88080F03F0E128D230CC4C372176E820DA600634DAFEDC40191816
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extensions.json
Size 16KB
SHA256 9a6ad5dcdefaae0fba9b9934973810fe302825f492a5e75d18c13c901caad813
MD5 6987324d441ddfaf0e53e92655bda0a4
SHA1 9daafa928d61898b4f9f7e2a989e945d6f9150bd
SHA512 8c6216faec0ee69040c91293adf03480ce16f8297a01b77966437794755c18dbec4cf2515cea5f093f472ad9bd66681a79f4b52393a059654e6eed4976008fb7
SSDEEP 384:9kI4vcUmldvD8dhWr94zS96oJL4HZL4PGL4H7L4HML4Hck4hj:+I4kRfQXC4q6+4x404H4m4d45
TLSH
T19A72511545048EB8298EA79AAA367E01C37D533B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 4.6MB
SHA256 a6c3a7a1fff2d87939607bf0e858819f54cdb0b462c7fb7b11a2e893375536d5
MD5 a7727c2be77ac7eb481d735c3425e740
SHA1 70ded1b403650fce7c2ccbedb7c29a683526e949
SHA512 4d325e1142a4e27955d54735bb25949eb9fd60dd10ecadc219c3329100adb02de7bfc1a9e90aef020a019c71f91d881597dd1002d757f217b06969b4c25f6176
SSDEEP 49152:jlRYPxofyjNa5R+WPtFdLAOiXjfAl+RPQ4BEUXgYQFhMoeR9HQXxCFbHZWOuEXMc:jXYpvNa5R+WAjfAm11aGMFRGg6
TLSH
T15F266C8CA36310F9A84F8CF0466DEEB1D038385E1335D7AE17D58A3556B27C42A69F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 e01786c42417f3daa00088156f008ff0bdf58aa918dec26c7e4999686b53cd0b
MD5 b0361d70da11c866516fc468fdc6627b
SHA1 d48d2997965ec3a2d9da9e21e52ec2313bfb05cd
SHA512 ad36ed7832ed13d463d9ff7dbd3af26c3c36cf26b1817a23bc3b5dfa20241f0e26755a15339699b7a96a613185b83d01fe6cd618ccae55bb51df2e6aa5631d2d
SSDEEP 96:xH+UTUQqGqso1zS+SSlvdv9ynAHdA0ScSqBw8828L4cnEVgR:ArRsoTSSldA0ScDBw88W+
TLSH
T1BDD120785408CB7FB4B6776CAC648D716AB2413BBBBF68D750A954C4004CF3842E9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 7093dd453e23fd754ed702924f519b4fb524d9f971d8a6c742d9341e3123c836
MD5 257960592ad8d91d0b7c733af27ae705
SHA1 726f744df73fa80e54a68f16825b061ca3467606
SHA512 f593cc04032018b259ca177fc153ee954eb607acf425975d0a1545847405373289ceb098dbf411f68bec41ea60564e680999804ae7645f39e0094da3db19429d
SSDEEP 96:xH+UTUQqGqsfy1zS6SSlvdv9j5LnAHdA0ScSqBw8828L4cnEVgR:ArRsfy/SSbadA0ScDBw88W+
TLSH
T153E11F785408CB7FB4B6776CAC6488716AB2413BBBBF68D750B954C4014CF3842E9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 8abff4fcc27597c6de976f8455f5c25cfb616e4033031f5c5dd6d199987b62f3
MD5 fce0c68be5b077baf42af563adc3c4c5
SHA1 d44e9c973b09428d168049e822d74b8d6cd3cec6
SHA512 8e16814fd63ffd5ea5a4be2c6532834a89eb568e4408e1a4f9b5bf3bcedddd18e8ac9b00387b19dd6c86078c3f9322745a48f866af540f1ca8c6fc0e60720eaf
SSDEEP 96:xH+UTUQqGqsfyObzS6SSlvdv9j5LnAHdA0ScSqBw8828L4cnEVgR:ArRsfyMSSbadA0ScDBw88W+
TLSH
T1C1E12E789408CB7FB4B6776CAC6488716AB2413BBBBF68D750A954C4014CF3842E96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 8KB
SHA256 87d5062d28c37d5582d0bb81cc48753511ecc0ce18d3d50736ebcfdd7372fd54
MD5 90433bfd0ed749716be2c1a025fea75b
SHA1 b814a21abf88fe530a1bbfd5626a11a12635e14a
SHA512 30228601866ae48d5a90415bcb21c589d67000f3a89dbda205e2065af284880e321983ed36aea5c631131a82db50ecd93bb5fe1c58d05752bada9b8c110b928f
SSDEEP 96:xHEVTUQqGqsfyObzS6SSlvdv9j5LnAWRGhA0ScSlHBw88sU79C8L4cnEVgR:GuRsfyMSSbvRCA0ScWBw88j79S+
TLSH
T1EF020C38A004CF7F74B6377CAC6489715AA2023BB6BF68D710B954C4054CF3542EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 7a06960379b931f52ebb8e4a8702ed64526765b35a401bb010c22f2a5791810f
MD5 bed91cb7c2b5365285f58b78f1c7d16d
SHA1 00d5ef555957941eb22c096f3db3995057ec305a
SHA512 2a5932fc2b187ee949856022b3a4d1c590eb9be0e7bc4ca712683f7f08ca164c17fa0599c965a2a0ce9abab876d8658c7e7630e46cb59a96e83ead360b1f861f
TLSH
T16621E787685B1EF1B626C15E98421FF586BB326081B48CB0949E4F15258DD8E728220A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.8MB
SHA256 85f16f2992b4e175b26d6f37007f200e887c5b2534a760d8c3364ae20b2b1231
MD5 5b05ac2660c96b28162d6e777832f6ec
SHA1 cd19c6337e3829b85da5ec9e2e08691157b438ca
SHA512 401cf87b76e40504e9d10530575e4749bb55203d5f8ad6f79d2665f9786f99f4e91b227e24a9f5c7bf97b630fcfce1776e7fe2c2e0315f95426a6dfbcf5f12d5
SSDEEP 49152:mYyh9dQnYIYZo0ERUBElgN5BQ4RhXx4K9Ms:PrwnERUGM5BQ4Rhcs
TLSH
T1B6664BE960D0D683F3814073B24A43DB31FFC04D5066DA4817B46AE9A4758EFDE2B7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 14a5e4289632c65e77a26a6dc201892b8cf1ba1b1d750fdc4e93cfa5c282590c
MD5 f87e91a4f3c0343f1a1c55684d846c0d
SHA1 40d06758e96ffa06137b70e66eccefca9f8f362d
SHA512 0473feed81fdecdfe7f38d58b349b917519f1056b85cc955df9b8fa721fdaec8139e4644e1fade3a89aedccdae52175a90e411c5f0c1f0266933aefbf38e09f1
SSDEEP 24576:+bK9ncxmDmdxDF/4NzuAoYd1n1qbr3jovR/A5HuVcjYeEssaQXPdCGlD:+bKh9DQd02YR6wRuMcjYeEssaQXPdCG1
TLSH
T19FF52AF860D05293F3418036658183EF22DFE049A477D9581BA45BF995B8CEB8F19B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 2.0MB
SHA256 413913e625cf8024fb97ab708020d1829f6bc4d10b25b0a280252442d72db249
MD5 9a62c7bbcd97f375d246efa20a6481e1
SHA1 660e333b99becbd55df951b1f079f441d9aa9f5c
SHA512 f539c4575174433bcef616b10e5cf68018bd06082d68dd891abaf96703297cd118793da4be853cbc77af0fcfc9258a6e2849b8a5cd5f53fd6ff9653f6d77a57f
SSDEEP 24576:o6E9ncxmDmNxDF/4NzuAoYd1nuWjpa9ovI:o6Eh9D4d02Yq+dI
TLSH
T1C7A59EF070F49187F350D037694993EB226FD108A4B3DAD41FE413E866A4DDB4E1AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads